I came through a post on Offensive Security and while reading , the author stated that:

At next SEH (when using a SE Handler address that starts with a null byte), we usually will put some code to jump back. After all, the null byte would acts as a string terminator and it does not make sense to put something after the SE Handler address (after all, you would not be able to jump to it anyway, right ?)

Typically, in a scenario like this, we want to do a short jump back… this jumpback opcode looks like this :xebxf0xffxff (so basically, jump back 10 bytes)

So, as per my understanding, to jmp back, I have to convert the decimal value to hex (I am using this [printf "%x\n" -7] in my shell as a quick way to convert -7 to hex) then add this value to the jmp instruction \xeb.

I have 2 questions here:

1-the final format of the opcode should be \xeb\xAA\xBB\xCC\xDD (the jump instruction \xeb followed by 4 bytes), however, the author includes only 3 bytes after \xeb ? is there is a missing \xff?

2-the author states that \xeb\xf0\xff\xff jumps back 10 bytes, however, I converted it myself and found that jumping back 10 bytes should be \xeb\xf6\xff\xff instead of \xeb\xf0\xff\xff which jumps back 16 bytes ?

  • 1
    Since it's a short jump the code should be EB followed by one byte. If I remember correctly those jump offsets are relative to the end of the jump instruction. – CodesInChaos Jul 28 '13 at 8:37

There are several jump opcodes; see the Intel manuals. I recommend the original 80386 manual which talks only about the 32-bit 80386, thus omitting all the extra features of ulterior CPU: this will make for a much easier, shorter read.

Go page 319 of that manual: you will see that, at the machine code level, there are no less than 21 distinct jump opcodes. The one which begins with EB is a short jump, followed by a single byte, thus allowing for a jump range of -128 to +127 bytes. The displacement is counted from the byte which immediately follows the whole instruction (the first byte after the one-byte displacement parameter), so EB 00 is a no-operation: it jumps to the instruction which follows the jump, where it would have gone anyway if there had been no jump. Similarly, EB FE is an infinite loop (jump back to itself). EB F0 jumps back 16 bytes, hence 14 bytes before the EB byte.

Note: be wary about the 16-bit/32-bit duality of x86 processors. All modern operating systems run in 32-bit mode. This changes nothing for the "short jump" we are talking about here, but it alters "near jumps" which will take a 32-bit displacement offset in 32-bit mode.

|improve this answer|||||
  • Thanks, this clarifies the picture here. just to make sure that I grasp it correctly. This means that \xeb\xf0\xff\xff will not jump back 10 bytes as the author stated, it should be \xeb\xf4\xff\xff which means a total displacement of -12 and -10 from the EB byte ? right ? Also, can I remove these FF as its useless ? – Ahmed Taher Jul 29 '13 at 21:21
  • Well, yes. That's what the manuals say. I have not read the article you link to, so I cannot truthfully comment on it. – Thomas Pornin Jul 29 '13 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.