How to find the jmp address during a x86 function call?
Posted
by
Bruce
on Stack Overflow
See other posts from Stack Overflow
or by Bruce
Published on 2010-12-31T09:21:41Z
Indexed on
2010/12/31
9:53 UTC
Read the original article
Hit count: 225
Suppose we have a call foo statement. So when the assembler encounters a call statement it breaks it down into -
push ip + 6
jmp <addr of foo>
I have the return address in a register ebx. Now I want to find out the "addr of foo". How do I do it? I want to confirm that the push statement is present before the jmp. Will the memory map look something like this?
-------
push (what will be the value stored in this byte?? opcode ??)
-------
jmp (what will be the value stored in this byte?? opcode ??)
-------
jmp byte 1
-------
jmp byte 2
-------
jmp byte 3
-------
jmp byte 4
-------
return address stored in ebx
-------
What are the opcodes for push and jmp?
© Stack Overflow or respective owner
