开发者

How to interpret "jmp dword ptr [rel $00005e52]"?

I am trying to trace an assembly code in Win64 platform:

When instruct开发者_StackOverflowion execute to:

0000000000402590 FF25525E0000     jmp dword ptr [rel $00005e52]

After the jump, it will go to address:

00000000006B3F90 56               push rsi

How the jmp instruction retrieve the address to jump to? What is the meaning of [rel $00005e52] ?


This particular jmp (listed as "FF /4 jmp r/m64" in the documentation) uses the so-called RIP-relative addressing (ModR/M byte = 0x25: mod=00b, reg/opcode=100b, r/m=101b; this means disp32 in 32-bit mode but RIP+disp32 in 64-bit mode).

It reads the jump address (64-bit) from 0x402590+6 (address of the instruction following this jmp) + 0x5E52, that is, from 0x4083E8. Memory at 0x4083E8 (8 bytes) should be equal to 0x6B3F90.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