Instruction Set Notes

Addressing Modes

• Registers:

  • EBX = 00000300H

  • ESI = 00000200H

  • ARRAY = 1000H

  • DS = 1000H

• Addressing Mode Types:

  • Register:

    • Instruction: MOV AX, BX

    • Source: Register BX

    • Destination: Register AX

  • Immediate:

    • Instruction: MOV CH, 3AH

    • Source: Immediate data 3AH

    • Destination: Register CH

  • Direct:

    • Instruction: MOV [1234H], AX

    • Source: Register AX

    • Destination: Memory at DS * 10H + DISP = 10000H + 1234H = 11234H

  • Register Indirect:

    • Instruction: MOV [BX], CL

    • Source: Register CL

    • Destination: Memory at DS * 10H + BX = 10000H + 0300H = 10300H

  • Base-plus-index:

    • Instruction: MOV [BX+SI], BP

    • Source: Register SP

    • Destination: Memory at DS * 10H + BX + SI = 10000H + 0300H + 0200H = 10500H

  • Register relative:

    • Instruction: MOV CL,[BX+4]

    • Source: Memory address DS * 10H + BX + 4 = 10000H + 0300H + 4 = 10304H

    • Destination: Register CL

  • Base relative-plus-index:

    • Instruction: MOV ARRAY[BX+SI], DX

    • Source: Register DX

    • Destination: Memory at DS * 10H + ARRAY + BX + SI = 10000H + 1000H + 0300H + 0200H = 11500H

  • Scaled index:

    • Instruction: MOV [EBX+2*ESI], AX

    • Source: Register AX

    • Destination: Memory at DS * 10H + EBX + 2 * ESI = 10000H + 00000300H + 2 * 00000200H = 10000H + 0300H + 0400H = 10700H

Data Movement Instructions

• Provide methods for moving bytes, words, or doublewords between memory and processor registers.

• Come in three types:

  1. General-purpose data movement instructions.

  2. Stack manipulation instructions.

  3. Type-conversion instructions.

General-Purpose Data Movement Instructions

• MOV (Move): Transfers a byte, word, or doubleword from the source operand to the destination operand.

  • Useful for transferring data along these paths:

    • To a register from memory

    • To memory from a register

    • Between general registers

    • Immediate data to a register

    • Immediate data to memory

  • Cannot move from memory to memory or from a segment register to a segment register.

  • Operation: DEST <-- SRC

  • Flags Affected: None

• XCHG (Exchange): Swaps the contents of two operands.

  • Does not require a temporary location to save the contents of one operand while the other is being loaded.

  • Exchanges Register/Memory with Register

  • Flags Affected: None

Stack Manipulation Instructions

• PUSH (Push):

  • Decrements the stack pointer (ESP register), then copies the source operand to the top of the stack.

  • Often used to place parameters on the stack before calling a procedure.

  • Operates on memory operands, immediate operands, and register operands.

• PUSHA (Push All Registers):

  • Saves the contents of the eight general registers on the stack .

    • The processor pushes the general registers on the stack in the following order: EAX, ECX, EDX, EBX, the initial value of ESP before EAX was pushed, EBP, ESI, and EDI.

  • The effect of the PUSHA instruction is reversed using the POPA instruction.

• POP (Pop):

  • Transfers the word or doubleword at the current top of the stack (indicated by the ESP register) to the destination operand, and then increments the ESP register to point to the new top of the stack.

    • Moves information from the stack to a general register, segment register, or to memory.

  • Example:

    • POP CX ; Load the last value stored at stack into CX which is BX ; increment SP by 2 i.e., SP=SP+2

    • POP [12H] ; Load the value from location of SP to memory address DS:0012H ; increment SP by 2

Type Conversion Instructions

• Convert bytes into words, words into doublewords, and words and doublewords into 64-bit quantities (quadwords).

• Two types:

  1. The CWD, CDQ, CBW, and CWDE instructions which only operate on data in the EAX register.

  2. The MOVSX and MOVZX instructions, which permit one operand to be in a general register while letting the other operand be in memory or a register.

• Useful for converting signed integers, because they automatically fill the extra bits of the larger item with the value of the sign bit of the smaller item.

