Hello and welcome.
In this section, we are going to take a look at the first jump instruction, which is an unconditional
jump.
It is the instruction called JMP.
And this instruction will cause a jump to happen irrespective of any conditions in the -.
It does not depend on the - registers.
And the syntax for this JMP is JMP followed by destination.
And you have three forms.
The destination can be an address, which in this case will be a jump to an address, or it could
be a register.
So it will jump to the register, and the register will contain an address.
So whatever is in the address in the register, it will jump to that address.
And the third form is jump memory, which means whatever address is in that memory, it will jump to that
address.
So we start off now by first opening the template2.exe in the x64dbg, and then put a breakpoint at
this location.
So let's say now we want to jump to address direct.
So we can select an address we want to jump to.
Let's say we want to jump to this address here.
But first, let us put some dummy instruction here.
So let's say we put an instruction to move something to -.
Move one to -.
And now we are going to put another instruction here which will cause it to jump to this address.
So we will copy this address by right-clicking this address.
And copying it.
And then we come back here and put our jump.
Put the prefix 0x, paste your address there, hit okay.
And now immediately you will see that there is a jump here.
If you click on the jump here, you will see that there is a red arrow going down to the address that
you are going to jump to.
So it is going to jump to this address 0x401150, which is over here.
And then execute this line.
Now, what happens to all the instructions in between?
It will skip it totally.
It will not execute it.
So just for demonstration, let us put an instruction here to do something.
Let's say we move two to -.
So move - two.
Now let's run to our breakpoint here and step over until we come to this line.
So once we are now in this line, you will notice the red arrow here, which indicates that it will
jump down here.
And you will see that after this jump is supposed to move two to -, but this will be jumped
over.
That means this instruction will never happen.
Let's step over and see what happens.
And immediately you see it jumps down here.
So the value in - remains as one.
It has not changed because this instruction did not happen.
Now let's step over this.
So now we move one to -.
So one is in -.
So this is how we jump.
Next one is jump register.
So now for this, we have to put an address in a register.
Let's say we put an address in the - register.
So let's choose an address for that demonstration.
Let's choose this one.
Right-click on this.
Let's put some instruction there.
Let's say we move three to -.
All right.
Now we are going to jump to this address, and we are going to put this address in the register.
So we copy this address first.
And then go to the register -, right-click on it, modify value, and paste the address here.
Hit okay.
So this address 0x401580 is referring to this location here.
So we want to jump there.
So we assemble a jump here.
Jump to the register -.
So what will happen is it's supposed to jump to the - register and fetch the address there, and
then it will jump to that address, which is this address here.
So let's execute it now by running, stepping over it.
So we jump to fetch this address here and jump to that address.
And so now we are here.
And now if we run this, it's supposed to move three to -.
Step over that, and you find three in -.
All right.
So let's take a look at the next example, which is to jump to the memory.
So to do that, we will first choose a memory.
We want to jump to an address we want to jump to.
So let's say we choose this address over here, 0x...598.
And we put the instruction there.
Move maybe eight
to -.
Now we want to jump to this address, but we want to put this address in memory.
So what we do is we will click on dump one, then click on memory map.
Then look for data segment.
You can also use BSS.
So we double-click the data segment, and it will show us the data segment in dump one.
Now we scroll down and look for empty space in memory, and we choose this one.
So we need to use the QWORD.
QWORD is
quad word, so 16... 8 bytes.
We cannot use part of it.
We cannot use DWORD because in the syntax for JMP, it must be a QWORD.
So we are going to store this address in memory here.
And this address is also a QWORD.
So this address here must be stored in memory in reverse order because of the little-endian convention.
So we need to store 98, 15, and 40.
So we right-click this and we binary edit.
And here we store in reverse order.
So 98 will be here, followed by 15, followed by 40.
40, and then we hit okay.
Now we see that our address is stored here in reverse order from the right to the left.
So if you read it from the right to the left, the first 00 here, the first byte 00 will
be referring to this 00 here.
And then you read backwards.
Read backwards all the way.
Then you will count to 40 over here, 15 over here, 98 over here.
So we have our QWORD address in this address 0x403140.
Now what we need to do is we need to jump to this address here.
So we right-click this and we copy this address.
And we come up to here and assemble our jump.
Jump QWORD PTR to dereference it.
And then we put our 0x prefix.
And then we paste our address there and hit okay.
So now we have a jump here.
So when it executes, it will jump to this address 0x403140.
And then dereference the address by fetching the value stored there.
So it will get the value stored there, which is 0x401598.
And jump to that address.
As you can see, the arrow points over here already.
So let's step over, and it jumps to that address 0x401598.
So what happens is when it goes to this address 0x403140, it will then fetch the value stored there.
And it will deconstruct it back into the reverse order.
So it will get back the address
0x401598 and then jump there.
So that is why it jumps over there.
And now it's going to execute this instruction.
And let's step over that and watch E, watch -.
So we step over, and it has moved it to -.
So this is how you can use jump inside your assembly code.
And very often you will find that certain programs will use this method, jump - or even jump
memory.
And this is part of the obfuscation to prevent analysis.
Usually those software which use some kind of protection, software protection, will use this method
so that it prevents analysis.
Why?
Because static analysis especially will depend on the static values stored in the
code to understand how the program flow logic.
But for those software which use software protection, then the address that you jump to will only
be calculated during runtime.
And so that defeats static analysis.
So this is a way of enforcing or implementing software security.
So that is why understanding this is important.
So that's all for this video.
Thank you for watching.