Re: Jumping into middle of instruction
- From: "Wolfgang Kern" <spamtrap@xxxxxxxxxx>
- Date: Wed, 27 Feb 2008 01:14:52 +0100
"mybwpp" asked:
Can anyone explain the concept of 'Jumping into the middle of
instructions'. Why it is used? Can we hide arbitrary code (I/O
instructions, system calls) by this technique ?
Sure it once was used to confuse brainless disassemblers ...
some compilers may still try to confuse us (with minor success,
because every half-brained disassambler can detect a code path).
..
I can give you one example (out from my early OS attempts):
[called as ext-mem OS PM32 Function from RM}
FN_get: ;get a byte/word/dword from ESI (count in AL)
use32:
CMP AL,01
JA GET_W_D ;if I want more than a single byte
MOV AL,[ESI]
RET ;AL= the byte
GET_W_D:
CMP Al,04 ;want four bytes ?
JNZ L1 ;Yes/NO I want just two
L0: ;
db 66h ;with this '66' I get MOV ax,[esi]
L1:
MOV eax,[esi] ;and without it I get EAX as it says
RET ;finally I got AX or EAX from [esi]
This example wont be seen in my Os since very long,
and you may see the bug (if AH=0 or not 4) in there ...
but it's just an often seen example of jumping into code.
xxx0c L0: 66 8b 06 mov ax,[esi]
xxx0d L1: 8b 06 mov eax,[esi]
this (few bytes) stupid function is still in my OS,
but only used in DOS-based DEMO-software.
__
wolfgang
.
- Follow-Ups:
- Re: Jumping into middle of instruction
- From: mybwpp@xxxxxxxxxxxxxx
- Re: Jumping into middle of instruction
- References:
- Jumping into middle of instruction
- From: mybwpp@xxxxxxxxxxxxxx
- Jumping into middle of instruction
- Prev by Date: Re: Cause IRQ5 programmatically
- Next by Date: Re: Branch prediction
- Previous by thread: Re: Jumping into middle of instruction
- Next by thread: Re: Jumping into middle of instruction
- Index(es):
Relevant Pages
|