  • Results in an integer of the same sign and magnitude, but a larger format.

• CBW (Convert Byte to Word): Copies the sign (bit 7) of the byte in the AL register into every bit position in the AX register.

• CWD (Convert Word to Doubleword): Converts the signed word in AX to a signed doubleword in DX:AX by extending the most significant bit of AX into all the bits of DX.

• CWDE (Convert Word to Doubleword Extended): Copies the sign (bit 15) of the word in the AX register into every bit position in the EAX register. Note that CWD is different from CWDE. CWDE uses EAX as a destination, instead of DX:AX.

• CDQ (Convert Doubleword to Quad-Word): Converts the signed doubleword in EAX to a signed 64-bit integer in the register pair EDX:EAX by extending the most significant bit of EAX (the sign bit) into all the bits of EDX.

• MOVSX (Move with Sign Extension): A generalized form of CBW, CWD, CWDE, CDQ. Extends an 8-bit value to a 16-bit value or to 32-bit value an 16-bit value to a 32-bit value by using the value of the sign to fill empty positions.

  • movsx reg16, mem8

  • movsx reg16, reg8

  • movsx reg32, mem8

  • movsx reg32, reg8

  • movsx reg32, mem16

  • movsx reg32, reg16

• MOVZX (Move with Zero Extension): Extends an 8-bit value to a 16-bit value or an 8- or 16-bit value to 32-bit value by clearing the empty bit positions.

Binary Arithmetic Instructions

Addition and Subtraction

• ADD (Add): Performs an integer addition of the two operands (DEST and SRC).

  • The result of the addition is assigned to the first operand (DEST), and the flags are set accordingly.

  • When an immediate byte is added to a word or doubleword operand, the immediate value is sign-extended to the size of the word or doubleword operand.

  • No memory to memory additions; memory operands must be loaded into registers.

  • Operation: DEST = DEST + SRC

  • Flags Affected: OF, SF, ZF, AF, CF, and PF

• ADC (Add Integers with Carry): Replaces the destination operand with the sum of the source and destination operands, plus 1 if the CF flag is set.

  • If the CF flag is clear, the ADC instruction performs the same operation as the ADD instruction.

  • Useful when using 32-bit ADD instructions to sum quadword operands.

  • Flags Affected: OF, SF, ZF, AF, PF, and CF

• INC (Increment): Adds 1 to the destination operand.

  • Preserves the state of the CF flag.

    • Allows the use of INC instructions to update counters in loops without disturbing the status flags resulting from an arithmetic operation used for loop control.

  • Flags Affected: OF, SF, ZF, AF, and PF

  • INC Reg/Memory location

• SUB (Subtract): Subtracts the second operand (SRC) from the first operand (DEST).

  • The first operand is assigned the result of the subtraction, and the flags are set accordingly.

  • When an immediate byte value is subtracted from a word operand, the immediate value is first sign-extended to the size of the destination operand.

  • Flags Affected: OF, SF, ZF, AF, PF, and CF

• SBB (Subtract Integers with Borrow): Subtracts the source operand from the destination operand and replaces the destination operand with the result, minus 1 if the CF flag is set.

  • If the CF flag is clear, the SBB instruction performs the same operation as the SUB instruction.

  • Flags Affected: OF, SF, ZF, AF, PF, and CF

• DEC (Decrement): Subtracts 1 from the destination operand.

  • Preserves the state of the CF flag.

  • Allows the use of the DEC instruction to update counters in loops without disturbing the status flags resulting from an arithmetic operation used for loop control.

  • Flags Affected: OF, SF, ZF, AF, and PF

Comparison and Sign Change Instructions

• CMP (Compare): Subtracts the source operand from the destination operand.

  • Updates the OF, SF, ZF, AF, PF, and CF flags, but does not modify the source or destination operands.

• NEG (Negate): Subtracts a signed integer operand from zero.

  • The effect of the NEG instruction is to change the sign of a two's complement operand while keeping its magnitude.

  • Flags Affected: OF, SF, ZF, AF, PF, and CF

Multiplication Instructions

• MUL (Unsigned Multiplication of AL or AX):

  • Performs unsigned multiplication of the source operand and the AL, AX, or EAX register.

