Welcome to the dark corner of BIOS reverse engineering, code injection and various modification techniques only deemed by those immensely curious about BIOS

Sunday, August 12, 2012

Above and Below vs Greater and Less in x86/x64 Architecture

There are two different "families" of integer comparison in x86 assembly language. The first one revolves around the "above" and "below" moniker, and the other one revolves around the "greater" and "less" moniker. It's not very clear what the difference between both "families" of instruction until you take into account signed and unsigned integer comparison. The "above" and "below" family of integer comparison instructions deal with unsigned integer comparison. You could verify this by looking at Intel x86/x64 manual. In the manual, you would find that the "above" and "below" instruction family only check for carry flag (CF) but not the sign flag. Let's see a copy of the instructions explanation from Intel manual:
JA rel8  -- Jump short if above (CF=0 and ZF=0).
JAE rel8 -- Jump short if above or equal(CF=0).
JB rel8 -- Jump short if below (CF=1).
JBE rel8 -- Jump short if below or equal(CF=1 or ZF=1).
As you can see, there's no check for sign flag in the instructions above. Therefore, they are all unsigned comparison. Now, let's have a look to the other family, the "greater" and "less". Again, let's see a copy of the instructions explanation from Intel x86/x64 manual:
JG rel8 -- Jump short if greater (ZF=0 and SF=OF).
JGE rel8 -- Jump short if greater or equal (SF=OF).
JL rel8 -- Jump short if less (SF‚ OF).
JLE rel8 A -- Jump short if less or equal (ZF=1 or SF‚ OF).
As you can see, all of the "greater" and "less" comparison checks against the sign flag (SF). Therefore, they're all signed integer comparison. The difference between the two "families" of instruction could be easily overlooked by those new to x86/x64 assembly language. I hope this post clarify that.