0

I dont know how to calculate the jump distances :

[Address | Binary value| ollydbg(jmp, call...)]

004014B6   $- FF25 30114000 JMP DWORD PTR DS:[<&MSVBVM60.#100>]      ;  MSVBVM60.ThunRTMain
004014C1   .  E8 **F0FFFFFF**   CALL [JMP.&MSVBVM60.#100]

other examples: random jmps to 004014C1

0040752A    ^\E9 **929FFFFF**   JMP stub2.004014C1
00407561    ^\E9 **5B9FFFFF**   JMP stub2.004014C1
00407582    ^\E9 **3A9FFFFF**   JMP stub2.004014C1

as you can see the bold number changes, I can see its a distance but I don't know how to calculate it.

1

First, you should read about little endianness. In a nutshell, the x86/x64 processors store the least significant byte first, so F0FFFFFF is really the value FFFFFFF0, and 3A9FFFFF is the value FFFF9F3A.

Second, read about integer representations of negative values, and how overflow works when adding/subtracting numbers. In short, FFFFFFF0 can either mean 4294967280 or -16, but when you add hex numbers, you don't really care; you just add them and ignore overflow.

Third, remember that jump offsets are calculated from the byte after the jmp/call instruction.

So, in your first example:

  • start with 4014B6
  • add 6 bytes for the instruction, result 4014BA
  • add the value 401130, result 8025EA

and the first of your random examples:

  • start with 40752A
  • add 5 bytes for the instruction, result 40752F
  • add FFFF9F92, result 1004014C1
  • ignore overflow, result 004014C1 which is the target Olly shows you.

Your other examples work in the same way, you should be able to figure them out now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.