Intel x86 Assembly Fundamentals

Computer p Organization g z and Assembly y Languages g g Yung-Yu Chuang

with slides by Kip Irvine

x86 Assembly Language Fundamentals

Instructions
Assembled into machine code by assembler Executed at runtime by the CPU Member of the Intel IA-32 instruction set Four parts
Label (optional) Mnemonic (required) Operand (usually required) Comment (optional) Mnemonic Operand(s) ;Comment
3

Label:

Labels
Act as place markers
marks the address (offset) of code and data

Easier to memorize and more flexible mov ax ax, [0020] mov ax ax, val Follow identifier rules Data D l label b l
must be unique example: l myArray BYTE 10

Code label (ends with a colon)

target of jump and loop instructions example: L1: mov ax, bx ... jmp L1

Reserved words and identifiers

Reserved words cannot be used as identifiers
Instruction mnemonics, mnemonics directives directives, type attributes attributes, operators, predefined symbols

Identifiers
1-247 characters, including digits case insensitive (by default) first character must be a letter, _, @, or $ examples: p var1 Count $first _main MAX open_file @@myfile xVal _12345

Mnemonics and operands

Instruction mnemonics
"reminder" reminder examples: MOV, ADD, SUB, MUL, INC, DEC

Operands
constant (immediate value), 96 constant expression, expression 2+4 Register, eax memory y( (data label), ), cou count t ; set Carry flag ; add 1 to ax ; move BX to count
6

Number of operands: 0 to 3
stc inc ax mov count, , bx

Directives
Commands that are recognized and acted upon by the assembler
Part of assemblers syntax but not part of the Intel instruction set Used to declare code, data areas, select memory model declare procedures model, procedures, etc etc. case insensitive

Different assemblers have different directives

NASM != MASM, for example

Examples: E l .data d

.code d

PROC OC

Comments
Comments are good!
explain the program's program s purpose tricky coding techniques application-specific pp p explanations p

Single-line comments
begin g with semicolon (;)

block comments
begin with COMMENT directive and a programmer programmerchosen character and end with the same programmer-chosen character COMMENT ! This is a comment and this line is also a comment !

Example: adding/subtracting integers

directive marking a comment
TITLE Add and Subtract (AddSub.asm)

comment
; This program adds and subtracts 32-bit integers. INCLUDE Irvine32.inc copy definitions from Irvine32.inc .code code segment. seg e t. 3 segments: seg e ts: code, data, stac stack main PROC beginning of a procedure mov eax,10000h source ; EAX = 10000h add eax,40000h ; EAX = 50000h d destination ti ti sub eax,20000h ; EAX = 30000h call DumpRegs ; display registers exit defined in Irvine32 Irvine32.inc inc to end a program main ENDP END main marks the last line and

define the startup procedure

9

Example output
Program output output, showing registers and flags:
EAX 00030000 EAX=00030000 ESI=00000000 EIP=00401024 EBX EBX=7FFDF000 7FFDF000 EDI=00000000 EFL=00000206 ECX ECX=00000101 00000101 EBP=0012FFF0 CF=0 SF=0 EDX EDX=FFFFFFFF FFFFFFFF ESP=0012FFC4 ZF=0 OF=0

10

Alternative version of AddSub

TITLE Add and Subtract (AddSubAlt.asm)

; This program adds and subtracts 32-bit integers. .386 .MODEL flat,stdcall , .STACK 4096 ExitProcess PROTO, dwExitCode:DWORD DumpRegs PROTO .code main PROC mov eax,10000h add eax,40000h sub eax,20000h call DumpRegs INVOKE ExitProcess,0 main ENDP END main

; EAX = 10000h ; EAX = 50000h ; EAX = 30000h

11

Program template
TITLE Program Template ; ; ; ; ; Program Description: Author: Creation Date: Revisions: Date: Modified by: (Template.asm)

