Question

So, I am confused about how jump instructions work in an operating system. I thought that the jump instruction set the value in the processor’s program counter. But programs can be run in various locations in memory. I see that in x86, there’s the JMP EAX instruction, but my C++ code doesn’t seem to use this. I compiled some C++ code in VC++:

int main()
{
    int i = 0;
    while (i < 10)
    {
        ++i;
        if (i == 7)
        {
            i += 1;
            continue;
        }
    }
}

This translates to:

    int main()
    {
00411370  push        ebp  
00411371  mov         ebp,esp 
00411373  sub         esp,0CCh 
00411379  push        ebx  
0041137A  push        esi  
0041137B  push        edi  
0041137C  lea         edi,[ebp-0CCh] 
00411382  mov         ecx,33h 
00411387  mov         eax,0CCCCCCCCh 
0041138C  rep stos    dword ptr es:[edi] 
        int i = 0;
0041138E  mov         dword ptr [i],0 
        while (i < 10)
00411395  cmp         dword ptr [i],0Ah 
00411399  jge         main+47h (4113B7h) 
        {
            ++i;
0041139B  mov         eax,dword ptr [i] 
0041139E  add         eax,1 
004113A1  mov         dword ptr [i],eax 
            if (i == 7)
004113A4  cmp         dword ptr [i],7 
004113A8  jne         main+45h (4113B5h) 
            {
                i += 1;
004113AA  mov         eax,dword ptr [i] 
004113AD  add         eax,1 
004113B0  mov         dword ptr [i],eax 
                continue;
004113B3  jmp         main+25h (411395h) 
            }
        }
004113B5  jmp         main+25h (411395h) 
    }
004113B7  xor         eax,eax 
004113B9  pop         edi  
004113BA  pop         esi  
004113BB  pop         ebx  
004113BC  mov         esp,ebp 
004113BE  pop         ebp  
004113BF  ret              

So I’m confused, for the command jmp 411395h, does this imply the program is always loaded in the same spot in memory? Because that seems illogical.

Answer 1

As other people wrote, there are relative jump and relative call instructions which essentially add a fixed value to eip and therefore do not depend on the program’s location in memory; compilers prefer to use these whenever possible. You can look at the code bytes to see what exact instructions your compiler used. However, I assume you are asking about jumps/calls to absolute addresses.

When the linker generates an executable, it generates absolute addresses supposing a particular base address; Microsoft linker usually uses 400000h. When OS loads an executable or a dll, it “fixes up” all absolute addresses by adding the difference between the address at which the executable was actually loaded and the address at which the linker based it. All executable formats except .com specify some sort of fixup table, which lists all locations in the executable which have to be patched up in this way. Therefore, after the OS loads your executable into memory at base address, say, 1500000h, your jump will look like jmp 1511395h. You can check this by looking at actual code bytes with a debugger.

Older Windows systems preferred to load executables at the base address used by the linker; this created a security risk, because an attacker would know in advance what is where in memory. This is why newer systems use base address randomization.