title: How encode a relative short jmp in x86
body: <p>Suppose I want to do a short jump using the following opcodes:</p>
  
  <blockquote>
    <p><strong>EB</strong> <em>CB</em>  or  <em>JMP rel8</em></p>
    
    <p>"Jump short, RIP = RIP + 8-bit displacement sign
    extended to 64-bits"</p>
    
    <p>(where CB is a byte <strong>signed value</strong> representing the relative offset relating to direction in <strong>EIP</strong> register)</p>
  </blockquote>
  
  <p>Maybe always the offset will be <em>offset+2</em> because the EIP in execution time (the reference direction) in this short jump is the base of the twobyte instruction, but the addend <a href="http://onlinedisassembler.com/odaweb/run_hex">occurs always</a> </p>
  
  <blockquote>
    <p>eb 30 = jmp 0x00000032 (+30)</p>
    
    <p>eb e2 = jmp 0xffffffe4 (-30)</p>
    
    <p>then EIP can be intentionally the same direction because fe + 2 is <strong>00</strong> or <strong>EIP</strong>. </p>
    
    <p>eb fe = jmp 0x00000000</p>
  </blockquote>
  
  <p>I find it surprising that the <em>overoffset</em> ocurred bifurcated although the number is negative. But in the Intel I find no mention (maybe because 3000 pages).</p>
  
  <blockquote>
    <p><strong>Intel® 64 and IA-32 Architectures
    Software Developer’s Manual: Vol. 2A 3-423</strong></p>
    
    <blockquote>
      <p>A near jump where the jump range is limited to –128 to +127 <strong>from the current</strong> EIP value.</p>
    </blockquote>
  </blockquote>
  
  <p>Then I contemplate three possibilities:</p>
  
  <ol>
  <li>is +2 because is the <em>after/future value</em> of EIP in execution time</li>
  <li>The coded value is not a 2s component encoded signed number.</li>
  <li>this appears in the manual but I have not seen because i'm stupid</li>
  </ol>