.data ; (insert variables here) .code code main PROC ; (insert executable instructions here) exit i main ENDP ; (insert additional procedures here) END main
12

Assemble-link execute cycle

The following diagram describes the steps from creating a source program through executing the compiled program. If the source code is modified, , Steps p 2 through g 4 must be repeated.
Link Library Source File
Step 2: St 2 assembler

Object File Listing File

Step 3: linker

Executable File Map File

Step 4: OS loader

Output

Step 1: text editor

13

Defining data

Intrinsic data types

BYTE, SBYTE

(1 of 2)

8-bit 8 bit unsigned i di integer; t 8 8-bit bit signed i di integer t

WORD, SWORD
16-bit unsigned & signed integer

DWORD, SDWORD
32-bit unsigned & signed integer

QWORD Q
64-bit integer

TBYTE
80-bit integer
15

Intrinsic data types

REAL4

(2 of 2)

4-byte 4 b t IEEE short h t real l

REAL8
8-byte IEEE long real

REAL10
10-byte IEEE extended real

16

Data definition statement

A data definition statement sets aside storage in memory for a variable. variable May optionally assign a name (label) to the data. Only size matters, matters other attributes such as signed are just reminders for programmers. Syntax:
[name] directive initializer [,initializer] . . . At least one initializer is required, can be ?

All initializers become binary data in memory

17

Integer constants
[{+|-}] digits [radix] Optional leading + or sign binary, decimal, hexadecimal, or octal digits C Common radix di characters: h t
h d b r o hexadecimal d i l (d decimal (default) f lt) binary encoded real octal

Examples: 30d, 6Ah, 42, 42o, 1101b Hexadecimal beginning with letter: 0A5h
18

Integer expressions
Operators and precedence levels:

Examples:

19

Real number constants (encoded reals)

Fixed point v.s. floating point
1 S 8 E 23 M

1.bbbb2 (E-127) Example 3F800000r=+1.0,37.75=42170000r

double
1 S 11 E 52 M
20

Real number constants (decimal reals)

[sign]integer.[integer][exponent] sign i {+|-} { |} exponent E[{+|-}]integer Examples:
2. +3.0 -44 44.2E+05 2E+05 26.E5

21

Character and string constants

Enclose character in single or double quotes
'A', 'A' " "x" " ASCII character = 1 byte

Enclose l strings in single l or double d bl quotes

"ABC" 'xyz' Each character occupies a single byte

Embedded quotes:
Say y "Goodnight," g Gracie "This isn't a test"

22

Defining BYTE and SBYTE Data

Each of the following defines a single byte of storage: value1 BYTE 'A value2 l 2 BYTE 0 value3 BYTE 255 ; character constant ; smallest ll t unsigned i d b byte t ; largest unsigned byte

value4 SBYTE -128 ; smallest signed byte value5 SBYTE +127 ; largest signed byte value6 BYTE ? ; uninitialized byte

A variable name is a data label that implies an offset (an address).

23

Defining multiple bytes

Examples that use multiple initializers: list1 BYTE 10 10,20,30,40 20 30 40 list2 BYTE 10,20,30,40 BYTE 50,60,70,80 BYTE 81,82,83,84 , , , list3 BYTE ?,32,41h,00100010b list4 BYTE 0Ah,20h,A,22h

24

Defining strings

(1 of 2)

A string is implemented as an array of characters For convenience, it is usually enclosed in quotation marks q It usually has a null byte at the end Examples:
str1 BYTE str2 BYTE str3 BYTE greeting1 "Enter your name",0 'Error: halting program',0 'A','E','I','O','U' BYTE "Welcome to the Encryption Demo program " BYTE "created created by Kip Irvine Irvine.",0 0 greeting2 \ BYTE "Welcome to the Encryption Demo program " BYTE "created by Kip Irvine.",0
25

Defining strings

(2 of 2)

