Data Transfers, Addressing, and Arithmetic
Data Transfers, Addressing, and Arithmetic
Data Transfers, Addressing, and Arithmetic
4.1.1 Introduction 79
• This chapter introduces a great many details, highlighting a fundamental difference between
assembly language and high-level language.
.data
var1 BYTE 10h
.code
mov al,var1 ; AL = 10h
mov al,[var1] ; AL = 10h
• MOV Instruction
o Move (copy) from source to destination
o Syntax:
• Examples:
.data
count BYTE 100
wVal WORD 2
.code
mov bl,count
mov ax,wVal
mov count,al
mov al,wVal ; error, AL is 8 bits
mov ax,count ; error, AX is 16 bits
mov eax,count ; error, EAX is 32 bits
.data
bVal BYTE 100
bVal2 BYTE ?
.code
mov bl,10001111b
movzx ax,bl ; zero-extension – 000000010001111b
mov bl,10001111b
movsx ax,bl ; sign-extension – 1111111110001111b
• LAHF (load status flags into AH) instruction copies the low byte of the EFLAGS register
into AH. The following flags are copied: Sign, Zero, Auxiliary Carry, Parity, and Carry.
.data
saveflags BYTE ?
.code
lahf ; load flags into AH
mov saveflags, ah ; save them in a variable
• SAHF (store status flags into AH) instruction copies the low byte of the EFLAGS register
into AH. The following flags are copied: Sign, Zero, Auxiliary Carry, Parity, and Carry.
.data
var1 WORD 1000h
var2 WORD 2000h
.code
xchg ax,bx ; exchange 16-bit regs
xchg ah,al ; exchange 8-bit regs
xchg var1,bx ; exchange mem, reg
xchg eax,ebx ; exchange 32-bit regs
xchg var1,var2 ; error: two memory operands
• Direct-Offset Operands
o A constant offset is added to a data label to produce an effective address (EA)
o The address is dereferenced to get the value inside its memory location
.data
arrayB BYTE 10h,20h,30h,40h, 50h
.code
mov al,arrayB+1 ; AL = 20h
mov al,[arrayB+1] ; alternative notation
mov al,arrayB+2 ; AL = 30h
• The following program demonstrates most of the data transfer examples form Section 4.1:
INCLUDE Irvine32.inc
.data
val1 WORD 1000h
val2 WORD 2000h
.code
main PROC
; MOVZX
mov bx,0A69Bh
movzx eax,bx ; EAX = 0000A69Bh
movzx edx,bl ; EDX = 0000009Bh
movzx cx,bl ; CX = 009Bh
; MOVSX
mov bx,0A69Bh
movsx eax,bx ; EAX = FFFFA69Bh
movsx edx,bl ; EDX = FFFFFF9Bh
mov bl,7Bh
movsx cx,bl ; CX = 007Bh
; Memory-to-memory exchange:
mov ax,val1 ; AX = 1000h
xchg ax,val2 ; AX = 2000h, val2 = 1000h
mov val1,ax ; val1 = 2000h
exit
main ENDP
END main
o DEC destination
• ADD Instruction
o ADD destination, source
o Examples:
.data
var1 DWORD 10000h
var2 DWORD 20000h
.code
mov eax,var1 ; EAX = 00010000h
add eax,var2 ; EAX = 00030000h
• SUB Instructions
o SUB destination, source
o Examples:
.data
var1 DWORD 30000h
var2 DWORD 10000h
.code
mov eax,var1 ; EAX = 00030000h
sub eax,var2 ; EAX = 00020000h
.data
valB BYTE -1
valW WORD +32767
.code
mov al,valB ; AL = -1
neg al ; AL = +1
neg valW ; valW = -32767
SUB 0,operand
.data
valB BYTE 1,0
valC SBYTE -128
.code
neg valB ; CF = 1, OF = 0
neg [valB + 1] ; CF = 0, OF = 0
neg valC ; CF = 1, OF = 1
.data
Rval DWORD ?
