计算JMP指令的地址
我试图通过用 JMP 指令替换函数的开头来挂钩函数，该指令应该通向我的函数。但问题是我不知道如何计算 JMP 偏移量以定位我的函数的地址。好吧，如果你在内存中向前跳转（目标地址 - 当前地址），我知道该怎么做，但我不知道当你在内存中跳回时如何确定它。
有人可以帮忙吗？
I am trying to hook a function by replacing its beginning with a JMP instruction which should lead to my function. But the problem is that I don't know how to calculate the JMP offset to target the address of my function. Well, I know how to do it if you jump forward in memory (Destination addr - Current addr), but I haven't got any ideas how to determine it when you jump back in memory.
Could somebody help?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
只需使用负偏移量向后跳转即可。
请记住考虑
JMP指令的大小。偏移量是相对于 JMP 指令的末尾而不是开头的。如果当前地址是您要写入JMP的位置，那么您需要 5+dest-current 的偏移量，因为JMP指令的大小加上偏移量（如果为 5）字节。Just use negative offset to jump backwards.
And remember to account for the size of the
JMPinstruction. The offset is relative to the end of theJMPinstruction and not the beginning. If the current address is where you are about to write theJMPthen you need an offet of 5+dest-current since the size of theJMPinstruction plus the offset if 5 bytes.这是您应该能够弄清楚的基本数学。 :)
如果向前的 JMP 是
Destination - Origin，那么向后的JMP将是Origin - Destination用简单的数字来思考一下：如果您想要将
JMP从 100 转发到 110，您的JMP将为110 - 100 = 10。如果您想JMP向后移动相同的量，则为100 - 110 = -10。This is basic math that you should be able to figure out. :)
If a JMP forward is
Destination - Origin, then aJMPbackward would beOrigin - DestinationThink about it in plain numbers: If you want to
JMPforward from 100 to 110, yourJMPwould be110 - 100 = 10. If you want toJMPthe same amount backward, it would be100 - 110 = -10.相对跳转是有符号的，也就是说，它们使用符号位进行正负位移。绝对跳跃是绝对的，所以没关系。参见第2A卷和第2卷。英特尔指令指南的 2B。
relative jumps are signed, that is, they have positive and negative displacement using the sign bit. absolute jumps are absolute so it doesn't matter. see volumes 2A & 2B of the intel instruction guide.
你好，我建议你使用“call”语句。 “call”语句将负责将返回指针放入堆栈中。
计算跳转的公式为：ToAddress - FromAddress - 5
-5 这是因为call + offset指令在内存中所占的空间
指针在内存中是反写的。如果要指向内存0x857830，则在内存中将此值写入307885
指令操作码
跳转 = 0xE9
调用 = 0xE8
hello i suggest you use the 'call' statement. The 'call' statement will take care of putting the return pointer on the stack.
the formula to calculate the jump you need to do is: ToAddress - FromAddress - 5
-5 this is because it is the space that the 'call' + offset instruction occupies in memory
pointers in memory are written inversely. if you want to point to memory 0x857830, in memory this value is written 307885
instructions opcode
jmp = 0xE9
call = 0xE8
偷偷摸摸地
对函数上方的位置进行虚拟调用
现在，您已经有了 ax 中 location2 的地址
，将 3 添加到 ax 中，并且您有了函数的内存地址
Be sneaky
Make a dummy call to a location above your function
You now have the address of location2 in ax
add 3 to ax and you have the memory address of your function