jmp Instruction jmp Types
● Like a goto in a high-level language Relative short
● Encodes a single byte signed
● Format: jmp StatementLabel
displacement telling how far forward or
● The next statement executed will be the backward to jump for the next instruction
one at StatementLabel: to execute—the
● And execution continues thereafter. ● assembler uses this format if possible
● Sign extended before adding to
Instruction Pointer(*IP)
● jmp LabelNearby
Relative near
● Encodes a signed doubleword
displacement—this allows a forward or
backward jump essentially anywhere in
memory
● Added to EIP. Sign extended before
adding to RIP
● jmp LabelDistant
Backward ●
● To a statement that precedes the jmp Indirect forms
statement ● Encode the address of the destination in a
register or memory are not often used.
● jmp edx, jmp DestAddress, jmp DWORD
PTR [edx]
●
●
● Back 6 (-6) ●
Forward
● To a statement that follows the jmp Jmp encoding
statement
●
● Forward 7
Conditional Jump Cmp opcodes
Instructions
● Format: j-- targetStatement
● The last part of the mnemonic identifies
the condition under which the jump is to
be executed.
● If the condition holds, then the jump takes
place and the next statement executed is
at targetStatement:
● Otherwise, the next instruction (the one
following the conditional jump) is
executed.
● Used to implement if structures, other
selection structures, and loop structures
in 80x86 assembly language
Conditional jumps and flags
● Most “conditions” considered by the
conditional jump instructions are settings
of flags in the EFLAGS register.
● Example: jz endWhile
● means to jump to the statement with label
endWhile if the zero flag ZF is set to 1
● Conditional jump instructions don’t modify
flags; they react to previously set flag
values.
cmp Instructions
● Most common way to set flags for
conditional jumps cmp Scenarios for conditional
Flag
● Set: Corresponding bit is 1 (True) jumps
● Reset: Corresponding bit is 0 (False) Appropriate mnemonic to be used based on
Format: cmp operand1, operand2 signedness and criteria.
● Flags are set the same as for the ● Conditional Jumps to Use After Signed
subtraction operation operand1 – Operand Comparison
operand2 ● Conditional Jumps to Use After Unsigned
● Operands are not changed Operand Comparison
● Other Conditional Jumps (signedness
Cmp examples does not matter)
Conditional jumps Continuation Condition
● A Boolean expression
● Checked before the loop body is executed
● Whenever it is true, the loop body is
executed and then the continuation
condition is checked again.
● When it is false, execution continues with
the statement following the loop.
● It may take several 80x86 statements to
evaluate and check a continuation
condition.
EX:
for Loops
● Counter-controlled loop
● for pseudocode design
Ex:
cmp eax, nbr
jle smaller ● Loop body executed once for each value
of the loop index in the given range
● Convert for loop to equivalent while loop
While
for Loops Cautions
● If ECX is initially 0, then 00000000 will be
● Can be implemented by converting into
decremented to FFFFFFFF, then
while loops
FFFFFFFE, etc., for a total of
● 80x86 loop instruction designed to
4,294,967,296 iterations.
implement “backward” counter-controlled
● The jecxz (“jump if ECX is zero”)
loops:
instruction can be used to guard a loop
implemented with the loop instruction
until Loops
● until pseudocode design
loop Instruction
format: loop statementLabel
● statementLabel is the label of a statement
that is a short displacement from the loop
instruction.
● Termination condition checked after the
execution
loop body is executed
● The value in ECX is decremented.
● If true, execution continues with the
● If the new value in ECX is zero, then
statement following the until loop.
execution continues with the statement
● If false, the loop body is executed again.
following the loop instruction.
● If the new value in ECX is non-zero, then
a jump to the instruction at
statementLabel takes place.
Defining an Array
Typically declare a collection of contiguous
elements in the data section
Examples
array1 DWORD 25, 47, 15, 50, 32
● creates an array of 5 doublewords with
initial values
array2 DWORD 1000 DUP (?)
● creates an array of 1000 logically
uninitialized doublewords
Array Access
Sequential
● Start from the beginning of the array and
move to the next element and so on.
● start+size+..+size => nth element
Random
● Access any element of the array based on
its position/index.
● start+offset*size => nth element
Sequential Array Access
● Put the address of the first element in a
register (typically with a lea instruction)
● Register indirect addressing allows the
register to “point at” the array element to
be used
● Add the element size to the register to
point at the next element
Random Array Access
● Use indexed addressing
● Example nbrArray[4*ecx]
● where nbrArray references the array, ECX
is the index of the element to be accessed
and scaling factor 4 gives doubleword
element size
