0

I am trying to pass a parameter to EIP register as a jump instruction to EBX register.

0

2 Answers 2

5

Short answer

JMP EBX will jump to the address stored in the EBX register within the current code segment.JMP DWORD PTR DS:[EBX] will jump to the address stored at memory offset EBX within the code segment that is pointed to by DS.

For example, let DS = 0x0440, EBX = 0x00006200, and the first four bytes of memory at address 0x00006200 be 0x00003500 (which would be stored as 00 35 00 00 on a little-endian machine).
JMP EBX becomes JMP 0x00006200.
JMP DWORD PTR DS:[EBX] becomes JMP 0x0440:0x00003500

Long answer

JMP EBX has the following signature:

JMP r/m32

In this case, the jump address is stored either in a 32-bit register (your case) or as a 32-bit variable in memory. The processor performs a near jump (in the same code segment), at the address specified by the operand, by loading the value into EIP.

JMP DWORD PTR DS:[EBX], on the other hand, has the following signature:

JMP ptr16:32

Here the jump address is supplied in two pieces. The first value (before the colon) gives the address of the code segment to jump to, and the second (after the colon) gives the offset within that code segment. The jump may be to a different code segment than the current and is thus a far jump. The processor performs the jump by loading the first value into CS and the second into EIP.
In addition, the second instruction uses [EBX], as opposed to EBX in the first. That means it will read the memory at the offset stored in EBX and use that value.
DWORD PTR is a size directive that tells the assembler the memory should be treated as a 32-bit integer.

Here is an example of the second jump in use.

1
  • That's not jmp ptr16:32. That's jmp r/m32 with a memory operand using the default segment (DS), which the OP's disassembler puts in explicitly to clutter the output and make it harder to read. Aug 7, 2016 at 3:46
4

JMP EBX means to instructs the CPU to jump to address pointed by EBX register value. If EBX is 12345678h, it'll jump to address 12345678h. So the instruction is interpreted as JMP 12345678h.

JMP DWORD PTR DS:[EBX] means to instructs the CPU to jump to address pointed by a DWORD value read from a memory address pointed by EBX register value and the DS selector. If EBX is 11111111h, the CPU will read the DWORD value from memory at address DS:11111111h, then jump to the address pointed by that DWORD value (the value from the memory). If the DWORD value from the memory is 22222222h, it'll jump to address 22222222h. So the instruction is interpreted as JMP DWORD PTR DS:[11111111h]. After the memory is read, it would be interpreted as JMP 22222222h.

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.