debugging - How does test and je/jne work -
okay started working little assembly. began following instructions:
test al, al jne 0x1000bffcc using debugger, wanted code not jump address 0x1000bffcc set breakpoint on jne instruction , inverted al register using following lldb command:
expr $al = 1 this worked continued until stumbled across following, similar instruction pair:
test al, al je 0x1000bffcc while looks similar, inverting al register doesn't seem have affect. keeps on jumping address 0x1000bffcc. did research , figured out test runs logical and al , sets 0 flag or zf accordingly. leads 2 questions:
- why did invert
alregister in first example? - why not work in second example?
- how can use debugger make code not jump in second example?
thanks lot help!
test al, al jne 0x1000bffcc the test instruction performs logical and of 2 operands , sets the cpu flags register according result (which not stored anywhere). if al zero, anded result 0 , sets z flag. if al nonzero, clears z flag. (other flags, such carry, overflow, sign, parity, etc. affected too, code has no instruction testing them.)
the jne instruction alters eip if z flag not set. there mnemonic same operation called jnz.
if let test instruction execute , changed al before conditional jump instruction, conditional jump still going whatever going before altering al. because value of al no longer affects conditional jump. if change value before test, work expected.
as why changing has effect: must because revised value of al affecting other logic.
to use debugger make instruction not jump, change flags such z flag set. might called zf, or might have modify bit in eflags register. how varies debugger , possibly revision.
Comments
Post a Comment