Skip to main content
Reverse Engineering

Return to Question

add architecture tag
Link
edit approved May 26, 2014 at 14:52
phuclv
edit approved May 26, 2014 at 14:52
phuclv
  • 486
  • 3
  • 15
Tweeted twitter.com/#!/StackReverseEng/status/470286443063955456
Better usage of the wiki syntax
Source Link
perror
perror
  • 19.2k
  • 29
  • 89
  • 151

iI wanted to know if a jump instruction as JEJE must directly follow to a CMPCMP instruction. Until Until now, iI did always see that first a CMPCMP comes and after that a JMPJMP. But But today iI have discover the following:

... CMP DWORD PTR SS:[EBP+0xC], EAX MOV ECX, DWORD PTR SS:[EBP+0x18] PUSH ESI MOV ECX, DWORD PTR SS:[EBP+0x18] MOV DWORD PTR SS:[ECX],EAX MOV EAX, DWORD PTR SS:[EBP+0x10] MOV DWORD PTR SS:[EDI], 0x1 JE SHORT crtdll.6C250E66 ....

First of all, iI am beginner. So i, I try to understand the assembly language. Logically i, I would say that the JEJE instruction is related to the CMPCMP instruction at the beginning of that sequence. So

So, my self-explanation was that we first compare, then do some MOVMOV and PUSHPUSH operations, after that all we are jumping, is that right?

But, as iI mentioned above, normally the jump comes in the next line after the comparison, could one say the reason for that late jump instruction here  ? Or is it normal  ?

i wanted to know if a jump instruction as JE must directly follow to a CMP instruction. Until now, i always see that first a CMP comes and after that a JMP. But today i have discover the following:

... CMP DWORD PTR SS:[EBP+0xC], EAX MOV ECX, DWORD PTR SS:[EBP+0x18] PUSH ESI MOV ECX, DWORD PTR SS:[EBP+0x18] MOV DWORD PTR SS:[ECX],EAX MOV EAX, DWORD PTR SS:[EBP+0x10] MOV DWORD PTR SS:[EDI], 0x1 JE SHORT crtdll.6C250E66 ....

First of all, i am beginner. So i try to understand the assembly language. Logically i would say that the JE instruction is related to the CMP instruction at the beginning of that sequence. So, my self-explanation was that we first compare, then do some MOV and PUSH operations, after that all we are jumping, is that right?

But as i mentioned above, normally the jump comes in the next line after the comparison, could one say the reason for that late jump instruction here? Or is it normal?

I wanted to know if a jump instruction as JE must directly follow to a CMP instruction. Until now, I did always see that first a CMP comes and after that a JMP. But today I have discover the following:

... CMP DWORD PTR SS:[EBP+0xC], EAX MOV ECX, DWORD PTR SS:[EBP+0x18] PUSH ESI MOV ECX, DWORD PTR SS:[EBP+0x18] MOV DWORD PTR SS:[ECX],EAX MOV EAX, DWORD PTR SS:[EBP+0x10] MOV DWORD PTR SS:[EDI], 0x1 JE SHORT crtdll.6C250E66 ....

First of all, I am beginner. So, I try to understand the assembly language. Logically, I would say that the JE instruction is related to the CMP instruction at the beginning of that sequence.

So, my self-explanation was that we first compare, then do some MOV and PUSH operations, after that all we are jumping, is that right?

But, as I mentioned above, normally the jump comes in the next line after the comparison, could one say the reason for that late jump instruction here  ? Or is it normal  ?

Source Link
user3097712
user3097712
  • 1.5k
  • 1
  • 26
  • 44

Does a JE must follow directly to an CMP?

i wanted to know if a jump instruction as JE must directly follow to a CMP instruction. Until now, i always see that first a CMP comes and after that a JMP. But today i have discover the following:

... CMP DWORD PTR SS:[EBP+0xC], EAX MOV ECX, DWORD PTR SS:[EBP+0x18] PUSH ESI MOV ECX, DWORD PTR SS:[EBP+0x18] MOV DWORD PTR SS:[ECX],EAX MOV EAX, DWORD PTR SS:[EBP+0x10] MOV DWORD PTR SS:[EDI], 0x1 JE SHORT crtdll.6C250E66 ....

First of all, i am beginner. So i try to understand the assembly language. Logically i would say that the JE instruction is related to the CMP instruction at the beginning of that sequence. So, my self-explanation was that we first compare, then do some MOV and PUSH operations, after that all we are jumping, is that right?

But as i mentioned above, normally the jump comes in the next line after the comparison, could one say the reason for that late jump instruction here? Or is it normal?