Index
> Windows > jmp in binary |
| Author |
|
|
bitRAKE 08 Jan 2011, 05:15
Opcode E9 uses a relative offset - specifically in the example above this offset is 0x12345673 (stored least byte first). As you might imagine this offset is from the instruction end address - which is at address 0x00000005 above.
5 + 0x12345673 = 0x12345678 (as expected) |
|||
08 Jan 2011, 05:15 |
|
|
mindcooler 08 Jan 2011, 07:13
Why not just jmp reg32?
|
|||
|
08 Jan 2011, 07:13 |
|
|
MinhHung 09 Jan 2011, 00:58
To understand why 0x12345678==78 56 34 12 visit http://en.wikipedia.org/wiki/Endianness
if you want to jmp memory use: jmp dwod[0x12345678] ; 32bit jmp word[0x1234] ; 16 bit |
|||
|
09 Jan 2011, 00:58 |
|
|
b1528932 09 Jan 2011, 06:39
use little endian, most significant byte last.
calculate it by substracting instruction following your jmp from destination. |
|||
|
09 Jan 2011, 06:39 |
|
|
Overflowz 09 Jan 2011, 11:45
b1528932
dude, watch its 73 56 34 12 maybe author posted wrong ? |
|||
|
09 Jan 2011, 11:45 |
|
|
b1528932 09 Jan 2011, 22:19
dest = 12345678
src = 0 operand = destination - source+sizeof(jmp) = 12345678 - (0 + 5) = 12345673 |
|||
|
09 Jan 2011, 22:19 |
|
|
MinhHung 11 Jan 2011, 02:08
i'm said:
Quote:
i'm fail it jmp to address store in $12345678 ex: Code: include 'win32ax.inc' ; you can simply switch between win32ax, win32wx, win64ax and win64wx here aa dd ? .code start: invoke MessageBox,HWND_DESKTOP,"Hi! I'm the example program!",invoke GetCommandLine,MB_OK mov [aa],b jmp [aa] a: invoke MessageBox,HWND_DESKTOP,"a program!",invoke GetCommandLine,MB_OK jmp e b: invoke MessageBox,HWND_DESKTOP,"b program!",invoke GetCommandLine,MB_OK mov [aa],a jmp [aa] e: invoke ExitProcess,0 .end start b1528932 i think it only true if jmp short Code: address code disassembly 12345678 ED 01 jmp 1234567B jmp(instruction)+8bit displacement(singed byte)+2(because jmp short have 2 byte) destination=address+2(size of jmp short)+singed byte 1234567B=12345678+2+01 if you jmp Overflowz true _________________ sorry for my english |
|||
|
11 Jan 2011, 02:08 |
|
< Last Thread | Next Thread > |
Forum Rules:
|