End-of-line character sequence: 0Dh = carriage return 0Ah = line feed str1 BYTE "Enter your name: ",0Dh,0Ah BYTE "Enter Enter your address: ",0 0 newLine BYTE 0Dh 0Dh,0Ah,0 0Ah 0

Idea: Define all strings used by your program in the same area of the data segment.
26

Using the DUP operator

Use DUP to allocate (create space for) an array or string. string Counter and argument must be constants or constant expressions p var1 BYTE 20 DUP(0) ; 20 bytes, all zero var2 BYTE 20 DUP(?) ; 20 bytes, ; uninitialized i iti li d var3 BYTE 4 DUP("STACK") ; 20 bytes: ;"STACKSTACKSTACKSTACK" var4 BYTE 10 10,3 3 DUP(0) DUP(0),20 20
27

Defining WORD and SWORD data

Define storage for 16-bit integers or double characters single value or multiple values word1 WORD 65535 word2 SWORD 32768 word3 WORD ? ; ; ; ; word4 WORD "AB" ; myList y WORD 1,2,3,4,5 , , , , array WORD 5 DUP(?) ; largest unsigned smallest signed g uninitialized, unsigned g double characters ; array y of words uninitialized array

28

Defining DWORD and SDWORD data

Storage definitions for signed and unsigned 32-bit integers: val1 val2 val3 val4 DWORD 12345678h SDWORD 2147483648 DWORD 20 DUP(?) SDWORD 3,2,1,0,1 3 2 1 0 1 ; ; ; ; unsigned signed unsigned array signed array

29

Defining QWORD, TBYTE, Real Data

Storage definitions for quadwords, tenbyte values, and real numbers: q quad1 Q QWORD 1234567812345678h val1 TBYTE 1000000000123456789Ah rVal1 a REAL4 -2.1 . rVal2 REAL8 3.2E-260 rVal3 REAL10 4.6E+4096 ShortArray REAL4 20 DUP(0.0)

30

Little Endian order

All data types larger than a byte store their individual bytes in reverse order order. The least significant byte occurs at the first (lowest) memory address. address Example:
val1 DWORD 12345678h

31

Adding variables to AddSub

TITLE Add and Subtract, INCLUDE Irvine32 Irvine32.inc inc .data val1 DWORD 10000h val2 DWORD 40000h val3 DWORD 20000h finalVal DWORD ? .code main PROC mov eax,val1 add eax,val2 sub eax,val3 mov finalVal,eax , call DumpRegs exit main ENDP END main (AddSub2.asm)

; ; ; ; ;

start with 10000h add 40000h subtract 20000h store the result ( (30000h) ) display the registers

32

Declaring unitialized data

Use the .data? directive to declare an unintialized i ti li d d data t segment: t
.data?

Within the segment, declare variables with "?" initializers: (will not be assembled into .exe)
Advantage: the program's EXE file size is reduced. .data smallArray DWORD 10 DUP(0) .data? bigArray DWORD 5000 DUP(?)
33

Mixing code and data

.code mov eax eax, ebx .data temp DWORD ? .code mov temp temp, eax

34

Symbolic constants

Equal-sign directive
name = expression
expression i i is a 32-bit 32 bit integer i t ( (expression i or constant) t t) may be redefined name is i called ll d a symbolic b li constant t t

good programming style to use symbols

Easier to modify Easier to understand, ESC_key Array DWORD COUNT DUP(0) COUNT=5 mov al, l COUNT COUNT=10 mov al al, COUNT COUNT = 500 . mov al,COUNT

36

Calculating the size of a byte array

current location counter: $
subtract bt t address dd of f li list t difference is the number of bytes list BYTE 10,20,30,40 ListSize stS e = 4 list BYTE 10,20,30,40 ListSize stS e = ($ - list) st)

list BYTE 10,20,30,40 var2 BYTE 20 DUP(?) ListSize = ($ - list) myString BYTE This is a long string. myString_len St i l = ($ - myString) St i )
37

