Last modified: Tue Jun 30 10:44:40 UTC+0200 2026 © A. Tarpai
Intel conditional JUMP and understanding condition codes for CMP
8086 Jcc
Intel 8086 had 16 opcodes for short, conditional jumps:
- 2 x 5 to test individual flags: OF overflow, SF sign, ZF zero, PF parity, CF carry
- 2 x 4 opcodes following CMP for signed/unsigned comparison
I know, that's 18. But 2 overlaps.
8086 Conditional JMP opcodes:
OPCODE TTTN disp MNEMONIC TESTS USED FOR
70: 0111 0000 REL8 JO OF Overflow Flag
71: 0111 0001 REL8 JNO OF Overflow Flag
72: 0111 0010 REL8 JC/JB/JNAE CF Carry Flag/Unsigned CMP
73: 0111 0011 REL8 JNC/JAE/JNB CF Carry Flag/Unsigned CMP
74: 0111 0100 REL8 JZ/JE ZF Zero Flag
75: 0111 0101 REL8 JNZ/JNE ZF Zero Flag
76: 0111 0110 REL8 JBE/JNA CF ZF Unsigned CMP
77: 0111 0111 REL8 JA/JNBE CF ZF Unsigned CMP
78: 0111 1000 REL8 JS SF Sign Flag
79: 0111 1001 REL8 JNS SF Sign Flag
7A: 0111 1010 REL8 JP PF Parity Flag
7B: 0111 1011 REL8 JNP PF Parity Flag
7C: 0111 1100 REL8 JL/JNGE SF OF Signed CMP
70: 0111 1101 REL8 JGE/JNL SF OF Signed CMP
7E: 0111 1110 REL8 JLE/JNG SF OF ZF Signed CMP
7F: 0111 1111 REL8 JG/JNLE SF OF ZF Signed CMP
TTT: test condition code
N: negated condition
TTT TESTS:
0: 000 OF Overflow Flag
1: 001 CF Carry Flag
2: 010 ZF Zero Flag
3: 011 CF ZF Unsigned CMP
4: 100 SF Sign Flag
5: 101 PF Parity Flag
6: 110 SF OF Signed CMP
7: 111 SF OF ZF Signed CMP
Signed 8-bit relative displacement following the opcode added to IP when condition is true. IP wraps around.
FLAG test and Jcc
These are simple tests: the flag is either set or not. Used after TEST and other instructions.
15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
+----+----+----+----+----+----+----+----+ +----+----+----+----+----+----+----+----+
| | | | | OF | DF | IF | TF | | SF | ZF | | AF | | PF | | CF | FLAGS
+----+----+----+----+----+----+----+----+ +----+----+----+----+----+----+----+----+
| | | | |
JO/JNO JS/JNS JZ/JNZ JP/JNP JC/JNC
SIGNED/UNSIGNED CMP followed by Jcc
See CMP.
386 Jcc encoding and operation
386 added 0F-prefixed, almost same opcodes (0F 8x instead of 7x), that can jump 32/16-bit signed relative based on operand-size.
The mechanism of changing EIP is the same as for the unconditional JMP: the upper bits of EIP is zeroed after the addition, when operand-size = 16(!):
operand-size = 16 operand-size = 32
D=0 or D=1 and 66h D=1 or D=0 and 66h
+-------------------+ +-------------------+
| DWORD | EIP | DWORD | EIP
+-------------------+ +-------------------+
+--------------+----+ +--------------+----+
+ |ssssssssssss<-|s | REL8 |ssssssssssss<-|s | REL8
+--------------+----+ +--------------+----+
+---------+---------+ +-------------------+
+ |sssssss<-|s | REL16 |s | REL32 <-- 0F Jcc
+---------+---------+ +-------------------+
| |
v v
+---------+---------+ +-------------------+
|000000000| | EIP | | EIP
+---------+---------+ +-------------------+
REL16 also wraps-around 64K.