assembly jmp to a line that doesn't exist

Assembly code showing JMPQ

For the line that says "jmpq *0x400850", there is actually no such line has 0x400850. In this case, since I cannot jump to the place that it is mentioned, do I just skip this command and go to the command that is in the line below?

So the answers told me to type "objdump" in terminal, so I typed

    objdump -d ./bin-lab-ref > output.txt

and I got no output in the terminal.
What should I do in this situation?

edited Nov 14 '18 at 19:28

Peter Cordes

126k18189325

asked Nov 14 '18 at 14:27

Juniper Sohn

6

* means indirect jump, that is through a pointer in memory. 0x400850 is the address of that pointer not the target of the jump. PS: please don't use images for code, copy-paste it as text instead.

– Jester
Nov 14 '18 at 14:32

It's an unconditional jmp; it never falls through. In machine code, the jmp doesn't "search" for the target line or address, it just jumps there.

– Peter Cordes
Nov 14 '18 at 14:47

Note that assembly is made of instructions, not commands. Try to use the correct terminology, this makes it easier for others to help you.

– fuz
Nov 14 '18 at 15:06

Use Intel syntax and you might be able to read something ;)

– Trass3r
Nov 14 '18 at 15:12

For the next time: please do not post pictures of code. Always post code as text instead of as pictures!

– fuz
Nov 14 '18 at 15:33

|
show 3 more comments

Assembly code showing JMPQ

So the answers told me to type "objdump" in terminal, so I typed

    objdump -d ./bin-lab-ref > output.txt

and I got no output in the terminal.
What should I do in this situation?

edited Nov 14 '18 at 19:28

Peter Cordes

126k18189325

asked Nov 14 '18 at 14:27

Juniper Sohn

6

* means indirect jump, that is through a pointer in memory. 0x400850 is the address of that pointer not the target of the jump. PS: please don't use images for code, copy-paste it as text instead.

– Jester
Nov 14 '18 at 14:32

It's an unconditional jmp; it never falls through. In machine code, the jmp doesn't "search" for the target line or address, it just jumps there.

– Peter Cordes
Nov 14 '18 at 14:47

Note that assembly is made of instructions, not commands. Try to use the correct terminology, this makes it easier for others to help you.

– fuz
Nov 14 '18 at 15:06

Use Intel syntax and you might be able to read something ;)

– Trass3r
Nov 14 '18 at 15:12

For the next time: please do not post pictures of code. Always post code as text instead of as pictures!

– fuz
Nov 14 '18 at 15:33

|
show 3 more comments

Assembly code showing JMPQ

So the answers told me to type "objdump" in terminal, so I typed

    objdump -d ./bin-lab-ref > output.txt

and I got no output in the terminal.
What should I do in this situation?

edited Nov 14 '18 at 19:28

Peter Cordes

126k18189325

asked Nov 14 '18 at 14:27

Juniper Sohn

Assembly code showing JMPQ

So the answers told me to type "objdump" in terminal, so I typed

    objdump -d ./bin-lab-ref > output.txt

and I got no output in the terminal.
What should I do in this situation?

assembly x86 reverse-engineering att jmp

edited Nov 14 '18 at 19:28

Peter Cordes

126k18189325

asked Nov 14 '18 at 14:27

Juniper Sohn

edited Nov 14 '18 at 19:28

Peter Cordes

126k18189325

asked Nov 14 '18 at 14:27

Juniper Sohn

edited Nov 14 '18 at 19:28

Peter Cordes

126k18189325

edited Nov 14 '18 at 19:28

Peter Cordes

126k18189325

edited Nov 14 '18 at 19:28

Peter Cordes

126k18189325

asked Nov 14 '18 at 14:27

Juniper Sohn

asked Nov 14 '18 at 14:27

Juniper Sohn

asked Nov 14 '18 at 14:27

Juniper Sohn

6

* means indirect jump, that is through a pointer in memory. 0x400850 is the address of that pointer not the target of the jump. PS: please don't use images for code, copy-paste it as text instead.

– Jester
Nov 14 '18 at 14:32

It's an unconditional jmp; it never falls through. In machine code, the jmp doesn't "search" for the target line or address, it just jumps there.

– Peter Cordes
Nov 14 '18 at 14:47

Note that assembly is made of instructions, not commands. Try to use the correct terminology, this makes it easier for others to help you.

– fuz
Nov 14 '18 at 15:06

Use Intel syntax and you might be able to read something ;)

– Trass3r
Nov 14 '18 at 15:12

For the next time: please do not post pictures of code. Always post code as text instead of as pictures!

– fuz
Nov 14 '18 at 15:33

|
show 3 more comments

6

* means indirect jump, that is through a pointer in memory. 0x400850 is the address of that pointer not the target of the jump. PS: please don't use images for code, copy-paste it as text instead.

– Jester
Nov 14 '18 at 14:32

It's an unconditional jmp; it never falls through. In machine code, the jmp doesn't "search" for the target line or address, it just jumps there.

