What does the "SHORT" mean in this code?
JE SHORT 00013FB8
A jump instruction, like "jmp", just switches the CPU to executing a different piece of code. It's the assembly equivalent of "goto", but unlike goto, jumps are notconsidered shameful in assembly.
Short jump—A near jump where the jump range is limited to –128 to +127 from the current EIP value. Far jump—A jump to an instruction located in a different segment than the current code segment but at the same privilege level, sometimes referred to as an intersegment jump.
A short JMP is the relative JMP that you refer to. It is encoded as a two bytes; the actual JMP and the number of bytes +/- relative to the current IP. A near jump allows you to jump within the current "segment" (using real mode terms) or within the currently selected memory area in the CS selector.
Short jumps (and near calls) are jumps whose target is in the same module (i.e. they are intramodular, however it is possible to get intermodular variants from certain hacks). They are most commonly up to 127 bytes of relative displacement (they change the flow of execution forward or backward from the address of the instruction), however there are 16bit variants offering 32k bytes.
You don't really need to worry about it much, its really superfluous information, but the intel developer manuals (volumes 2a and 2b, specifically 2a) will cover the gory details.
A short jump can be achieved using a relative offset from the current assembly instruction. For x86/32-bit, this is a 2 byte instruction, where the first byte is always EB
, for short jump, and the second byte is the number of bytes before or after the current instruction to jump. The second byte is a signed 8-bit number, so the the furthest short jump on x86 is +/-127 bytes away. Anything past +/-127 bytes away is a long jump, E9
, and must use the full 32-bit address; resulting in a 5 byte instruction.
This is important to keep in mind if you are inline patching assembly code.
ex.
EB 0
would jump to the opcode following the short jump, not the line of code itself.
ex.
EB 7F
is the furthest jump down.
It means that it isn't jumping very far. Depending on the disassembler, the number after that will either be the address that it jumps to or a relative offset which tells you how many bytes are between the next instruction and the target of the jump.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With