80x86 assembly question

Question

I have this code :

section .data
Foos:
  mov ecx,7
  mov edx,5
L:
  inc edx
  sub ecx,1
  setZ al ; set al to 1 if zero flag, otherwise al=0
  shl al,1
  mov byte[L1+1],al
L1:
  jmp L
  lmp L
  mov eax,edx
  ret

The question is what will be in eax at the end of the code? I don't know why the answer is 12?

Answer 1

This looks like self-modifying code.

It loops 7 times and when ecx reaches zero, it replaces the jmp L statement with a different JMP instruction which jumps to the statement after the second JMP.

Foos:
  mov ecx,7
  mov edx,5
L:
  inc edx
  sub ecx,1
  setZ al ; set al to 1 if zero flag, otherwise al=0
  shl al,1   ; multiply by 2, so al=2 when ecx reaches zero
  mov byte[L1+1],al
L1:
  jmp L
  jmp L
  mov eax,edx
  ret

The magic is in the mov byte[L1+1]. When al=0, it replaces the first JMP with a JMP to the next statement, which is again JMP L, so it loops. When al=2, it replaces the first JMP to skip 2 bytes, so it skips the second jump, so the loop ends. At the end edx is 12 (5 + 7)

Why is that?

The JMP instructions used here are short jumps. They are coded as 2 bytes: EB followed by a single byte representing the relative number of bytes to jump. The mov instruction replaces the second byte by either 0 (jump to next instruction) or 2 (jump 2 bytes ahead).

Answer 2

This code is self modifying and missing a memory fence instructions. What happens depends on the processor stepping and how full the instruction cache is at the point when the code is executed which can change if this section of code is preempted by an ISR, a page fault occurs, or any number of other things.