Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  Unfamiliar Disassembly Code

Topic created on: April 16, 2011 03:19 CDT by brian .

I'm reversing a malware, and came across this:
cmp     [ebp+fdwReason], 0
jnz     short $+2

Where does '$+2' jmp to? What could have caused this?

  djnemo     April 18, 2011 11:21.03 CDT
i was seen same thing before i think the code will try to skip  s bytes from the next command

  PeterFerrie     April 18, 2011 12:26.03 CDT
Look at the opcodes, you'll see "75 00", which means that it's "branching" to the instruction following immediately.  Really, the branch does nothing.  It suggests that there was supposed to be code to handle the condition when the reason wasn't the expected one, but it is not there (anymore).

  cseagle     April 18, 2011 23:30.52 CDT
In assembler syntax, $ is shorthand for "the current instruction/location, much like . refers to the current directory when navigating a file system. $+2 means 2 bytes beyond the current instruction.  If you look at the length of the current instruction (jnz short $+2) you will see that it is 2 bytes long so the jnz is targeting the very next instruction as Peter says above.

Note: Registration is required to post to the forums.

There are 29,884 total registered users.


Recently Created Topics
Decompiling raw bina...
May/22
Incorrect bitness wh...
May/20
PaiMei stalker modul...
May/19
Attach to program us...
May/13
IDA PRO how to make ...
May/12
FACT: OpenRCE is dead.
May/08
Int 3 anti debug?
May/05
help needed - Beginn...
May/03
Attaching IDA Pro to...
Apr/27
File type
Apr/21


Recent Forum Posts
Ollydbg 2.0 - Plugin...
openrce...
IDA PRO how to make ...
codeinject
FACT: OpenRCE is dead.
codeinject
IDA Resource Viewer ...
r2x64
FACT: OpenRCE is dead.
djnemo
FACT: OpenRCE is dead.
codeinject
FACT: OpenRCE is dead.
pedram
help needed - Beginn...
araujo
Attaching IDA Pro to...
codeinject
Int 3 anti debug?
codeinject


Recent Blog Entries
lowpriority
Apr/13
OllyMigrate Plugin for Olly...

everdox
Mar/08
2 anti-trace mechanisms spe...

everdox
Mar/07
Advanced debugging techniques

everdox
Mar/06
Branch tracing and LBR acce...

everdox
Mar/05
Using pre-paged in virtual ...

More ...


Recent Blog Comments
clarisonic on:
Apr/03
New version of Ollydbg!

clarisonic on:
Apr/03
New version of Ollydbg!

trackerx90 on:
Mar/04
SuppressDebugMsg As Anti-De...

coachfactory on:
Feb/25
Portable Executable Format ...

coachfactory on:
Feb/25
A new Anti-Olly trick.

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit