Given I have x86 assembly code disassembled into a list of structures that fully describe it (opcode, regs, imm, etc.), how can I programmatically turn absolute jumps to relative jumps?
Basically what I try to achieve is that I can insert or delete bytes between jump and destination and afterwards fix the jump simply by adding the delta to it.
6
Lets start out by making a distinction between assembly and machine code. These are often seen as something very similar, and they are, but there’s a step between the assembly language and the machine language – that of the assembler.
People don’t work in machine code anymore (they did long ago) its too much of a pain. Working with an assembler gives you the ability to use labels and in some cases, higher level opcodes. The assembler can then translate the labels and higher level opcodes into machine code.
When you disassemble a binary, you are getting the translation of the machine code back into assembly. But not all of the information for assembly is there. In particular, the labels are not there. Without the labels, you have jump and read addresses that are fixed. That was what the assembler did converting the initial assembly into machine code.
If you want to get the labels back, you need to add them. Go through and label every address that is used as a jump or branching target. Then convert every use of that address to its label and go forward from there. Remember that you need to add all of the labels and do this because you will be shifting thing around. Adding an instruction or two near the top will push everything after it to a new address.
4