Hello and welcome back.
In this lesson, we are going to take a look at conditional jumps in the context of x64dbg.
The two most common jumps you will find are JE and JB, or its opposite JNE and JAE.
You won't see JZ or JNZ, neither will you see JC or JNC.
So these are actually equivalent.
So whenever you enter JZ, it is automatically converted to JE inside x64dbg.
The same holds true for JNZ.
When you enter JNZ instruction, it will be converted to JNE because they are equivalent instructions.
The same also is true for JC.
If you input JC in here, it will be converted to JB, and if you input JNC, it will be converted to JAE.
They are both equivalent.
JC is equivalent to JB, JNC is equivalent to JAE. So let's understand what this means.
So take, for example, you do a comparison instruction between - and zero.
This is equivalent to - minus zero.
So when - minus zero, and the result, let's say if - is also zero, so zero minus zero will give you zero.
So this means that - is equal to zero.
So JE is true.
Another way to look at it is when the result of the subtraction - minus zero equals zero, the zero flag
will be set.
So when the zero flag is set, then the jump will take place.
Because this is testing whether the jump is equal to zero or not.
So in this case, if - is zero, it will jump.
Now the same thing happens in the opposite.
If, let's say - minus zero does not give you a zero.
For example, if - is one.
So when you compare one and zero, you get a non-zero result because one minus zero does not give you
zero.
So in this case, the zero flag will be cleared.
So because the zero flag is cleared, the JNZ will take place.
Assuming this was JNZ, so it will jump.
Now the same thing is true for here.
If you are, let's say you have one in -, and you are comparing one with two.
So if you compare one and two, one is less than two.
So it's true.
So jump below.
So JB means jump if below.
So if - is below two, it will jump.
That is the meaning.
So here you will see something like JB.
It will jump.
So another way to look at it is when you minus one with two, you need to carry, as in normal operations,
when the first parameter is less than the second one. One minus two needs to carry.
So that will cause a carry.
So the carry flag will be set.
So CF will be set.
Then the opposite is also true.
Let's say if -.
If this - is two or bigger than two, then JAE will be true.
That means jump if above or equal.
So if - is two, then two and two is above or equal.
So in this case, two is equal to two.
So JAE will take place.
And also if, let's say - is three.
So three is above two.
Therefore, JAE also will jump.
So if this is JAE, it will jump.
All right.
So now let's open our template2 inside x64dbg.
Put a breakpoint here, and then we will enter this code.
First one is CMP - with zero here, okay.
So now we are going to run so that it hits our breakpoint.
And then we step over until we come to this line.
So over here now, we are going to modify the value in -.
So to see what happens with this.
I see. Now we're going to enter another code here, JE.
Let's see if I enter JZ.
Notice that it will convert it into JE.
So let's say, okay, let's pick an address somewhere down here.
Let's say I pick this address here.
I assemble an instruction here.
Say MOV -, eight.
And then I copy this address.
All right.
So I want to jump to that address.
So I will assemble a JZ.
So let's see what happens when I put JZ.
And I paste that address here, okay.
And you see, JZ is converted to JE.
So JE and JZ are equivalent.
So now we are here. I'm going to modify the register to put zero inside it.
So now it's going to compare zero with zero.
And what happens is the result is going to be zero.
And so it will set the zero flag.
Let's take a look.
Zero flag is set.
So because the zero flag is set, immediately you will see here there is a red line coming down.
And then here also you will see the message saying jump is taken.
That means it's going to jump. Why? Because - minus zero will give you zero and sets the zero flag.
Another way to look at it is zero
minus zero gives you zero.
So they are both equal.
That's why jump equal is true.
So it will jump over here.
So let's jump now and see.
It jumps over there.
You see that.
That's how it works.
All right.
So now let's reset this and come back to another scenario over here, JNZ.
So now I'm going to also do the same comparison, - zero.
But this time I'm going to put JNZ, but it's going to convert to JNE.
Just take a look.
JNZ, paste the same address, and take a look.
It converts it to JNE.
All right.
So now I'm going to run until it hits this breakpoint and step over.
And inside.
Right now I'm going to put something which is non-zero.
So let's right-click this.
Right-click this, modify -. I'm going to put two here, okay.
So now - is two.
So when you do a comparison, you got - and zero.
It's going to take two minus zero.
So two minus zero will give you a non-zero result.
Therefore, the zero flag will be cleared.
Another way to look at it is two is not equal to zero.
So jump not equal.
Therefore, will be true.
So it will jump.
If I step over that now, you will see the zero flag is clear and it's going to jump because you can see the
red arrow lights up.
Okay.
So if I step over now, it jumps down here.
All right.
So that's how it works.
Now let's reset this now.
And this time we are going to study the JB and JAE.
So in this case, we are going to move one to -.
So before that, let's run to this breakpoint.
Let's reset.
Okay, so let's run to this breakpoint.
Step over.
And now we are going to assemble this instruction, move one to -.
So let's MOV one to -.
And now the next instruction is to compare - with two.
-, two. And then we are going to assemble JB.
And paste our address there.
Watch what happens when I press okay.
It will convert JB to JAE.
It will convert the.
Sorry.
Let's enter JC.
Watch what happens when I convert this and I press okay.
It converts JC to JB.
See, JC to JB because they are equivalent.
So in this case here, it's going to compare.
It's going to compare one with two.
So one minus two, one minus two.
So that will cause a carry because one minus two is, one is smaller than two.
So that will set the carry flag.
Another way to look at it is one is less than two.
Yes.
So jump if below is true.
So it's going to jump.
So let's step over and see that happening.
It moves one to -.
Now it's going to take one minus two.
And you see, the carry flag is set and the arrow lights up, meaning it's going to jump.
And here also you see jump is taken.
All right.
So let's step over and you see the jump.
It has jumped over here.
Now let's look at the opposite.
This one over here.
Jump above or equal.
All right.
So for that, we will reset again.
And then we are going to run to our breakpoint and step over.
And now we are going to move a different value to -.
We are going to move three to -.
Okay, let's do this first.
We forgot to enter the comparison instruction, so let me do that now.
-, two.
Then we will assemble the JNC and paste that in there.
All right.
So now we got it right.
So now we are here.
Let's step over.
It's going to move three to -.
Now it's going to compare - with two.
So three minus two, three is bigger than two.
Yes.
So three is bigger than two.
Therefore, JAE is true because JAE means jump if above or equal.
So since three is above or equal to two, therefore it will jump.
So let's step over that and see it jumps over here.
So this is how you can use the conditional jumps.
Note that these are the most common jumps you will find.
There are actually others like jump overflow or jump sign or jump not overflow, jump not sign.
But we are not going to bother with that because you won't see them in x64dbg as
they are not very commonly used when you reverse any programming software.
The most common conditional jumps you will see are JE, JNE, JB, JAE.
Those are the most common ones.
So that's all for this video.
Thank you for watching.