x86 jnz after xor?

纵饮孤独 提交于 2021-02-04 17:43:59

问题


After using IDA Pro to disassemble a x86 dll, I found this code (Comments added by me in pusedo-c code. I hope they're correct):

test    ebx, ebx        ; if (ebx == false)
jz      short loc_6385A34B ; Jump to 0x6385a34b
mov     eax, [ebx+84h]  ; eax = *(ebx+0x84)
mov     ecx, [esi+84h]  ; ecx = *(esi+0x84)
mov     al, [eax+30h]   ; al = *(*(ebx+0x84)+0x30)
xor     al, [ecx+30h]   ; al = al XOR *(*(esi+0x84)+0x30)
jnz     loc_6385A453

Lets make it simpler for me to understand:

mov     eax, b3h
xor     eax, d6h
jnz     ...

How does the conditional jump instruction work after a xor instruction?


回答1:


Like most instructions, xor sets the processor condition flags depending on the result of the previous operation. In this case, the Z flag will be set if the result of the xor is zero. The jnz instruction tests the Z flag and branches if it is not set.




回答2:


I barely know assembly at all but xor in this context does pretty much the same as cmp I’d say, in addition to setting eax to the result of the xor operation.

In other words, after the xor, eax will be 0 exactly if its previous value was d6h (otherwise, it will be some value != 0). And additionally, the zero flag will be set (as with cmp) so you can jnz to test that flag.




回答3:


It will jump if the value in eax doesn't end up as zero.

Your second example doesn't do the code justice since the code you have is using constant values, not values loaded from memory.

In the first example, it loads all those values from memory and performs the xor on that. The memory contents may, unlike your second example, change on each execution depending on what's in [ebx+84h] and [esi+84h].

See xor and jnz for details.




回答4:


Arithmetic operations like xor set comparison flags (just like a compare instruction).




回答5:


Well, JNZ is a conditional jump, specifically, jump if not zero.

the XOR (and many other arithmetic/logic operations) will set the zero flag of the status register if the result of the operation is zero. So in your case, it's saying "do XOR, and if the result is not zero (i.e. if the two numbers are different) jump to this location.



来源:https://stackoverflow.com/questions/2984025/x86-jnz-after-xor

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!