In the x86 assembly language, the JMP instruction performs an unconditional jump. Such an instruction transfers the flow of execution by changing the instruction pointer register. There are a number of different opcodes that perform a jump; depending on whether the processor is in real mode or protected mode, and an override instruction is used, the instructions may take 16-bit, 32-bit, or segment:offset pointers.
There are many different forms of jumps: relative, conditional, absolute and register-indirect jumps.
JMP $ can be used to hang the computer. The $ is used to refer to the same location where the instruction starts. That means that the instruction will jump to itself and thereby creating an endless loop.
The following examples illustrate:
- a relative jump with a 16-bit pointer;
- a long jump (inter-segment), a relative jump with a 32-bit pointer;
- and a register-indirect absolute jump using the EAX register.
(Note that although the first and second jumps are relative, commonly the destination address is shown instead of the relative offset as encoded in the opcode.)
Example one: Load IP with the new value 0x89AB, then load CS with 0xACDC and IP with 0x5578.
Example two: Load IP with the value 0x56789AB1, only in protected mode or unreal mode.
Example three: Jump to the value stored in the EAX register, only in protected mode.
JMP EAX