Consider the following code, compiled on a 32-bit Ubuntu 14.04.2
with gcc 4.8.2
#include
int main(){
_exit(0)
Actually, those last 4 bytes are not the target address. The instruction ff 25 0c a0 04 08
is an instance of jmp rm32
(jump absolute indirect), the last 4 bytes are actually the address from which the jump target will be read.
The ModRM byte 25h, as you can see in this table, has a /digit part of 4 (that makes it a jmp rm32
, other instructions that have opcode byte ff
are inc rm32
, dec rm32
, call rm32
, call m16:32
, jmp m16:m32
, push rm32
, all distinguished by the ModRM byte). The rest of the ModRM byte 25h means that the operand is a memory address of the form [sdword]
.