Lesson 6 - Jump and Loop Structures (1)
Lesson 6 - Jump and Loop Structures (1)
somePlace:
;some other code
JMP somePlace
2
Unconditional Jumping: JMP
● Jumping always has limits
○ The limit is more strict for the conditional jumps
● For Unconditional jumping, there are three different types of jumps that can
be made, each with their own limit:
○ Short: -128 to +127 bytes from the jump instruction
○ Near: < -128 or > 127 bytes from the jump instruction, anywhere else in the same segment
○ Far: Outside the same segment
● An unconditional jump can be helpful for creating a program that loops
forever in the main procedure
○ Add a label to the top, then add a jump back to that label at the bottom
○ You also might want to create some break condition later in your main program to allow for
clean exiting
3
Looping: LOOP
LOOP label
● Creates a counting loop
● ECX becomes the counter variable - before your loop executes, it needs to
be set to the proper value
● Similar in syntax to jumping
● Logically:
○ ECX = ECX - 1
○ Jump if ECX != 0
● Implementation:
○ Calculate the distance, in bytes, between the offset of the following instruction and the offset
of the target label.
○ Add that value to EIP
4
Looping
● Each loop in a program needs to have a unique label
● Example:
MOV ECX, 10
countingLoop:
;some code here
LOOP countingLoop
5
Conditional Looping: LOOPZ/LOOPE
LOOPZ label / LOOPE label
● Creates a counting loop that will continue to loop while ECX > 0 and the zero
flag is set
● Logically:
○ ECX = ECX - 1
○ Jump if ECX != 0 and ZF = 1
● This loop is useful if you need to find the first value in an array that does not
match a specific pattern
6
Conditional Looping: LOOPNZ/LOOPNE
LOOPNZ label / LOOPNE label
● Creates a counting loop that will continue to loop while ECX > 0 and the zero
flag is not set
● Logically:
○ ECX = ECX - 1
○ Jump if ECX != 0 and ZF = 0
● Since this loop is the opposite of LOOPZ/LOOPE, it is useful if you need to
find the first value in an array that does match a specific pattern
7
Nested Loops
● You can create nested loops, but this requires some care
● The value of the outer loop’s counter (ECX) must be saved before each time the inner loop starts, and restored after it
finishes.
● There are a few ways to do this:
○ Save it in a variable - not ideal if you have multiple nested loops, or
○ Use the runtime stack (We’ll cover this in a later lecture)
● Example:
.data
count DWORD ?
.code
MOV ECX, 100 ;set outer loop count
L1:
MOV count, ECX ;save outer loop count
MOV ECX, 20 ;set inner loop count
L2:
;Inner Loop Code
loop L2 ;repeat the inner loop
MOV ECX, count ;restore outer loop count
loop L1 ;repeat the outer loop
8
Making Comparisons: CMP
CMP destination, source
9
Review: CPU Status Flags
● Zero Flag: set when the result of the previous operation was zero
● Carry Flag: set when the result of the previous operation is too large or too
small to fit into its destination
● Sign Flag: set when the result of the previous operation produces a
negative value in the destination operand
● Overflow Flag: set when the result of the previous operation produces an
invalid signed result
● Parity Flag: set when the low byte of the result of the previous operation
contains an even number of 1 bits
● Auxiliary Carry Flag: set when the previous operation causes a carry from
bit 3 to bit 4
10
Conditional Jumping: Jcond
● Similar in syntax and purpose to an unconditional jump (JMP) but only
executes the jump if the condition provided is true.
● Examples:
○ JB, JC - jump to a label if the Carry flag is set
○ JE, JZ - jump to a label if the Zero flag is set
○ JS - jump to a label if the Sign flag is set
○ JNE, JNZ - jump to a label if the Zero flag is clear
○ JECXZ - jump to a label if ECX = 0
● These examples look at a specific flag, but jumps can also be conditional
based on the result of an arithmetic (mathematical) or logical (i.e.,
comparison) operations
11
Conditional Jumping: Jumping on Flag Values
12
Conditional Jumping: Jumping on Equality
13
Conditional Jumping: Jumping on Unsigned Comparisons
14
Conditional Jumping: Jumping on Signed Comparisons
15
Loop Patterns
● The loop, as we’ve seen it so far, has been similar to a do-while Java loop:
In Assembly: In Java:
loop1: do {
;do some work //do some work
LOOP loop1 } while(ECX != 0)
16
Conditional Branching Structures
● Things to think about:
○ How would we create the If structure in Assembly?
○ How would we create the if-else structure in Assembly?
○ How would we create the if-else-if-else structure in Assembly?
○ How would we create if statements with complex conditions in Assembly?
○ How would we create the logic of the normal LOOP instruction using only jumps?
17
Conditional Branching Structures
● Program Examples:
○ Write a program to collect 10 numbers from the user and store them in an array. Loop
through the array without using the LOOP instruction to display each element with a comma
after it, except for the last one.
■ Now Modify the program to also calculate the sum of the array elements and display it,
using the LOOP instruction.
○ Create a program to collect two unsigned integers from the user and compare them. Display
a > b, a < b, or a = b back to the user.
■ What changes need to be made to make this program work for signed integers? Make
the changes and rerun your code.
○ Create a program that will collect a signed number from the user and display it back to them
until they enter a zero.
18
Bit Testing: TEST
TEST destination, source
19
Bit Testing: BT/BTC/BTR/BTS
BT source, n / BTC source, n / BTR source, n / BTS source n
● All of these will copy bit n of the source operand to the carry flag
● The three-letter opcodes will also:
○ BTC - complements bit n of the source operand
○ BTR - clears (i.e., sets to zero) bit n of the source operand
○ BTS - sets (i.e., sets to one) bit n of the source operand
● The source can only be a 16 or 32 bit register or memory, and the
destination can only be an immediate value or a 16 or 32 bit register.
● You can use the conditional jumps JC or JNC to detect the result.
20
Bit Scanning: BSF/BSR
BSF destination, source / BTR destination, source
21