计算 JMP 操作码
我正在尝试计算跳转的正确操作码，我在其他线程中查看了这一点，但我仍然不明白：
我认为公式是 desination - (from+5)但它只是不起作用，已经很远了，这是我想要跳转到/从的地址：
FROM: 6259326B
TO: 02980000
CORRECT OPCODE: E9 90CD3EA0
FORMULA OPCODE: E9 5FC13266
所以我遇到了这个问题，感谢任何帮助。
I'm trying to calculate the correct op codes for a jump, I've looked at this in other threads and I still don't understand:
I thought the formula was desination - (from+5) but its just not working, it's way off, here's the addresses that I want to jump to/from:
FROM: 6259326B
TO: 02980000
CORRECT OPCODE: E9 90CD3EA0
FORMULA OPCODE: E9 5FC13266
So I'm having problems with this, any help appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您正在计算负 jmp！所以正确的公式是：
等于 $A03ECD90 （或小尾数中的 $90CD3EA0）。
You are calculating negative jmp! So correct formula is:
what is equal $A03ECD90 (or $90CD3EA0 in little endian).
公式很好（尽管提供的程序集和地址似乎不完全匹配：
02980000-6259326b-5=c726cd90code>，反转字节顺序，它几乎与您的正确程序集匹配，我假设它由于图像重定位而关闭等）。您确定您的数学计算正确并且颠倒了字节顺序以匹配相对 32 位跳转所需的编码（小尾数）吗？The formula is fine (though it seems the provided assembly and addresses dont exactly match:
02980000-6259326b-5=c726cd90, reverse the byte order and it almost matches your correct assembly, Id assume its off due image relocation etc.). Are you sure you did the math correctly and reversed the byte order to match the required encoding (little endian) for a relative 32bit jump?该公式是正确的，假设跳转指令恰好有 5 个字节，并且
FROM是该跳转指令的地址。如果长度不是 5 或者FROM不是 jmp 所在的位置，则它是不正确的。这样你就可以得到模 232 算术：
如果您不明白 2980000H - 62593270H 如何等于 32 位中的 0A03ECD90H，请想象一下您正在从 102980000H 而不是 2980000H 中减去，也就是说，您设置了第 33 位。那么你有 102980000H - 62593270H = 0A03ECD90H。您可以验证 102980000H = 62593270H + 0A03ECD90H。但由于只有 32 位用于计算，因此第 33 位，无论它是什么，都不会影响总和和差。因此，您只需将两个数字作为 32 位数字相减，并取结果中最低有效的 32 位，忽略第 32 位以外的任何未完成的借位。
并且 0A03ECD90H 必须在 jmp 指令中从最低有效字节到最高有效字节进行编码，因此您将得到编码该指令的字节序列：
之前曾提出过类似问题。
The formula is correct, assuming the jump instruction has exactly 5 bytes and
FROMis the address of this jump instruction. If the length isn't 5 orFROMisn't where jmp is, it's incorrect.With that you get in modulo 232 arithmetic:
If you don't understand how 2980000H - 62593270H equals 0A03ECD90H in 32 bits, imagine for a moment that you're subtracting from 102980000H instead of 2980000H, that is, you have the 33rd bit set. Then you have 102980000H - 62593270H = 0A03ECD90H. And you can verify that 102980000H = 62593270H + 0A03ECD90H. But since you only have 32 bits for the calculation, that 33rd bit, whatever it is, is not going to affect the sum and difference. So you just subtract the two numbers as 32-bit numbers and take the least significant 32-bits of the result, ignoring any outstanding borrows from bits beyond the 32nd.
And 0A03ECD90H has to be encoded in the jmp instruction from the least significant byte to the most significant byte, so you get this sequence of bytes encoding the instruction:
A similar question has been asked before.