Calculating the size of a word array

current location counter: $
subtract address of list difference is the number of bytes divide by 2 (the size of a word) list li t WORD 1000h,2000h,3000h,4000h 1000h 2000h 3000h 4000h ListSize = ($ - list) / 2 list DWORD 1,2,3,4 ListSize = ($ - list) / 4

38

EQU directive
name EQU expression name EQU symbol Q <text> name EQU Define a symbol as either an integer or text expression. expression Can be useful for non-integer constants Cannot C t be b redefined d fi d

39

EQU directive
PI EQU Q <3.1416> pressKey EQU <"Press any key to continue...",0> .data prompt BYTE pressKey matrix1 EQU 10*10 matrix2 EQU <10 <10*10> 10> .data M1 WORD matrix1 M2 WORD matrix2 ; M1 WORD 100 ; M2 WORD 10*10

40

Addressing

Addressing Modes

Addressing Modes

32-Bit Addressing Modes

These addressing modes use 32-bit registers
Segment + Base + (Index * Scale) + displacement

Operand types
Three basic types of operands:
I Immediate di t a constant t ti integer t (8 (8, 16 16, or 32 bit bits) ) value is encoded within the instruction Register R i t the th name of f a register i t register name is converted to a number and encoded within the instruction Memory reference to a location in memory memory address dd i is encoded d d within ithi th the instruction, or a register holds the address of a memory location

45

Instruction operand notation

46

Direct memory operands

A direct memory operand is a named reference to storage in memory The named reference (label) is automatically dereferenced by the assembler
.data var1 1 BYTE 10h 10h, .code mov al,var1 l 1 mov al,[var1]

; AL = 10h ; AL = 10h

alternate format; I prefer this one.

47

Direct-offset operands
A constant offset is added to a data label to produce an effective address (EA). (EA) The address is dereferenced to get the value inside its memory location. (no range checking) .data arrayB BYTE 10h,20h,30h,40h .code d mov al,arrayB+1 ; AL = 20h mov al,[arrayB+1] ; alternative notation mov al,arrayB+3 ; AL = 40h

48

Direct-offset operands (cont)

A constant offset is added to a data label to produce an effective address (EA). (EA) The address is dereferenced to get the value inside its memory location. .data data arrayW WORD 1000h,2000h,3000h arrayD DWORD 1,2,3,4 .code mov ax,[arrayW+2] ; AX = 2000h mov ax,[arrayW+4] [ W 4] ; AX = 3000h mov eax,[arrayD+4] ; EAX = 00000002h ; will the following assemble and run? mov ax,[arrayW-2] ; ?? mov eax,[arrayD+16] [ 16] ; ??
49

Data-Related Operators and Directives

OFFSET Operator PTR Operator p TYPE Operator LENGTHOF Operator SIZEOF Operator LABEL Directive

50

OFFSET Operator
OFFSET returns the distance in bytes, of a label

from the beginning of its enclosing segment

Protected mode: 32 bits Real mode: 16 bits
offset data segment: myByte

The Protected-mode programs we write only have a single g segment g (we use the flat memory ( y model). )
51

OFFSET Examples
Let's assume that bVal is located at 00404000h: .data bVal BYTE ? wVal WORD ? dVal DWORD ? dV l2 DWORD ? dVal2 .code mov esi,OFFSET mov esi,OFFSET mov esi,OFFSET mov esi,OFFSET

bVal ; wVal ; dVal ; dVal2;

ESI ESI ESI ESI

= = = =

00404000 00404001 00404003 00404007

52

Relating to C/C++
The value returned by OFFSET is a pointer. Compare the following code written for both C++ and assembly language: ; C++ version: char array[1000]; char * p = &array; .data array BYTE 1000 DUP(?) .code mov esi esi,OFFSET OFFSET array ; ESI is p

