Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  Unfamiliar Disassembly Code

Topic created on: April 16, 2011 03:19 CDT by brian .

I'm reversing a malware, and came across this:
cmp     [ebp+fdwReason], 0
jnz     short $+2

Where does '$+2' jmp to? What could have caused this?

  djnemo     April 18, 2011 11:21.03 CDT
i was seen same thing before i think the code will try to skip  s bytes from the next command

  PeterFerrie     April 18, 2011 12:26.03 CDT
Look at the opcodes, you'll see "75 00", which means that it's "branching" to the instruction following immediately.  Really, the branch does nothing.  It suggests that there was supposed to be code to handle the condition when the reason wasn't the expected one, but it is not there (anymore).

  cseagle     April 18, 2011 23:30.52 CDT
In assembler syntax, $ is shorthand for "the current instruction/location, much like . refers to the current directory when navigating a file system. $+2 means 2 bytes beyond the current instruction.  If you look at the length of the current instruction (jnz short $+2) you will see that it is 2 bytes long so the jnz is targeting the very next instruction as Peter says above.

Note: Registration is required to post to the forums.

Active in Last 5 Minutes
st1

There are 30,635 total registered users.


Recently Created Topics
Keep you Slim Easily
Apr/19
Your Best Slim &...
Apr/19
Amazing Your Lucky Skin
Apr/18
Your Skin Very Soft...
Apr/17
Question about debbu...
Apr/16
IDA PRO Struct Point...
Apr/15
problems with pseudo...
Apr/04
Problem with ollydbg
Mar/22
Should binaries be n...
Mar/22
Ida pro on infineon ...
Mar/10


Recent Forum Posts
Should binaries be n...
Kolisar
Problem with ollydbg
nullx42
!findtrampoline Immu...
skycrack
looking for a softwa...
raxen
Documenting reversed...
raxen
.orpc section what's...
mbin
Pydbg load() issue
phreak
Pydbg load() issue
netw0rm
How would you interp...
mbin
Pydbg load() issue
phreak


Recent Blog Entries
loisjoneis
Apr/19
Detox Max Review - amazing ...

martanhawkings
Apr/19
iPhone 4S- Purchase Apple’s...

elenablacik
Apr/18
Cleanse Pure Premium Supple...

hermesfrsac
Apr/17
Il convient que vous devrie...

oleavr
Apr/17
frida.re 1.2.0 is out, with...

More ...


Recent Blog Comments
pedram on:
Dec/21
frida.github.io: scriptable...

cin100dy on:
Dec/16
Devil May Cry Cosplay Costu...

NeOXQuiCk on:
Nov/26
DONGLE

maharlee on:
Nov/21
Cheap Nike Shoes NZ,Nike Sh...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit