The Address of the Next Instruction

[Citric]

Hi All

Is it possible to move the address of the next into a variable ie

Code Select Expand


    mov eax,"next instruction address"
    mov [spotToJumpBackToo],eax


Cheer Adam

[Petroizki]

Maybe you could do something like?

Code Select Expand

mov eax, OFFSET @F
@@:

[roticv]

Code Select Expand


call @F
@@:
pop eax ;eax = address of next instruction - 1
;next instruction


[AeroASM]

Code Select Expand


call @F
@@:
pop eax
add eax, offset NextInstruction - offset @B
NextInstruction:


Petroizki's way is simplest, quickest and smallest though.

[Citric]

isnt there a register with the current instruction pointer?

Adam.

[Citric]

Should "mov [istrPointer], eip + 4" work?

Adam

[Petroizki]

You can't use eip register directly. You have to do some tricks to get it.

[AeroASM]

JUst thought of another idea:

Code Select Expand


int 3
jmp @F
dd 0
@@:


Then, make another app which debugs the first one and when it gets the int3, it uses GetThreadContext to get the eip, then stores it in the spare dd.

[MichaelW]

Should "mov [istrPointer], eip + 4" work?

The programmer does not have direct access to the instruction pointer, so EIP is not a valid symbol.

These should work:

mov [istrPointer], $ + 10
mov eax, $ + 5

Where the number at the end is the length of the assembled instruction in bytes.

[Mark Jones]

This may be a dumb question... but there's no EIP macro?

[Farabi]

GetEIP proc
pop eax
push eax

ret

GetEip endp

[BogdanOntanu]

Take care because this code:

Code Select Expand


mov eax, OFFSET @F
@@:


Is calculated at compile time not at runtime.

[MazeGen]

Mark, what do you mean by "EPI macro"?

Bogdan, the offset is not relocated at run-time?

[AeroASM]

EXEs generally do not have a relocation table, so they have to be loaded at the correct base otherwise they are screwed.

[Randall Hyde]

EXEs generally do not have a relocation table, so they have to be loaded at the correct base otherwise they are screwed.

Sure they do!  It's possible to strip the relocation entries (the .reloc section) from an EXE file, in which case what you claim would be true, but standard EXEs are certain relocatable.
Cheers,
Randy Hyde