    • If a source operand is byte it is multiplied by the value in AL; the result is left in the AX register ( AH and AL registers).

    • If the source operand is a word, the processor multiplies it by the value held in the AX register and returns the double-length result in the DX and AX registers.

    • If the source operand is a doubleword, the processor multiplies it by the value held in the EAX register and returns the quadword result in the EDX and EAX registers.

  • The MUL instruction sets the CF and OF flags when the upper half of the result is non-zero; otherwise, the flags are cleared.

    • The state of the SF, ZF, AF, and PF flags is undefined.

• IMUL (Signed Integer Multiply): Performs a signed multiplication operation.

  1. A one-operand form. The operand may be a byte, word, or doubleword located in memory or in a general register.

     • This instruction uses the EAX and EDX registers as implicit operands in the same way as the MUL instruction.

  2. A two-operand form. One of the source operands is in a general register while the other may be in a general register or memory.

     • The result replaces the general register operand.

  3. A three-operand form; two are source operands and one is the destination. One of the source operands is an immediate value supplied by the instruction; the second may be in memory or in a general register.

     • The result is stored in a general register.

Division Instructions

• DIV (Unsigned Integer Divide): Performs an unsigned division of the AL, AX, or EAX register by the source operand.

  • The dividend (the accumulator) is twice the size of the divisor (the source operand); the quotient and remainder have the same size as the divisor

  • Flags Affected: The OF, SF, ZF, AF, PF, CF flags are undefined.

• IDIV (Signed Integer Divide): Performs a signed division of the accumulator by the source operand.

  • The IDIV instruction uses the same registers as the DIV instruction.

Decimal Arithmetic Instructions

• Decimal arithmetic is performed by combining the binary arithmetic instructions with the decimal arithmetic instructions.

• The decimal arithmetic instructions are used in one of the following ways:

  • To adjust the results of a previous binary arithmetic operation to produce a valid packed or unpacked decimal result.

  • To adjust the inputs to a subsequent binary arithmetic operation so that the operation will produce a valid packed or unpacked decimal result.

  • These instructions operate only on the AL or AH registers. Most use the AF flag.

Packed BCD Adjustment Instructions

• DAA (Decimal Adjust after Addition): Adjusts the result of adding two valid packed decimal operands in the AL register.

  • A DAA instruction must follow the addition of two pairs of packed decimal numbers (one digit in each half-byte) to obtain a pair of valid packed decimal digits as results.

  • The CF flag is set if a carry occurs.

  • The SF, ZF, AF, PF, and CF flags are affected. The state of the OF flag is undefined.

• DAS (Decimal Adjust after Subtraction): Adjusts the result of subtracting two valid packed decimal operands in the AL register.

  • A DAS instruction must always follow the subtraction of one pair of packed decimal numbers (one digit in each half-byte) from another to obtain a pair of valid packed decimal digits as results.

  • The CF flag is set if a borrow is needed.

  • The SF, ZF, AF, PF, and CF flags are affected. The state of the OF flag is undefined.

Unpacked BCD Adjustment Instructions

• AAA (ASCII Adjust after Addition): Changes the contents of the AL register to a valid unpacked decimal number, and clears the upper 4 bits.

  • An AAA instruction must follow the addition of two unpacked decimal operands in the AL register.

  • The CF flag is set and the contents of the AH register are incremented if a carry occurs.

  • The AF and CF flags are affected. The state of the OF, SF, ZF, and PF flags is undefined.

• AAS (ASCII Adjust after Subtraction): Changes the contents of the AL register to a valid unpacked decimal number, and clears the upper 4 bits.

  • An AAS instruction must follow the subtraction of one unpacked decimal operand from another in the AL register.

  • The CF flag is set and the contents of the AH register are decremented if a borrow is needed.

  • The AF and CF flags are affected. The state of the OF, SF, ZF, and PF flags is undefined.

• AAM (ASCII Adjust after Multiplication): Corrects the result of a multiplication of two valid unpacked decimal numbers.

  • An AAM instruction must follow the multiplication of two decimal numbers to produce a valid decimal result.

