19

Suppose I want to do a short jump using the EB opcode, jmp rel8 short jump
Intel manual entry for it:

EB CB or JMP rel8

"Jump short, RIP = RIP + 8-bit displacement sign extended to 64-bits"

(where CB is a byte signed value representing the relative offset relating to direction in EIP register)

Maybe always the offset will be offset+2 because the EIP in execution time (the reference direction) in this short jump is the base of the twobyte instruction, but the addend occurs always

  • eb 30 = jmp 0x00000032 (+30)
  • eb e2 = jmp 0xffffffe4 (-30)

then EIP can be intentionally the same direction because fe + 2 is 00 or EIP.

  • eb fe = jmp 0x00000000

I find it surprising that the overoffset occurred bifurcated although the number is negative. But in the Intel I find no mention (maybe because 3000 pages).

Intel® 64 and IA-32 Architectures Software Developer’s Manual: Vol. 2A 3-423

A near jump where the jump range is limited to –128 to +127 from the current EIP value.

Then I contemplate three possibilities:

  1. is +2 because is the after/future value of EIP in execution time
  2. The coded value is not a 2s component encoded signed number.
  3. this appears in the manual but I have not seen because i'm stupid
Peter Cordes
  • 328,167
  • 45
  • 605
  • 847
user1629569
  • 661
  • 1
  • 4
  • 17

3 Answers3

23

Whether it's short jump or not, it's always destination - (source + sizeof(instruction)).

i.e. dst - end_of_jmp

In your case (short jump), sizeof(instruction) is 2.

The reason behind this addition is because of the fact that once the cpu has performed the instruction fetch stage, the instruction pointer is already pointing to the instruction that comes after the branch. The rel8 or rel32 branch displacement is relative to that EIP/RIP value.

Peter Cordes
  • 328,167
  • 45
  • 605
  • 847
JosephH
  • 8,465
  • 4
  • 34
  • 62
  • 1
    I'm confused by the terminology: what is a "short jump"? I haven't been able to find a definition of this anywhere on the Web. – Anderson Green Feb 20 '13 at 19:30
  • 4
    @AndersonGreen short jump is encoded as *jmp rel8* (EB XX) where the relative distance (dest-source) is less than 0x80. The other one is called long jump, which is encoded as *jmp rel32* (E9 XXXXXXXX). Note that this can be encoded with the 66H prefix, which changes the operand to *rel16*. – JosephH Feb 21 '13 at 06:24
  • I had to tweak this formula before it would work. I used `destination - source - sizeof(instruction)` – byxor Oct 07 '18 at 09:53
  • @byxor: good point, fixed. It's actually easiest to remember it as `dst - end_of_jmp`. – Peter Cordes Apr 17 '19 at 22:14
19

The rel8 is relative to the next instruction's memory address, as can easily be confirmed by creating two executables and disassembling them:

@label:
    jmp @label
    nop

This disassembles as (with ndisasm, it's the same in 16-bit, 32-bit and 64-bit code):

EBFE jmp short 0x0
90   nop

Then, another executable:

    jmp @label
@label:
    nop

EB00 jmp short 0x2
90   nop

So, the rel8 is encoded always relative to the next instruction after jmp. Disassemblers (at leastndisasm and udcli), however, show it relative to the jmp instruction itself. That may possibly cause some confusion.

nrz
  • 10,435
  • 4
  • 39
  • 71
  • 1
    Disassemblers show the absolute target address when decoding it into asm syntax. `ndisasm` defaults to the start of the flat binary at address zero. `ndisasm -o 0x7c00` would use addresses as if the binary was loaded at offset `7C00`. – Peter Cordes Jan 17 '23 at 07:27
7

The jump short takes an EIP relative to the end of the jump instruction (which is two bytes long), and takes a one byte operand, which is sign extended and added to EIP.

SecurityMatt
  • 6,593
  • 1
  • 22
  • 28