I am trying to pass a parameter to EIP
register as a jump instruction to EBX
register.
2 Answers
Short answer
JMP EBX
will jump to the address stored in the EBX
register within the current code segment.JMP DWORD PTR DS:[EBX]
will jump to the address stored at memory offset EBX
within the code segment that is pointed to by DS
.
For example, let DS
= 0x0440, EBX
= 0x00006200, and the first four bytes of memory at address 0x00006200 be 0x00003500 (which would be stored as 00 35 00 00 on a little-endian machine).
JMP EBX
becomes JMP 0x00006200
.
JMP DWORD PTR DS:[EBX]
becomes JMP 0x0440:0x00003500
Long answer
JMP EBX
has the following signature:
JMP r/m32
In this case, the jump address is stored either in a 32-bit register (your case) or as a 32-bit variable in memory. The processor performs a near jump (in the same code segment), at the address specified by the operand, by loading the value into EIP
.
JMP DWORD PTR DS:[EBX]
, on the other hand, has the following signature:
JMP ptr16:32
Here the jump address is supplied in two pieces. The first value (before the colon) gives the address of the code segment to jump to, and the second (after the colon) gives the offset within that code segment. The jump may be to a different code segment than the current and is thus a far jump. The processor performs the jump by loading the first
value into CS
and the second into EIP
.
In addition, the second instruction uses [EBX]
, as opposed to EBX
in the first. That means it will read the memory at the offset stored in EBX
and use that value.
DWORD PTR
is a size directive that tells the assembler the memory should be treated as a 32-bit integer.
Here is an example of the second jump in use.
-
That's not
jmp ptr16:32
. That'sjmp r/m32
with a memory operand using the default segment (DS
), which the OP's disassembler puts in explicitly to clutter the output and make it harder to read. Aug 7, 2016 at 3:46
JMP EBX
means to instructs the CPU to jump to address pointed by EBX
register value. If EBX
is 12345678h
, it'll jump to address 12345678h
. So the instruction is interpreted as JMP 12345678h
.
JMP DWORD PTR DS:[EBX]
means to instructs the CPU to jump to address pointed by a DWORD
value read from a memory address pointed by EBX
register value and the DS
selector. If EBX
is 11111111h
, the CPU will read the DWORD
value from memory at address DS:11111111h
, then jump to the address pointed by that DWORD
value (the value from the memory). If the DWORD
value from the memory is 22222222h
, it'll jump to address 22222222h
. So the instruction is interpreted as JMP DWORD PTR DS:[11111111h]
. After the memory is read, it would be interpreted as JMP 22222222h
.