  • The upper digit is left in the AH register, the lower digit in the AL register.

  • The SF, ZF, and PF flags are affected. The state of the AF, OF, and CF flags is undefined.

• AAD (ASCII Adjust before Division): Modifies the numerator in the AH and AL registers to prepare for the division of two valid unpacked decimal operands, so that the quotient produced by the division will be a valid unpacked decimal number.

  • The AH register should contain the upper digit and the AL register should contain the lower digit. This instruction adjusts the value by setting the value in the AL register to (AL + (10 * AH)), and then clears the AH register to 00H. and places the result in the AL register.

    • $AL = AL + (10 * AH)$

  • The AH register will be clear. The SF, ZF, and PF flags are affected. The state of the AF, OF, and CF flags is undefined.

Logical Instructions

• The logical instructions have two operands.

  • Source operands can be immediate values, general registers, or memory.

  • Destination operands can be general registers or memory (except when the source operand is in memory).

• The logical instructions modify the state of the flags.

  1. Boolean operation instructions

  2. Bit test and modify instructions

  3. Bit scan instructions

  4. Rotate and shift instructions

  5. Byte set on condition

Boolean Operation Instructions

• (AND, OR, XOR, and NOT instructions.)

• NOT (Not): Inverts the bits in the specified operand to form a one's complement of the operand.

  • The NOT instruction is a unary operation which uses a single operand in a register or memory.

  • NOT has no effect on the flags.

• The AND, OR, and XOR instructions perform the standard logical operations "and," "or," and "exclusive or."

  • These instructions can use the following combinations of operands:

    • Two register operands

    • A general register operand with a memory operand

    • An immediate operand with either a general register operand or a memory operand

  • The AND, OR, and XOR instructions clear the OF and CF flags, leave the AF flag undefined, and update the SF, ZF, and PF flags.

Bit Test and Modify Instructions

• This group of instructions operates on a single bit which can be in memory or in a general register.

Bit Scan Instructions

• These instructions scan a word or doubleword for a set bit and store the bit index (an integer representing the bit position) of the first set bit into a register.

  • The bit string being scanned may be in a register or in memory.

  • The ZF flag is set if the entire word is clear, otherwise the ZF flag is cleared.

  • In the former case, the value of the destination register is left undefined.

  • The state of the OF, SF, AF, PF, and CF flags is undefined.

    • BSF (Bit Scan Forward): Scans low-to-high (from bit 0 toward the upper bit positions).

    • BSR (Bit Scan Reverse): Scans high-to-Iow (from the uppermost bit toward bit 0).

Shift Instructions

• Shift instructions apply an arithmetic or logical shift to bytes, words, and doublewords.

  • An arithmetic shift right copies the sign bit into empty bit positions on the upper end of the operand, while a logical shift right fills clears the empty bit positions.

  • There is no difference between an arithmetic shift left and a logical shift left. Two names, SAL and SHL, are supported for this instruction in the assembler.

  • A count specifies the number of bit positions to shift an operand. Bits can be shifted up to 31 places. A shift instruction can give the count in any of three ways.

    • One form of shift instruction always shifts by one bit position.

    • The second form gives the count as an immediate operand.

    • The third form gives the count as the value contained in the CL register.

  • When the number of bit positions to shift is zero, no flags are affected. Otherwise, the CF flag is left with the value of the last bit shifted out of the operand.

  • In a single-bit shift, the OF flag is set if the value of the uppermost bit (sign bit) was changed by the operation. Otherwise, the OF flag is cleared.

  • After a shift of more than one bit position, the state of the OF flag is undefined. On a shift of one or more bit positions, the SF, ZF, PF, and CF flags are affected, and the state of the AF flag is undefined.

SAL/SHL

• SAL (Shift Arithmetic Left): Shifts the destination byte, word, or doubleword operand left by one bit position or by the number of bits specified in the count operand (an immediate value or a value contained in the CL register).

  • Empty bit positions are cleared.

  • The high-order bit is shifted into the CF flag, and the low-order bit is cleared.

