2

What is the meaning of this kind of jmp instruction in x86 assembly in IDA?

enter image description here

Does it mean that we should jump to the address [6CA2E9B0] + 8 or [6CA2E9B0+8]? When I follow that off_XXX, I get to the memory region that looks like this:

enter image description here

Is this some kind of a jump table? loc_6C954360 is indeed pointed by the address 6CA2E9B0, does it mean that the instruction in question jumps to the address pointed by 6CA2E9B0+8? If that's the case, then I must've messed something up in the debugger as the computed address didn't seem to be the same as the one stored in memory.

EDIT: I read about the FF /5 jump which I believe is present here: enter image description here

It should load to EIP the far address stored in the memory location specified by the 4 bytes next to the FF 25. And it seems like it is how it works, as I managed to see that happening in the debugger. However, the address after FF 25 is slightly modified when the library is loaded into a process, are those addresses somehow adjusted once the process starts using the library? Also what is the point of this kind of jumps, why are functions defined in this way?

Improve this question
2
  • dereference the pointer add the displacement to the dereferenced value and jump to the resultant normally a method in a class
    – blabb
    Feb 12, 2022 at 5:48
  • @blabb so in other words EIP = [6CA2E9B0] + 8 = 6C954360 + 8?
    – Moteke
    Feb 12, 2022 at 12:22

1 Answer 1

Reset to default
0

IDA displays +8 because the target address is in the middle of a data item (xmmword is 16 bytes).

You should undefine the oversized item and create two separate qwords, the second one should be actual pointer used by the instruction.

Improve this answer
2
  • Thanks, it makes more sense now. Do you know though why the referenced function shown in IDA is different from the one actually being called when the library is loaded? It looks like those offsets were changed and now point at different functions.
    – Moteke
    Feb 12, 2022 at 15:06
  • @Moteke sorry I don’t know. Possibly something changed during debugging.
    – Igor Skochinsky ♦
    Feb 12, 2022 at 15:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.