2

Consider x86 16 bit mode instruction:

$ echo 66 EA 66 55 44 33 22 11 | xxd -p -r | ndisasm -b16 -
00000000  66EA665544332211  jmp dword 0x1122:0x33445566

I thought 16 bit code jumps work by combining two 16 bit parts, while 32 bit code just uses 32 bit offset without segment part. What's the meaning of having both segment offset and 32 bit offset?

Improve this question

1 Answer 1

Reset to default
2

It's a far/long jump, which sets loads the code segment descriptor using the selector specified.

A jmp to a code segment selector which is the same as the existing CS value reloads the descriptor.

See the Intel Software Developer's Manual Section 7.3.15.2 "Far Control Transfer Instructions" and the description of the JMP instruction:

In protected mode, the JMP instruction also allows jumps to a call gate, a task gate, and a task-state segment.

The JMP and CALL instructions (see Section 7.3.8, “Control Transfer Instructions”) both accept a far pointer as a destination to transfer program control to a segment other than the segment currently being pointed to by the CS register.

Far Jumps in Protected Mode. When the processor is operating in protected mode, the JMP instruction can be used to perform the following three types of far jumps:

• A far jump to a conforming or non-conforming code segment.

• A far jump through a call gate.

• A task switch.

Improve this answer
3
  • What do numbers 1122 and 33445566 mean here, how exactly are they combined to determine jump target?
    – Uprooted
    Commented May 28, 2023 at 22:34
  • 1
    @Uprooted 0x1122 there is the selector which is an offset (multiple of 8, the descriptor size in bytes) into the GPT (en.wikipedia.org/wiki/Global_Descriptor_Table). 0x1122 would be invalid because it is not a multiple of 8. The segment descriptor (en.wikipedia.org/wiki/Segment_descriptor) is loaded, which can change the privilege level, base address, and default operation size of the new code. 0x33445566 is an offset from the base address specified in the segment descriptor, which may be different to the physical address if paging is also used.
    – matja
    Commented May 28, 2023 at 23:42
  • 1
    @matja There's nothing here to suggest that it's running in protected mode at the time. It is a perfectly valid unreal-mode address.
    – peter ferrie
    Commented Jun 4, 2023 at 2:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.