• SHL (Shift Logical Left): Is another name for the SAL instruction.
  Examples:
  *SAL EAX, 1
  *SAL EAX,3
  *SAL EBX,CL

• In a single-bit shift, the OF flag is set if the value of the uppermost bit (sign bit) was changed by the operation. Otherwise, the OF flag is cleared.

• After a shift of more than one bit position, the state of the OF flag is undefined. On a shift of one or more bit positions, the SF, ZF, PF, and CF flags are affected, and the state of the AF flag is undefined.
  Figure 3-6. SHL/SAL Instruction

SHR

• SHR (Shift Logical Right): Shifts the destination byte, word, or doubleword operand right by one bit position or by the number of bits specified in the count operand (an immediate value or a value contained in the CL register).

  • Empty bit positions are cleared.
    Examples:
    SHR EBX, 1
    SHR EAX, 4
    SHR EAX, CL

SAR

• SAR (Shift Arithmetic Right): Shifts the destination byte, word, or doubleword operand to the right by one bit position or by the number of bits specified in the count operand (an immediate value or a value contained in the CL register).

  • The sign of the operand is preserved by clearing empty bit positions if the operand is positive, or setting the empty bits if the operand is negative.

Double-Shift Instructions

• The double shifts operate either on word or doubleword operands, as follows:.,

  • Take two word operands and produce a one-word result (32-bit shift).

  • Take two doubleword operands and produce a doubleword result (64-bit shift).

• SHLD (Shift Left Double): Shifts bits of the destination operand to the left, while filling empty bit positions with bits shifted out of the source operand.

  • The result is stored back into the destination operand. The source operand is not modified.

  • The destination operand can be a register or a memory location; the source operand is a register.

  • The count operand is an unsigned integer that can be stored in an immediate byte or in the CL register

  • If the count is 1 or greater, the CF flag is filled with the last bit shifted out of the destination operand.

  • For a 1-bit shift, the OF flag is set if a sign change occurred; otherwise, it is cleared.

  • If the count operand is 0, flags are not affected.

• SHRD (Shift Right Double): Shifts bits of the destination operand to the right, while filling empty bit positions with bits shifted out of the source operand.

  • The result is stored back into the destination operand. The source operand is not modified.

  • The destination operand can be a register or a memory location; the source operand is a register.

  • The count operand is an unsigned integer that can be stored in an immediate byte or the CL register.

  • If the count is 1 or greater, the CF flag is filled with the last bit shifted out of the destination operand.

  • For a 1-bit shift, the OF flag is set if a sign change occurred; otherwise, it is cleared.

  • If the count operand is 0, flags are not affected.

Rotate Instructions

• Rotate instructions apply a circular permutation to bytes, words, and doublewords.

  • Bits rotated out of one end of an operand enter through the other end. Unlike a shift, no bits are emptied during a rotation.

  • The rotate is repeated the number of times indicated by the second operand, which is either an immediate number or the contents of the CL register.

  • Rotate instructions use only the CF and OF flags.

  • The CF flag may act as an extension of the operand in two of the rotate instructions, allowing a bit to be isolated and then tested by a conditional jump instruction (JC or JNC).

  • The CF flag always contains the value of the last bit rotated out of the operand, even if the instruction does not use the CF flag as an extension of the operand.

  • The state of the SF, ZF, AF, and PF flags is not affected.

ROL

• ROL (Rotate Left): Rotates the byte, word, or doubleword destination operand left by one bit position or by the number of bits specified in the count operand (an immediate value or a value contained in the CL register).

  • For each bit position of the rotation, the bit which exits from the left of the operand returns at the right.
    Examples:
    ROL EAX, 1
    ROL EAX, 4
    ROL EAX, CL

ROR

• ROR (Rotate Right): Rotates the byte, word, or doubleword destination operand right by one bit position or by the number of bits specified in the count operand (an immediate value or a value contained in the CL register).

  • For each bit position of the rotation, the bit which exits from the right of the operand returns at the left.
    Examples:
    ROR EAX, 1
    ROR EAX, 4
    ROR EAX, CL

RCL

• RCL (Rotate Through Carry Left): Rotates bits in the byte, word, or doubleword destination operand left by one bit position or by the number of bits specified in the count operand (an immediate value or a value contained in the CL register).

