Calculation of jmp distance of E9: distance = destination address-(current address + 5) (plus 5 is because the JMP command occupies a total of 5 words, actually the destination address minus the end address of the JMP command, that is, the current address + 5
If the target address is f1e0b63e
The current address is 8093c6d8.
Distance = f1e0b63e-8093c6d8-5 = 714cef61
Jmp is
Current address current encoding assembly instruction
8093c6d8 e961ef4c71 (written backwards) jmp f1e0b63e
Encoded in C ++
- # Include "stdafx. h"
- # Include <iostream>
- Using namespace std;
- Int _ tmain (int argc, _ TCHAR * argv [])
- {
- Unsigned long a = 0xf1e0b63e;
- Unsigned long B = 0x8093c6d8;
- Unsigned c = a-b-5;
- Int d [4];
- For (INT I = 0; I <4; I ++)
- {
- D [I] = 0;
- D [I] + = C % 16;
- C = C/16;
- D [I] + = C % 16*16;
- C = C/16;
- Cout
- }
- Return 0;
- }
- // E9 d [0] d [1] d [2] d [3] Is e961ef4c71
If the destination address is smaller than the current address, the distance is-5