Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to code a far absolute JMP/CALL instruction in MASM?

Tags:

x86

assembly

masm

How can I write a far absolute JMP or CALL instruction using MASM? Specifically how do I get it to emit these instruction using the EA and CA opcodes, without manually emitting them using DB or other data directives?

For example consider the case of jumping to the BIOS reset entry point at FFFF:0000 in a boot sector. If I were using NASM I could code this in one instruction in the obvious way:

jmp 0xffff:0

With the GNU assembler the syntax is less obvious, but the following will do the job:

jmp 0xffff, 0

However when I try the obvious solution with MASM:

jmp 0ffffh:0

I get the following error:

t206b.asm(3) : error A2096:segment, group, or segment register expected

Workarounds I'm trying to avoid

There are a number of possible workarounds I could use in MASM, like any of the following:

Hand assemble the instruction, emitting the machine code manually:

    DB 0EAh, 0, 0, 0FFh, 0FFh

Use a far indirect jump:

bios_reset DD 0ffff0000h
    ...
    jmp bios_reset   ; FF 2E opcode: indirect far jump

Or push the address on the stack and use a far RET instruction to "return" to it:

    push 0ffffh
    push 0
    retf

But is there anyway I can use an actual JMP instruction and have MASM generate the right opcode (EA)?

like image 870
Ross Ridge Avatar asked Sep 22 '15 01:09

Ross Ridge


People also ask

What instruction is JMP?

Description. The jmp instruction transfers execution control to a different point in the instruction stream; records no return information. Jumps with destinations of disp[8|16|32] or r/m[16|32] are near jumps and do not require changes to the segment register value.

How many bytes is JMP instruction?

Summary − So this instruction JMP requires 3-Bytes, 3-Machine Cycles (Opcode Fetch, Memory Read, MemoryRead) and 10 T-States for execution as shown in the timing diagram.

What is near jump and far jump?

Short jump—A near jump where the jump range is limited to –128 to +127 from the current EIP value. Far jump—A jump to an instruction located in a different segment than the current code segment but at the same privilege level, sometimes referred to as an intersegment jump.

What is short jump in microprocessor?

"short" jmp specifically means the rel8 2-byte encoding for near jumps. You're conflating that with "near" jumps/calls in general, which change IP/EIP/RIP but not CS.


1 Answers

There's one way you can do it, but you need to use MASM's /omf switch so that it generates object files in the OMF format. This means the object files need to be linked with an OMF compatible linker, like Microsoft's old segmented linker (and not their current 32-bit linker.)

To do it you need to use a rarely used and not well understood feature of MASM, the SEGMENT directive's AT address attribute. The AT attribute tells linker that the segment lives at a fixed paragraph address in memory, as given by address. It also tells the linker to discard the segment, meaning the contents of the segment aren't used, just its labels. This is also why the /omf switch has to be used. MASM's default object file format, PECOFF, doesn't support this.

The AT attribute gives the you segment part of the address we want to jump to. To get the offset part all you need to do is use the LABEL directive inside the segment. Combined with the ORG directive, this lets you create a label at the specific offset in the specific segment. All you then need to do is use this label in the JMP or CALL instruction.

For example if you want to jump to the BIOS reset routine you can do this:

bios_reset_seg SEGMENT USE16 AT 0ffffh
bios_reset LABEL FAR
bios_reset_seg ENDS

_TEXT SEGMENT USE16 'CODE'
    jmp bios_reset
_TEXT ENDS

Or if you want to call the second stage part of your boot loader whose entry point is at 0000:7E00:

zero_seg SEGMENT USE16 AT 0
    ORG 7e00h
second_stage LABEL FAR
zero_seg ENDS

_TEXT SEGMENT USE16 'CODE'
    call second_stage
_TEXT ENDS
like image 186
Ross Ridge Avatar answered Oct 21 '22 11:10

Ross Ridge