  • This instruction differs from ROL in that it treats the CF flag as a one-bit extension on the upper end of the destination operand.

  • Each bit which exits from the left side of the operand moves into the CF flag. At the same time, the bit in the CF flag enters the right side.

RCR

• RCR (Rotate Through Carry Right): Rotates bits in the byte, word, or doubleword destination operand right by one bit position or by the number of bits specified in the count operand (an immediate value or a value contained in the CL register).

  • This instruction differs from ROR in that it treats CF as a one-bit extension on the lower end of the destination operand.

  • Each bit which exits from the right side of the operand moves into the CF flag. At the same time, the bit in the CF flag enters the left side.

Byte-Set-On-Condition Instructions

• This group of instructions sets a byte to the value of zero or one, depending on any of the 16 conditions defined by the status flags.

  • The byte may be in a register or in memory.

  • SETcc (Set Byte on Condition cc) loads the value 1 into a byte if condition cc is true; clears the byte otherwise.

• TEST (Test): Performs the logical "and" of the two operands, clears the OF and CF flags, leaves the AF flag undefined, and updates the SF, ZF, and PF flags.

  • The operands may be bytes, words, or doublewords.

  • The difference between the TEST and AND instructions is the TEST instruction does not alter the destination operand.

  • The difference between the TEST and BT instructions is the TEST instruction can test the value of multiple bits in one operation, while the BT instruction tests a single bit.

Control Transfer Instructions

• 2 types

  1. CONDITIONAL

  2. UNCONDITIONAL

CONDITIONAL TRANSFER INSTRUCTIONS

Table 3-3. Conditional Jump Instructions

Loop Instructions

• LOOP (Loop While ECX Not Zero):

  • Decrements the contents of the ECX register before testing for the loop-terminating condition.

  • If contents of the ECX register are non-zero, the program jumps to the destination specified in the instruction.

  • The LOOP instruction causes the execution of a block of code to be repeated until the count reaches zero.

  • When zero is reached, execution is transferred to the instruction immediately following the LOOP instruction.

  • If the value in the ECX register is zero when the instruction is first called, the count is predecremented to OFFFFFFFFH and the LOOP runs $2^{32}$ times.

• LOOPE (Loop While Equal) and LOOPZ (Loop While Zero):

  • Decrements the contents of the ECX register before testing for the loop-terminating condition.

  • If the contents of the ECX register are non-zero and the ZF flag is set, the program jumps to the destination specified in the instruction.

  • When zero is reached or the ZF flag is clear, execution is transferred to the instruction immediately following the LOOPE/LOOPZ instruction.

• LOOPNE (Loop While Not Equal) and LOOPNZ (Loop While Not Zero):

  • Decrements the contents of the ECX register before testing for the loop-terminating condition.

  • If the contents of the ECX register are non-zero and the ZF flag is clear, the program jumps to the destination specified in the instruction.

  • When zero is reached or the ZF flag is set, execution is transferred to the instruction immediately following the LOOPE/LOOPZ instruction.

Executing a Loop or Repeat Zero Times

• JECXZ (Jump if ECX Zero):

  • Jumps to the destination specified in the instruction if the ECX register holds a value of zero.

  • The JECXZ instruction is used in combination with the LOOP instruction and with the string scan and compare instructions.

  • Because these instructions decrement the contents of the ECX register before testing for zero, a loop will run $2^{32}$ times if the loop is entered with a zero value in the ECX register.

  • The JECXZ instruction is used to create loops which fall through without executing when the initial value is zero. A JECXZ instruction at the beginning of a loop can be used to jump out of the loop if the count is zero.

  • When used with repeated string scan and compare instructions, the JECXZ instruction can determine whether the loop terminated due to the count or due to satisfaction of the scan or compare conditions.

Unconditional Transfer Instructions

• JMP (Jump): Unconditionally transfers execution to the destination.

  • The JMP instruction is a one-way transfer of execution; it does not save a return address on the stack. The JMP instruction transfers execution from the current routine to a different routine. The address of the routine is specified in the instruction, in a register, or in memory.

• **CALL (