How to find the jmp address during a x86 function call?
- by Bruce
Suppose we have a call foo statement. So when the assembler encounters a call statement it breaks it down into -
push ip + 6
jmp <addr of foo>
I have the return address in a register ebx. Now I want to find out the "addr of foo". How do I do it? I want to confirm that the push statement is present before the jmp. Will the memory map look something like this?
-------
push (what will be the value stored in this byte?? opcode ??)
-------
jmp (what will be the value stored in this byte?? opcode ??)
-------
jmp byte 1
-------
jmp byte 2
-------
jmp byte 3
-------
jmp byte 4
-------
return address stored in ebx
-------
What are the opcodes for push and jmp?