– Peter Cordes
Nov 14 '18 at 14:47

Note that assembly is made of instructions, not commands. Try to use the correct terminology, this makes it easier for others to help you.

– fuz
Nov 14 '18 at 15:06

Use Intel syntax and you might be able to read something ;)

– Trass3r
Nov 14 '18 at 15:12

For the next time: please do not post pictures of code. Always post code as text instead of as pictures!

– fuz
Nov 14 '18 at 15:33

* means indirect jump, that is through a pointer in memory. 0x400850 is the address of that pointer not the target of the jump. PS: please don't use images for code, copy-paste it as text instead.

– Jester
Nov 14 '18 at 14:32

It's an unconditional jmp; it never falls through. In machine code, the jmp doesn't "search" for the target line or address, it just jumps there.

– Peter Cordes
Nov 14 '18 at 14:47

Note that assembly is made of instructions, not commands. Try to use the correct terminology, this makes it easier for others to help you.

– fuz
Nov 14 '18 at 15:06

Use Intel syntax and you might be able to read something ;)

– Trass3r
Nov 14 '18 at 15:12

For the next time: please do not post pictures of code. Always post code as text instead of as pictures!

– fuz
Nov 14 '18 at 15:33

|
show 3 more comments

1 Answer
1

active

oldest

votes

The instruction jmpq *0x400850(,%rax,8) jumps to the value stored at address 0x400850(,%rax,8), not to the address 0x400850(,%rax,8) itself. Likely, there is a jump table at this address and rax selects an entry from the jump table to jump to.

Inspect the memory around 0x400850 to find out what entries the jump table has and thus where the jump goes. You can get a dump of the executable's image using objdump -s.

edited Nov 14 '18 at 15:14

answered Nov 14 '18 at 15:08

fuz

58.4k14127257

2

@JuniperSohn The memory address 400850 is likely not part of the .text section but rather of the .rodata section. Since this section does not contain code (but rather data), it is not disassembled if you pass -d. Inspect the output of objdump -s to see the content of all sections.

– fuz
Nov 14 '18 at 15:23

1

@JuniperSohn: it's data, not code, so objdump -d won't show it. But objdump -s or -D will hexdump all sections. Or look at it in GDB while debugging a running process started from the executable. The address looks about right for .section .rodata, and it's in the same page as the instructions you're showing, so it definitely exists.

– Peter Cordes
Nov 14 '18 at 15:24

1

@JuniperSohn If you have trouble interpreting the output of objdump -s, feel free to post it and I can tell you what it means. Make sure to post it as text, not as an image. Never post images of text.

– fuz
Nov 14 '18 at 15:27

1

@Jester someone™ should make a canonical question/solution to all bomb labs just to get rid of these questions. They do get a bit annoying by the time.

– fuz
Nov 14 '18 at 15:28

2

I am guessing it's the 64 bit version of this

– Jester
Nov 14 '18 at 15:31

|
show 7 more comments

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53302503%2fassembly-jmp-to-a-line-that-doesnt-exist%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

Inspect the memory around 0x400850 to find out what entries the jump table has and thus where the jump goes. You can get a dump of the executable's image using objdump -s.

edited Nov 14 '18 at 15:14

answered Nov 14 '18 at 15:08

fuz

58.4k14127257

2

@JuniperSohn The memory address 400850 is likely not part of the .text section but rather of the .rodata section. Since this section does not contain code (but rather data), it is not disassembled if you pass -d. Inspect the output of objdump -s to see the content of all sections.

– fuz
Nov 14 '18 at 15:23

1

@JuniperSohn: it's data, not code, so objdump -d won't show it. But objdump -s or -D will hexdump all sections. Or look at it in GDB while debugging a running process started from the executable. The address looks about right for .section .rodata, and it's in the same page as the instructions you're showing, so it definitely exists.

– Peter Cordes
Nov 14 '18 at 15:24

1

@JuniperSohn If you have trouble interpreting the output of objdump -s, feel free to post it and I can tell you what it means. Make sure to post it as text, not as an image. Never post images of text.

– fuz
Nov 14 '18 at 15:27

1

@Jester someone™ should make a canonical question/solution to all bomb labs just to get rid of these questions. They do get a bit annoying by the time.

– fuz
Nov 14 '18 at 15:28

2

I am guessing it's the 64 bit version of this

– Jester
Nov 14 '18 at 15:31

|
show 7 more comments

Inspect the memory around 0x400850 to find out what entries the jump table has and thus where the jump goes. You can get a dump of the executable's image using objdump -s.

edited Nov 14 '18 at 15:14

answered Nov 14 '18 at 15:08

fuz

58.4k14127257

2

@JuniperSohn The memory address 400850 is likely not part of the .text section but rather of the .rodata section. Since this section does not contain code (but rather data), it is not disassembled if you pass -d. Inspect the output of objdump -s to see the content of all sections.

