title: JMP rel16 (instead of JMP rel32)
body: <p>I need to make a jump opcode for an exploit demonstration. </p>
  
  <p>I need to jump to about 200 bytes after the jump instruction. This is too much for a <code>jmp short</code>.</p>
  
  <p>If I generate an opcode with a regular jump, <code>jmp $200</code> I get this:</p>
  
  <pre><code>e9 fb 01 00 00
  </code></pre>
  
  <p>The problem here is that opcode contains 00 which is interpreted as an end of string when passing the string to the program (as such I can't pass the full shellcode with this in it).</p>
  
  <p>I thought my approach was screwed but then <a href="http://microsym.com/editor/assets/386intel.pdf" rel="nofollow">I checked the manual</a> and on the second line there is apparently a "near jump" that takes 2 bytes (there's also the other one that takes 4 bytes, the one I showed above). Both these jumps start with the same byte, <code>e9</code>.</p>
  
  <p>How can I pass <code>e9 fb 01</code> as the near jump that takes only two bytes arguments? How do I prevent the OS from looking for four bytes after the <code>e9</code>, ie: <code>e9 fb 01 90 90</code>?</p>