How to interpret "jmp dword ptr [rel $00005e52]"?
I am trying to trace an assembly code in Win64 platform:
When instruct开发者_StackOverflowion execute to:
0000000000402590 FF25525E0000 jmp dword ptr [rel $00005e52]
After the jump, it will go to address:
00000000006B3F90 56 push rsi
How the jmp instruction retrieve the address to jump to? What is the meaning of [rel $00005e52] ?
This particular jmp (listed as "FF /4 jmp r/m64" in the documentation) uses the so-called RIP-relative addressing (ModR/M byte = 0x25: mod=00b, reg/opcode=100b, r/m=101b; this means disp32 in 32-bit mode but RIP+disp32 in 64-bit mode).
It reads the jump address (64-bit) from 0x402590+6 (address of the instruction following this jmp) + 0x5E52, that is, from 0x4083E8. Memory at 0x4083E8 (8 bytes) should be equal to 0x6B3F90.
精彩评论