Specifying the Size of a JMP Instruction in WinDBG

WINDBG
1

Hi all,
I thought windbg is easy to get a JMP rel8 instruction’s machine code,however, after many times experiments and tries, I still unexpectedly get a JMP rel32 instruction’s machine code instead,as follows,
0:000> a

7734e6e6 jmp 10 <==hope to get a JMP rel8 instruction’s machine code

jmp 10

7734e6eb

0:000> u 7734e6e6

ntdll!..:

7734e6e6 e92519cb88 jmp 00000010 <==unexpectedly get a JMP rel32 instruction’s machine code

Could someone know how to specify the size of a JMP Instruction(e.g. JMP BYTE ) ?
Thanks.

-Matt

2

JMP-instruction contains relative offset. Therefore, WinDbg has created a five-byte command (offset from 7734e6e6 to 10 is 4 byte + opcode). For your example, try:

7734e6e6 jmp 7734e6e6+10

The result should be create instructions eb0e

3

0:001> u 7c80236b
kernel32!CreateProcessA:
7c80236b 8bff mov edi,edi
7c80236d 55 push ebp
7c80236e 8bec mov ebp,esp
7c802370 6a00 push 0
7c802372 ff752c push dword ptr [ebp+2Ch]
7c802375 ff7528 push dword ptr [ebp+28h]
7c802378 ff7524 push dword ptr [ebp+24h]
7c80237b ff7520 push dword ptr [ebp+20h]

0:001> eb 7c80236b eb 10

0:001> u 7c80236b
kernel32!CreateProcessA:
7c80236b eb10 jmp kernel32!CreateProcessA+0x12 (7c80237d)
7c80236d 55 push ebp
7c80236e 8bec mov ebp,esp
7c802370 6a00 push 0
7c802372 ff752c push dword ptr [ebp+2Ch]
7c802375 ff7528 push dword ptr [ebp+28h]
7c802378 ff7524 push dword ptr [ebp+24h]
7c80237b ff7520 push dword ptr [ebp+20h]