Question

I came across this assembly code and when trying to compile it it said there was an error. Not know much about assembly i was wondering if someone could help me. Thanks in advance.

JMP 0x1F
POPL %ESI
MOVL %ESI, 0x8(%ESI)
XORL %EAX, %EAX

Answer 1

Put a label at the destination of the JMP and use that instead of the constant 0x1F. Alternatively, knowing the length of the instruction, use a construct such as JMP .+length+offset, in this case length is 2 bytes, so it becomes JMP .+0x21. This will be then encoded as 0xeb 0x1f which is what the phrack link apparently wants. Relative jumps in x86 are encoded as offsets from the start of the next instruction, if you don’t know the instruction length you can put a label after the instruction like so:

JMP next+0x1f
next:
POPL %ESI
MOVL %ESI, 0x8(%ESI)
XORL %EAX, %EAX

(Local labels may be helpful, but in this particular case 1f+0x1f would have been very confusing.)

Be advised, when assembling code the assembler might pick an encoding you don’t expect and hence mess up your offsets if you don’t use labels.