0

I'm currently parsing a lot of assembly files and don't understand a specific jmp or call with $+5 as operand:

call $+5
 jmp $+5

To provide more context I grepped some of the occurrences:

mov esp, [ebp+ms_exc.old_esp]
and [ebp+ms_exc.registration.TryLevel], 0
or [ebp+ms_exc.registration.TryLevel], 0FFFFFFFFh
call $+5
jmp sub_4493CA
===== S U B R O U T I N E =======================================
push esi

[...]

mov esp, [ebp+ms_exc.old_esp]
and [ebp+ms_exc.registration.TryLevel], 0
or [ebp+ms_exc.registration.TryLevel], 0FFFFFFFFh
call $+5
jmp sub_45746A
===== S U B R O U T I N E =======================================
mov eax, dword_4778F8

[...]

mov eax, ebx
test al, 2
jnz loc_100994B8
jmp $+5
-----------------------------------------------------------------
mov eax, [ebp+var_34]
mov [ebp+var_40], eax

What is the meaning of the $+5 operand?

3

opcode for call $+5 is e8 00000000 so it calls the next instruction
opcode for jmp $+5 is e9 00000000 so it jumps to the next insturction

76E95FE0                        E8 00000000 CALL    76E95FE5         ;  <ntdll.call here>
76E95FE5 <ntdll.call here>      00          DB      00
76E95FE6                        E9 00000000 JMP     76E95FEB         ;  <ntdll.jmp_here>
76E95FEB <ntdll.jmp_here>       00          DB      00
76E95FEC                        EB 02       JMP     SHORT 76E95FF0   ;  <ntdll.jmp+4>
76E95FEE                        00          DB      00
76E95FEF                        00          DB      00
76E95FF0 <ntdll.jmp+4>          00          DB      00
  • 1
    More likely E9 00 00 00 00. EB 02 would be $+4. – peter ferrie Aug 26 '16 at 18:12
2

$ = Current position (beginning of the instruction)

+5 = +5 bytes from the beginning of the instruction

jmp $+5 = jmp 3 bytes past the jmp instruction (short jmp takes 2 bytes + 3 bytes past that)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.