3

I was wondering how the processor jumps from a lower memory region into a higher memory region, or the other way around, in a x64 application.

The default mnemonic for a far jump is 'E9 XXXXXXXX', in x86 as well as x64 bit apps. Doing a far jump on x86 is easy, as you can put the target address directly behind the 'E9' bit, like so:

Far call

Address   Hex dump          Command                        Comments
002957A1  E8 F15B2900       CALL Cam_Surveillance.00295BF1 ; above current code
002957A6  E9 3C562900       JMP  Cam_Surveillance.0029563C ; below current code


Or the short call for comparison

Address   Hex dump          Command                         Comments
002957A1   E8 4B040000      CALL Cam_Surveillance.00295BF1 ; above current code
002957A6   E9 91FEFFFF      JMP  Cam_Surveillance.0029563C ; below current code

You can also make use of the code segment to create a pointer.

Still, when using a x64 bit app, you cannot override that limit of 40 bits. So in order to do a far call or jump to a (hardcoded) 64 bit address, you would need 64 bits.

For example RIP points to '00FF7A0B.002957A1'. What instruction(s) would RIP set to point to '00000000.003967B1'? Or does this mean you cannot make a far jump or call?

1201ProgramAlarm
  • 32,384
  • 7
  • 42
  • 56
User1
  • 321
  • 3
  • 9
  • 7
    possible duplicate of [JMP instruction - Hex code](http://stackoverflow.com/questions/9815448/jmp-instruction-hex-code) - per the answer there, the solution for absolute 64-bit jumps/calls is to load the destination into a register and do e.g. `jmp rax` / `call rax`. – nobody May 22 '14 at 18:40
  • 1
    You should avoid the term `far jump` for this case, because that has a special meaning for jumps going to a different segment. – Jester May 22 '14 at 21:23
  • 64 bit mode does away with most of the segment registers, except for FS and GS, meant to be used for operating type stuff. – rcgldr May 23 '14 at 01:22
  • 1
    @AndrewMedico; Ah yes, quite stupid of me not to have thought about that. Thank you for your comment and sorry for posting a duplicate question! – User1 May 23 '14 at 12:12

0 Answers0