Xval DWORD 26
Yval DWORD 30
Zval DWORD 40
.code
mov eax,Xval
neg eax ; EAX = -26, EAX = -Xval
mov ebx,Yval ; EBX = 30, EBX = Yval
sub ebx,Zval ; EBX = -10, EBX = (Yval – Zval)
add eax,ebx ; EAX = -36, EAX = -Xval + (Yval – Zval)
mov Rval,eax ; Rval = -36
mov cx,1
sub cx,1 ; CX = 0, ZF = 1
mov ax,0FFFFh
inc ax ; AX = 0, ZF = 1
inc ax ; AX = 1, ZF = 0
Note: A flag is set when it equals 1
A flag is clear when it equals 0
mov cx,0
sub cx,1 ; CX = -1, SF = 1
add cx,2 ; CX = 1, SF = 0
Note: The sign flag is a copy of the destination's highest bit
o Carry flag: Set when unsigned destination operand value is out of range
mov al,7Fh
add al,1 ; AL = 80, CF = 0
mov al,0FFh
add al,1 ; AL = 00, CF = 1, Too big
mov al,1
sub al,2 ; AL = FF, CF = 1, Below zero
o Auxiliary Carry: Set when carry out of bit 3 in the destination operand
mov al,0Fh
add al,1 ; AL = 10, AC = 1
o Parity flag: Set when the least significant byte of the destination has even number of 1
bits.
mov al,10001100b
add al,00000010b ; AL = 10001110, PF = 1
sub al,10000000b ; AL = 00001110, PF = 0
o Examples:
mov al,-128 ; AL = 10000000b
neg al ; AL = 10000000b, CF = 1, OF = 1
mov al,7Fh
add al,2 ; AL = 10000001b, CF = 0, OF = 1
• The following program implements various arithmetic expressions using the ADD, SUB,
INC, DEC, and NEG instructions, and show how certain status flags are affected:
INCLUDE Irvine32.inc
.data
Rval SDWORD ?
Xval SDWORD 26
Yval SDWORD 30
Zval SDWORD 40
.code
main PROC
; INC and DEC
mov ax,1000h
inc ax ; 1001h
dec ax ; 1000h
exit
main ENDP
END main
• OFFSET operator returns the distance in bytes, of a label from the beginning of its enclosing
segment
o Protected mode: Offset are 32 bits
o Real mode: Offset are 16 bits
• OFFSET Example
o Assume that the data segment begins at 00404000h
.data
bVal BYTE ?
wVal WORD ?
dVal DWORD ?
dVal2 DWORD ?
.code
mov esi,OFFSET bVal ; ESI = 00404000
mov esi,OFFSET wVal ; ESI = 00404001
mov esi,OFFSET dVal ; ESI = 00404003
mov esi,OFFSET dVal2 ; ESI = 00404007
• Relating to C/C++
o The value returned by OFFSET is a pointer
o Compare the following code written for both C++ and assembly language
// C++ version:
char array[1000];
char * p = array;
; Assembly version
.data
array BYTE 1000 DUP(?)
.code
mov esi,OFFSET array
• The ALIGN directive aligns a variable on a byte, word, doubleword, or paragraph boundary.
• ALIGN Example
o Assume that the data segment begins at 00404000h
.data
bVal BYTE ? ; 00404000
ALIGN 2
wVal WORD ? ; 00404002
bVal2 BYTE ? ; 00404004
ALIGN 4
dVal DWORD ? ; 00404008
dVal2 DWORD ? ; 0040400C
• PTR Operator
o Overrides the default type of a label (variable)
o Provides the flexibility to access part of a variable
o Must be used in combination with one of the standard assembly data type: BYTE,
SBYTE, WORD, SWORD, DWORD, SDWORD, FWORD, QWORD, or TWORD
• Little Endian Order
o Little endian order refers to the way Intel stores integers in memory.
o Multi-byte integers are stored in reverse order, with the least significant byte stored at the
lowest address
o For example, the doubleword 12345678h would be stored as:
.data
myDouble DWORD 12345678h
.code
mov ax,myDouble ; error
mov ax,WORD PTR myDouble ; AX = 5678h
mov ax,WORD PTR [myDouble+2] ; AX = 1234h
mov al,BYTE PTR myDouble ; AL = 78h
mov al,BYTE PTR [myDouble+1] ; AL = 56h
mov al,BYTE PTR [myDouble+2] ; AL = 34h
• PTR operator can combine elements of a smaller data type and move them into a larger
operand
.data
myBytes BYTE 12h,34h,56h,78h
.code
mov ax,WORD PTR [myBytes] ; AX = 3412h
mov ax,WORD PTR [myBytes+2] ; AX = 7856h
mov eax,DWORD PTR myBytes ; EAX = 78563412h
• TYPE operator returns the size, in bytes, of a single element of a data declaration
• TYPE Example:
.data
var1 BYTE ?
var2 WORD ?
var3 DWORD ?
var4 QWORD ?
