Calculate a 32 bit relative jump offset with x86

user_6469690 0
Viewed 78

I want to modify an entry point of a 32 bit DLL. I already tried to overwrite the entry point with ...

mov     eax, OFFSET absolute_immediate
jmp     eax

... encoded in this hook pattern.

// mov eax, addr; jmp eax
static uchar_t hookPattern[] = { 0xB8, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE0 };

The code works correctly but I'd like to have a relative jump.
I tried this hook pattern:

static uchar_t hookPattern[] = { 0xE9, 0x00, 0x00, 0x00, 0x00 }; // jmp REL32

And overwrote the four relative bytes like that:

DWORD dwModify = (char *)&::myHook - (char *)entryPoint;
memcpy( hookPattern + 1, &dwModify, sizeof dwModify );

Buf if I call entryPoint I get redirected to a completely different function of my runtime by accident but not to myHook.
Am I missing something with the calculation of the relative offset ?

x86 assembly
1 Answers

The offset in a relative branch instruction is relative to the beginning of the following instruction.

So you need to subtract the size of the branch instruction from the offset, like this:

DWORD dwModify = (char *)&::myHook - (char *)entryPoint - sizeof hookPattern;
user_84223300
Related