Question

In the next code:

    Gloat: mov eax, 0
          jmp [(ebx*4)+Tab]
    Tab:  dd F4
          dd F3
          dd F2
          dd F1
    F1: add eax, 4
    F2: add eax, 4
    F3: add eax, 4
    F4: ret

I don’t understand What the mean of [(ebx*4)+Tab]. For example, If ebx contain 2, What I will get on the jmp condition? jmp [8+Tab], but what is the Tab?

Thanks.

Answer 1

Tab is a table holding the addresses of the jump targets (F1, F2 etc.), ebx * 4 selects an entry from that table (by adding to the address of Tab, then dereferencing that address), which is then jumped to.

So in your example, if EBX is 2, we get JMP [Tab + 8] which becomes JMP F2, because the address of F2 is 8 bytes from the start of Tab.