Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I am trying to trace an assembly code in Win64 platform:
When instruction execute to:
0000000000402590 FF25525E0000 jmp dword ptr [rel $00005e52]
After the jump, it will go to address:
00000000006B3F90 56 push rsi
How the jmp instruction retrieve the address to jump to? What is the meaning of [rel $00005e52] ?
This particular jmp (listed as “FF /4 jmp r/m64” in the documentation) uses the so-called RIP-relative addressing (ModR/M byte = 0x25: mod=00b, reg/opcode=100b, r/m=101b; this means disp32 in 32-bit mode but RIP+disp32 in 64-bit mode).
It reads the jump address (64-bit) from 0x402590+6 (address of the instruction following this jmp) + 0x5E52, that is, from 0x4083E8. Memory at 0x4083E8 (8 bytes) should be equal to 0x6B3F90.