– fuz
Nov 14 '18 at 15:23

1

@JuniperSohn: it's data, not code, so objdump -d won't show it. But objdump -s or -D will hexdump all sections. Or look at it in GDB while debugging a running process started from the executable. The address looks about right for .section .rodata, and it's in the same page as the instructions you're showing, so it definitely exists.

– Peter Cordes
Nov 14 '18 at 15:24

1

@JuniperSohn If you have trouble interpreting the output of objdump -s, feel free to post it and I can tell you what it means. Make sure to post it as text, not as an image. Never post images of text.

– fuz
Nov 14 '18 at 15:27

1

@Jester someone™ should make a canonical question/solution to all bomb labs just to get rid of these questions. They do get a bit annoying by the time.

– fuz
Nov 14 '18 at 15:28

2

I am guessing it's the 64 bit version of this

– Jester
Nov 14 '18 at 15:31

|
show 7 more comments

Inspect the memory around 0x400850 to find out what entries the jump table has and thus where the jump goes. You can get a dump of the executable's image using objdump -s.

edited Nov 14 '18 at 15:14

answered Nov 14 '18 at 15:08

fuz

58.4k14127257

Inspect the memory around 0x400850 to find out what entries the jump table has and thus where the jump goes. You can get a dump of the executable's image using objdump -s.

edited Nov 14 '18 at 15:14

answered Nov 14 '18 at 15:08

fuz

58.4k14127257

edited Nov 14 '18 at 15:14

answered Nov 14 '18 at 15:08

fuz

58.4k14127257

answered Nov 14 '18 at 15:08

fuz

58.4k14127257

answered Nov 14 '18 at 15:08

fuz

58.4k14127257

2

@JuniperSohn The memory address 400850 is likely not part of the .text section but rather of the .rodata section. Since this section does not contain code (but rather data), it is not disassembled if you pass -d. Inspect the output of objdump -s to see the content of all sections.

– fuz
Nov 14 '18 at 15:23

1

@JuniperSohn: it's data, not code, so objdump -d won't show it. But objdump -s or -D will hexdump all sections. Or look at it in GDB while debugging a running process started from the executable. The address looks about right for .section .rodata, and it's in the same page as the instructions you're showing, so it definitely exists.

– Peter Cordes
Nov 14 '18 at 15:24

1

@JuniperSohn If you have trouble interpreting the output of objdump -s, feel free to post it and I can tell you what it means. Make sure to post it as text, not as an image. Never post images of text.

– fuz
Nov 14 '18 at 15:27

1

@Jester someone™ should make a canonical question/solution to all bomb labs just to get rid of these questions. They do get a bit annoying by the time.

– fuz
Nov 14 '18 at 15:28

2

I am guessing it's the 64 bit version of this

– Jester
Nov 14 '18 at 15:31

|
show 7 more comments

2

@JuniperSohn The memory address 400850 is likely not part of the .text section but rather of the .rodata section. Since this section does not contain code (but rather data), it is not disassembled if you pass -d. Inspect the output of objdump -s to see the content of all sections.

– fuz
Nov 14 '18 at 15:23

1

@JuniperSohn: it's data, not code, so objdump -d won't show it. But objdump -s or -D will hexdump all sections. Or look at it in GDB while debugging a running process started from the executable. The address looks about right for .section .rodata, and it's in the same page as the instructions you're showing, so it definitely exists.

– Peter Cordes
Nov 14 '18 at 15:24

1

@JuniperSohn If you have trouble interpreting the output of objdump -s, feel free to post it and I can tell you what it means. Make sure to post it as text, not as an image. Never post images of text.

– fuz
Nov 14 '18 at 15:27

1

@Jester someone™ should make a canonical question/solution to all bomb labs just to get rid of these questions. They do get a bit annoying by the time.

– fuz
Nov 14 '18 at 15:28

2

I am guessing it's the 64 bit version of this

– Jester
Nov 14 '18 at 15:31

@JuniperSohn The memory address 400850 is likely not part of the .text section but rather of the .rodata section. Since this section does not contain code (but rather data), it is not disassembled if you pass -d. Inspect the output of objdump -s to see the content of all sections.

– fuz
Nov 14 '18 at 15:23

@JuniperSohn: it's data, not code, so objdump -d won't show it. But objdump -s or -D will hexdump all sections. Or look at it in GDB while debugging a running process started from the executable. The address looks about right for .section .rodata, and it's in the same page as the instructions you're showing, so it definitely exists.

– Peter Cordes
Nov 14 '18 at 15:24

@JuniperSohn If you have trouble interpreting the output of objdump -s, feel free to post it and I can tell you what it means. Make sure to post it as text, not as an image. Never post images of text.

– fuz
Nov 14 '18 at 15:27

@Jester someone™ should make a canonical question/solution to all bomb labs just to get rid of these questions. They do get a bit annoying by the time.

– fuz
Nov 14 '18 at 15:28

I am guessing it's the 64 bit version of this

– Jester
Nov 14 '18 at 15:31

|
show 7 more comments

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Vfrdtyky