# how to calculate this distance?

I dont know how to calculate the jump distances :

``````[Address | Binary value| ollydbg(jmp, call...)]

004014B6   \$- FF25 30114000 JMP DWORD PTR DS:[<&MSVBVM60.#100>]      ;  MSVBVM60.ThunRTMain
004014C1   .  E8 **F0FFFFFF**   CALL [JMP.&MSVBVM60.#100]
``````

other examples: random jmps to 004014C1

``````0040752A    ^\E9 **929FFFFF**   JMP stub2.004014C1
00407561    ^\E9 **5B9FFFFF**   JMP stub2.004014C1
00407582    ^\E9 **3A9FFFFF**   JMP stub2.004014C1
``````

as you can see the bold number changes, I can see its a distance but I don't know how to calculate it.

First, you should read about little endianness. In a nutshell, the x86/x64 processors store the least significant byte first, so `F0FFFFFF` is really the value `FFFFFFF0`, and `3A9FFFFF` is the value `FFFF9F3A`.

Second, read about integer representations of negative values, and how overflow works when adding/subtracting numbers. In short, `FFFFFFF0` can either mean `4294967280` or `-16`, but when you add hex numbers, you don't really care; you just add them and ignore overflow.

Third, remember that jump offsets are calculated from the byte after the `jmp`/`call` instruction.

So, in your first example:

• start with `4014B6`
• add 6 bytes for the instruction, result `4014BA`
• add the value `401130`, result `8025EA`

and the first of your random examples:

• start with `40752A`
• add 5 bytes for the instruction, result `40752F`
• add `FFFF9F92`, result `1004014C1`
• ignore overflow, result `004014C1` which is the target Olly shows you.

Your other examples work in the same way, you should be able to figure them out now.