flat assembler
Message board for the users of flat assembler.

Index > Windows > far jumps for far and je/jz

Author
Thread Post new topic Reply to topic
ishkabible



Joined: 13 Sep 2010
Posts: 54
ishkabible
ok so i want to find the binary value for the instructions in je and jz that will allow me to jump as far as a 32-bit value can jump.
1) dose anyone happen to know what this value is or where i can find it?
2) can someone show me how to type it in FASM so i can find it with the debugger?
Post 15 Jan 2011, 06:01
View user's profile Send private message Reply with quote
b1528932



Joined: 21 May 2010
Posts: 287
b1528932
je = jz. equal = zero flag


ocnditional jumps are only relative, 1 byte ranged.
you can jump only 127 bytes ahead, or 128 backward.
Nothing else is needed, since you can either use cmovCC or jCC over jmp.
2) i would choose hex editor for this task
Post 15 Jan 2011, 08:27
View user's profile Send private message Reply with quote
ishkabible



Joined: 13 Sep 2010
Posts: 54
ishkabible
thanks i figured it out a while back using a debugger, you can jump further ahead than 127 and further back than 128 using the 0x0F84 je/jz instruction. you can go 2^31-1 forward and -2^31-6 backwards Wink

the minus 6 is becuase you have to jump backwards form the end of the instruction witch is 6 bytes.

0x0F84 0x00000000
Post 30 Jan 2011, 01:53
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17278
Location: In your JS exploiting you and your system
revolution
You can actually go forwards/backwards over the entire 32-bit address space. No need to worry about +ve or -ve distances, they wrap around.
Post 30 Jan 2011, 02:02
View user's profile Send private message Visit poster's website Reply with quote
Goplat



Joined: 15 Sep 2006
Posts: 181
Goplat
You shouldn't call this a "far" jump. "far" has a specific meaning on x86; it means segment:offset. (Only unconditional jumps can be far.)

The jumps with one-byte offsets are called "short" jumps, while the jumps with two- or four-byte offsets are "long" jumps. But since they don't change the code segment, they're all still "near".
Post 01 Feb 2011, 21:30
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar.

Powered by rwasa.