这个 EB F2 x86 指令是如何工作的?

逆向工程 拆卸 部件 x86 x64dbg
2021-06-27 21:03:24

在以下代码片段中,EB F2 指令导致执行跳转回箭头指示的行。考虑到没有向 EB 提供地址并且 jmp 在地址距离方面小于 F2,情况如何?在此处输入图片说明这两个位置彼此相距 0xC。

1个回答

来自 google starmans领域

引用相关信息

These are also known as SHORT Relative Jumps. Programs using only Relative    
Jump  instructions can be relocated anywhere in memory without having to     
change the    machine code for the Jumps. The first byte of a SHORT Jump is    
always EB and the    second is a relative offset from 00h to 7Fh for Forward    
jumps, and from 80h to    FFh for Reverse (or Backward) jumps. [Note: The    
offset count always begins at    the byte immediately after the JMP    
instruction for any type of Relative Jump!] 

所以eb 01 到 eb 7f 向前跳跃
eb fe 到 eb 80 jumpf 向后

所以当前指令在 0x172b066 加上操作码长度 2 当前指令以 xxxx68 结束或下一条指令从 0xxxxx68 0xf2 == -0xe 开始(阅读二进制补码表示法)

0xxxxx68 - 0xe = 0xxxxx5A