Why can't you set the instruction pointer directly?

x86 cpu-registers program-counter
user142019 picture user142019 · Nov 30, 2011 · Viewed 18.1k times · Source

The Wikipedia article about x86 assembly says that "the IP register cannot be accessed by the programmer directly."

Directly means with instructions like mov and add.

Why not? What is the reason behind this? What are the technical restrictions?

Answer

Polynomial picture Polynomial · Nov 30, 2011

You can't access it directly because there's no legitimate use case. Having any arbitrary instruction change eip would make branch prediction very difficult, and would probably open up a whole host of security issues.

You can edit eip using jmp, call or ret. You just can't directly read from or write to eip using normal operations

Setting eip to a register is as simple as jmp eax. You can also do push eax; ret, which pushes the value of eax to the stack and then returns (i.e. pops and jumps). The third option is call eax which does a call to the address in eax.

Reading can be done like this:

call get_eip
  get_eip:
pop eax ; eax now contains the address of this instruction

Related questions

How do AX, AH, AL map onto EAX?

My understanding of x86 registers say that each register can be accessed by the entire 32 bit code and it is broken into multiple accessible registers. In this example EAX being a 32 bit register, if we call AX it should return …

Read More
What is between ESP and EBP?

Right, I'm sure this is implicitly answered many times, but I seem not to be able to quite get to it. If you have a (x86) stack trace (say, looking at it in WinDbg), and you look at the registers, …

Read More
What is the "FS"/"GS" register intended for?

So I know what the following registers and their uses are supposed to be: CS = Code Segment (used for IP) DS = Data Segment (used for MOV) ES = Destination Segment (used for MOVS, etc.) SS = Stack Segment (used for SP) But …

Read More