Geek Answers Handbook

Jmp short instruction syntax

I read http://thestarman.pcministry.com/asm/2bytejumps.htm , but in the text it’s not very clear how to do JMPfor the offset (a short jump to a relative address without using a label).

Say I have

NOP
NOP
NOP
NOP

(these are 4 bytes of instructions) and I want to skip them (skip 4 bytes). What would I write?

jmp $+4;?

jmp $+2+4;?

+4
source share
2 answers

Short jmp opcodes use two bytes. When you collect this, the current position ( $) indicates the beginning of the JMP instruction, not the beginning of the next instruction.

To go to the next command (a jump that doesn't actually jump), you do

jmp $+2

, N JMP, :

jmp $+2+N

4 NOP

jmp $+6

, . ,

jmp short $+6
+6

"" 4 jmp , jmps 2 5 .

() 4 , :

  jmp   short $+4   ; the "short" forces a 2 byte relative branch
  nop
  nop

, N , nop. , , :

void ObjectCodeEmitNByteNop(natural n)
{ // See http://mail.openjdk.java.net/pipermail/hotspot-compiler-dev/2010-September/003881.html GOOD INFO
  /* The Intel Architecture Software developer guide, volume 2B (instructions N-Z) contains the following table (pg 4-12) about NOP:

Table 4-9. Recommended Multi-Byte Sequence of NOP Instruction

Length    Assembly                                   Byte Sequence
=================================================================================
2 bytes   66 NOP                                     66 90H
3 bytes   NOP DWORD ptr [EAX]                        0F 1F 00H
4 bytes   NOP DWORD ptr [EAX + 00H]                  0F 1F 40 00H
5 bytes   NOP DWORD ptr [EAX + EAX*1 + 00H]          0F 1F 44 00 00H
6 bytes   66 NOP DWORD ptr [EAX + EAX*1 + 00H]       66 0F 1F 44 00 00H
7 bytes   NOP DWORD ptr [EAX + 00000000H]            0F 1F 80 00 00 00 00H
8 bytes   NOP DWORD ptr [EAX + EAX*1 + 00000000H]    0F 1F 84 00 00 00 00 00H
9 bytes   66 NOP DWORD ptr [EAX + EAX*1 + 00000000H] 66 0F 1F 84 00 00 00 00 00H
  */
  switch(n)
  { 
case 0:
  break;  // accidentally aligned
case 1:
  ObjectCodeEmitByte(0x90); // sequence recommended by AMD optimization manual
  break;
case 2:
  ObjectCodeEmitWord(0x9066); // sequence recommended by AMD and Intel optimization manual
      // MS assembler suggests:  ObjectCodeEmitWord(0xFF8B); "MOV EDI,EDI"
  break;
case 3: 
      ObjectCodeEmitThreeByteNOP();
      break;
case 4:        
  ObjectCodeEmitFourByteNOP();
      // ObjectCodeEmitDword(0x90666666); // sequence recommended by AMD optimization manual
      // MS assembler suggests: ObjectCodeEmitDword(0x0024648D); // LEA ESP,0[ESP]
  break;
    case 5:
#if 0
  ObjectCodeEmitByte(0x05); // ADD EAX, imm32
  ObjectCodeEmitDword(0);
#else
  ObjectCodeEmitByte(0x0F); // NOP ...
      ObjectCodeEmitDword(0x0000441F); // ... DWORD ptr [EAX + EAX*1 + 00H]
#endif
      break;
   case 6:
  ObjectCodeEmitWord(0x9B8D); // LEA EBX,disp32[EBX]  (Microsoft assembler emits this)
  ObjectCodeEmitDword(0x00000000); // offset = 0 --> don't change EBX
      break;
case 7:
  ObjectCodeEmitByte(0x8D); // LEA opcode byte
  ObjectCodeEmitWord(0x24A4); // ESP,disp32[ESP]
  ObjectCodeEmitDword(0x00000000); // offset = 0 --> don't change ESP
      break;
case 8:
  ObjectCodeEmitDword(0x00841F0F); // NOP DWORD ptr [EAX + EAX*1 + ...
      ObjectCodeEmitDword(0x00000000); // ...00000000H]
      break;
    case 9:
      ObjectCodeEmitByte(0x66); // 66 0F 1F 84 00 00 00 00 00H
      ObjectCodeEmitDword(0x00841F0F); // NOP DWORD ptr [EAX + EAX*1 + ...
      ObjectCodeEmitDword(0x00000000); // ...00000000H]
      break;
default:
      { ObjectCodeEmitJmpRelativeShort(ObjectCodeSize+n);
        // ObjectCodeEmitJmpRelativeLong(DesiredObjectLocation); // 5 bytes is safe; 1-4 bytes handled above
        ObjectCodeEmitNBreakpoints(n-2);
  }
  }
}

, , , , , . " ".

+1

More articles:


All Articles