53

TYPE Operator
The TYPE operator returns the size, in bytes, of a single element of a data declaration. declaration .data var1 BYTE ? var2 WORD ? var3 DWORD ? var4 QWORD ? .code mov eax,TYPE mov eax,TYPE mov eax,TYPE mov eax eax,TYPE TYPE

var1 var2 2 var3 var4

; ; ; ;

1 2 4 8
54

LENGTHOF Operator
The LENGTHOF operator counts the number of elements in a single data declaration. declaration .data byte1 BYTE 10,20,30 array1 WORD 30 DUP(?),0,0 array2 2 WORD 5 DUP(3 DUP(?)) array3 DWORD 1,2,3,4 digitStr BYTE "12345678",0 12345678 ,0 .code mov ecx,LENGTHOF array1 LENGTHOF ; 3 ; 32 ; 15 ; 4 ; 9

; 32

55

SIZEOF Operator
The SIZEOF operator returns a value that is equivalent to multiplying LENGTHOF by TYPE. TYPE .data byte1 BYTE 10,20,30 array1 WORD 30 DUP(?),0,0 array2 WORD 5 DUP(3 DUP(?)) array3 DWORD 1,2,3,4 digitStr BYTE "12345678" 12345678 ,0 0 .code mov ecx,SIZEOF array1 SIZEOF ; 3 ; 64 ; 30 ; 16 ; 9

; 64

56

ALIGN Directive
ALIGN bound aligns a variable on a byte, word, doubleword or paragraph boundary for doubleword, efficiency. (bound can be 1, 2, 4, or 16.) bVal ALIGN wVal bV l2 bVal2 ALIGN dVal dVal2 BYTE ? 2 WORD ? BYTE ? 4 DWORD ? DWORD ? ; 00404000 ; 00404002 ; 00404004 ; 00404008 ; 0040400C
57

PTR Operator
Overrides the default type of a label (variable). Provides the flexibility to access part of a variable. variable .data myDouble DWORD 12345678h .code mov o a ax,myDouble , y oub e mov ax,WORD PTR myDouble mov WORD PTR myDouble,4321h

; e error o why? y? ; loads 5678h ; saves 4321h

To understand how this works, we need to know about little endian ordering of data in memory. memory
58

Little Endian Order

Little endian order refers to the way Intel stores integers in memory. memory Multi-byte integers are stored in reverse order, with the least significant byte stored at the lowest address For example example, the doubleword 12345678h would be stored as:
byte offset

78 56 34 12

0000 0001 0002 0003

When integers are loaded from memory into registers registers, the bytes are automatically re-reversed into their correct positions.
59

PTR Operator Examples

.data myDouble DWORD 12345678h
doubleword word byte offset

12345678 5678

78 56

0000 0001 0002 0003

myDouble myDouble + 1 myDouble + 2 myDouble + 3

1234

34 12

mov mov mov mov mov

al,BYTE al al,BYTE BYTE al,BYTE ax,WORD ax,WORD

PTR PTR PTR PTR PTR

myDouble [myDouble+1] [myDouble+2] [myDouble] y [myDouble+2]

; ; ; ; ;

AL AL AL AX AX

= = = = =

78h 56h 34h 5678h 1234h

60

PTR Operator (cont)

PTR can also be used to combine elements of a smaller d data type and d move them h i into a l larger operand. d Th The CPU will automatically reverse the bytes. .data myBytes BYTE 12h,34h,56h,78h .code mov ax ax,WORD WORD PTR [myBytes] mov ax,WORD PTR [myBytes+1] , PTR myBytes y y mov eax,DWORD

; ; ; ;

AX = 3412h AX = 5634h EAX =78563412h

61

Your turn . . .
Write down the value of each destination operand: .data varB BYTE 65h,31h,02h,05h varW WORD 6543h 6543h,1202h 1202h varD DWORD 12345678h .code mov ax,WORD PTR [varB+2] mov bl,BYTE PTR varD mov bl,BYTE PTR [varW+2] mov ax ax,WORD WORD PTR [varD+2] mov eax,DWORD PTR varW

