1

I am looking at some code that has jmp $+5 instruction at the beginning of the entry code in a library, right after pushing registers to the stack. I understand that jmp $+5 puts IP at the next instruction but why is the jump there at all? Without it, the next instruction would have been executed anyway. The only thing that comes to mind is that it is PIE related and jump with displacement of 0 that could potentially be a non-zero value, but this code is a part of a big "blob" and I don't think its individual parts would be relocatable, at least not to a point where the jump displacement would be non-zero.

The compiler is GCC 3.7?, linux 32 bit

Version needs section '.gnu.version_r' contains 2 entries:
 Addr: 0x0000000000017e0c  Offset: 0x017e0c  Link: 3 (.dynstr)
  000000: Version: 1  File: libgcc_s.so.1  Cnt: 1
  0x0010:   Name: GCC_3.0  Flags: none  Version: 7

Thanks

5
  • 1
    it really depends on compiler and its optimization capabilities
    – R4444
    May 12 at 3:23
  • What does? Are you talking about this "I don't think its individual parts would be relocatable, at least not to a point where the jump displacement would be non-zero."? I'll add compiler info to the post if that helps
    – Igor
    May 12 at 16:28
  • It could be a hook for instrumentation. May 14 at 17:51
  • +1 for "hook point for instrumentation" May 19 at 5:11
  • I think @peterferrie comment is the best explanation for this so far. Makes sense as a hook for instrumentation, or a test harness, or maybe a way to change initialization in some environments. Could just modify the binary to get different behavior without having to rebuild.
    – Igor
    Jun 1 at 18:20
0

Are you sure you encounter JMP $+5? A common x86 function prologue pattern has CALL $+5 in the position you describe. In addition to continuing at the next instruction, it also pushes the address of the next instruction to the stack. It is usually followed by POP EBX to put that address into ebx and then ADD EBX, $const to modify EBX so it contains a specific reference address, IIRC the beginning of the function slots in the GOT.

The important point about this instruction sequence is that it works independently of the base address of the code, as JMP NEAR (opcode E9) and CALL NEAR contain relative addresses, so $+5 is always encoded the same way, no matter where the instruction is located. The add instruction then adds/subtracts the fixed distance between that instruction and the GOT.

1
  • Yes, it is a jmp instruction. The opcode ise9 00 00 00 00 jmp $+5
    – Igor
    May 18 at 23:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.