I always thought that the full offset (directly in the code) is set in the same way as the short shift (8-bit) - as a signed number. But recently I came across such an article: http://altcode.ru/assembler/ssm/asm26.php A small excerpt:

Considering the calculation of the address of the transition point, you should keep in mind the phenomenon of wrapping, the essence of which can be briefly expressed by the following relations:

FFFFh + 0001h = 0000h

0000h-0001h = FFFFh

If you consistently increase the contents of any register or memory cell, then, having reached the upper possible limit FFFFh, the number will “cross” this border, will become zero and continue to increase in the region of small positive numbers (1, 2, 3, etc. .) <...> Thus, when calculating the address of the transition point, the offset should be considered an unsigned number, but take into account the wrapping phenomenon

An article about 16-bit processors. After I read it, I wondered about the offsets in 32-bit mode, looked through the documentation from Intel and AMD, Google, but could not find a direct answer. I decided to check in practice, I looked in the disassembler as jmp near is encoded when going backwards, with EIP = 4250F0 and the label at 424FF0 (label offset: -256) it turned out:

E9 00FFFFFF

By rearranging the bytes in the correct order, we get FFFFFF00, i.e. just -256. It turns out that the offset is given as a signed number ...

My questions are:

1) Are the 32-bit offsets (directly specified in the code) always specified as a signed number? Or is there still a case when without a sign?

2) Is the author of the article right that in the 16-bit mode, the offsets are set as unsigned, or is it some kind of nonsense?

3) Where can you read about it? In the documentation ("Intel 64 and IA-32 Architectures Software Developer's Manual" and "AMD64 Architecture Programmer's Manual") I cannot find anything on this topic, only the size (1,2,4 bytes) is indicated everywhere.

    1 answer 1

    I still found a description of the directly specified offsets. The answers are:

    1) JMP NEAR - uses a relative (relative to the EIP value) offset, which is represented as a signed number.

    JMP FAR - Uses the absolute offset, which is represented as an unsigned number.

    2) In the article nonsense (in part), the absolute offset is a specific address, there is no “wrapping phenomenon” there.

    3) As it turned out, this is not described in the "Instruction format" section (where I was looking for), but in the description of the JMP instruction itself.