; ; ; ; ;

a. 0502h b. 78h c. 02h d d. 1234h e. 12026543h

62

Spanning Multiple Lines

(1 of 2)

A data declaration spans multiple lines if each line (except the last) ends with a comma comma. The LENGTHOF and SIZEOF operators include all lines belonging to the declaration: .data array WORD 10,20, 30,40, 50,60 .code mov eax eax,LENGTHOF LENGTHOF array mov ebx,SIZEOF array

; 6 ; 12
63

Spanning Multiple Lines

(2 of 2)

In the following example, array identifies only the first WORD declaration. declaration Compare the values returned by LENGTHOF and SIZEOF here to those in the previous slide: .data array WORD 10,20 WORD 30,40 WORD 50,60

.code mov eax eax,LENGTHOF LENGTHOF array mov ebx,SIZEOF array

; 2 ; 4

64

LABEL Directive
Assigns an alternate label name and type to an existing storage location LABEL does not allocate any storage of its own; it is just an alias. j Removes the need for the PTR operator .data data dwList LABEL DWORD wordList o d st LABEL WORD O intList BYTE 00h,10h,00h,20h .code mov eax,dwList ; 20001000h mov cx,wordList ; 1000h mov dl dl,intList intList ; 00h
65

Indirect operands

(1 of 2)

An indirect operand holds the address of a variable, usually y an array y or string. g It can be dereferenced (j (just like a pointer). [reg] uses reg as pointer to access memory .data d val1 BYTE 10h,20h,30h .code code mov esi,OFFSET val1 mov al,[esi] ; dereference ESI (AL = 10h) inc esi mov al,[esi] l [ i] inc esi mov al,[esi]

; AL = 20h

; AL = 30h

66

Indirect operands

(2 of 2)

Use PTR when the size of a memory operand is ambiguous. .data myCount WORD 0 unable bl to t determine d t i th the size from the context .code mov esi esi,OFFSET OFFSET myCount inc [esi] ; error: ambiguous inc WORD PTR [esi] ; ok

67

Array sum example

Indirect operands are ideal for traversing an array. Note that the register g in brackets must be incremented by ya value that matches the array type. .data arrayW .code code mov mov add add add dd add

WORD 1000h,2000h,3000h esi,OFFSET ax,[esi] esi,2 ax,[esi] esi,2 i 2 ax,[esi] arrayW ; or: add esi,TYPE arrayW ; i increment t ESI S b by 2 ; AX = sum of the array
68

Indexed operands
An indexed operand adds a constant to a register to generate an effective address. There are two notational forms: [label + reg] label[reg] .data d arrayW WORD 1000h,2000h,3000h .code code mov esi,0 mov ax,[arrayW y + esi] ; AX = 1000h mov ax,arrayW[esi] ; alternate format add esi,2 add dd ax,[arrayW [ W + esi] i] etc.
69

Index scaling
You can scale an indirect or indexed operand to the offset o set of o an a array a ay element. ele e t. This s is s do done e by multiplying ult ply g the index by the array's TYPE: .data arrayB BYTE 0,1,2,3,4,5 arrayW WORD 0 0,1,2,3,4,5 1 2 3 4 5 arrayD DWORD 0,1,2,3,4,5 .code code mov esi,4 mov al al,arrayB[esi*TYPE arrayB[esi*TYPE arrayB] mov bx,arrayW[esi*TYPE arrayW] mov edx edx,arrayD[esi*TYPE arrayD[esi*TYPE arrayD]

; 04 ; 0004 ; 00000004
70

Pointers
You can declare a pointer variable that contains the offset of another variable. variable .data arrayW WORD 1000h,2000h,3000h 1000 2000 3000 ptrW DWORD arrayW .code code mov esi,ptrW mov ax,[esi] ; AX = 1000h

71