.code ; TYPE
mov eax,TYPE var1 ; 1
mov eax,TYPE var2 ; 2
mov eax,TYPE var3 ; 4
mov eax,TYPE var4 ; 8
.data ; LENGTHOF
byte1 BYTE 10,20,30 ; 3
array1 WORD 30 DUP(?),0,0 ; 32
array2 WORD 5 DUP(3 DUP(?)) ; 15
array3 DWORD 1,2,3,4 ; 4
digitStr BYTE "12345678",0 ; 9
.code
mov ecx,LENGTHOF array1 ; 32
.data ; SIZEOF
byte1 BYTE 10,20,30 ; 3
array1 WORD 30 DUP(?),0,0 ; 64
array2 WORD 5 DUP(3 DUP(?)) ; 30
array3 DWORD 1,2,3,4 ; 16
digitStr BYTE "12345678",0 ; 9
.code
mov ecx,SIZEOF array1 ; 64
• A data declaration spans multiple lines if each line (except the last) ends with a comma
• The LENGTHOF and SIZEOF operators include all lines belonging to the declaration
.data
array WORD 10,20,
30,40,
50,60
.code
mov eax,LENGTHOF array ; 6
mov ebx,SIZEOF array ; 12
• LABEL Directive
o Assigns an alternate label name and type to an existing storage location
o LABEL does not allocate any storage of its own
o Removes the need for the PTR operator
• LABEL Examples
.data
val16 LABEL WORD
val32 DWORD 12345678h
.code
mov ax,val16 ; AX = 5678h
mov dx,[val16+2] ; DX = 1234h
.data
LongValue LABEL DWORD
val1 WORD 5678h
val2 WORD 1234h
.code
mov eax,LongValue ; EAX = 12345678h
• Indirect Operands
o An indirect operand holds the address of a variable, usually an array or string
o It can be dereferenced (just like a pointer).
.data
val1 BYTE 10h,20h,30h
.code
mov esi,OFFSET val1 ; ESI = the address of Val1
mov al,[esi] ; AL = 10h, dereference ESI
inc esi
mov al,[esi] ; AL = 20h
inc esi
mov al,[esi] ; AL = 30h
.data
myCount WORD 0
.code
mov esi,OFFSET myCount
inc [esi] ; error: ambiguous
inc WORD PTR [esi] ; ok
• Indexed operands
o An indexed operand adds a constant to a register to generate an effective address. There
are two notational forms:
[label + reg] label[reg]
.data
arrayW WORD 1000h,2000h,3000h
.code
mov esi,0
mov ax, [arrayW + esi] ; AX = 1000h
mov ax, arrayW[esi] ; alternate format
add esi,2
add ax,[arrayW + esi] ; AX = 2000h
• Index Scaling
o You can scale an indirect or indexed operand to the offset of an array element
o This is done by multiplying the index by the array's TYPE
.data
arrayB BYTE 0,1,2,3,4,5
arrayW WORD 0,1,2,3,4,5
arrayD DWORD 0,1,2,3,4,5
.code
mov esi,4 ; ESI = index of array
mov al,arrayB[esi*TYPE arrayB] ; AL = 04h
mov bx,arrayW[esi*TYPE arrayW] ; BX = 0004h
mov edx,arrayD[esi*TYPE arrayD] ; EDX = 00000004h
• Pointers
o Declare a pointer variable that contains the offset of another variable
.data
arrayW WORD 1000h,2000h,3000h
ptrW DWORD arrayW ; ptrW (pointer variable)
.code
mov esi,ptrW
mov ax,[esi] ; AX = 1000h
o Alternate format:
ptrW DWORD OFFSET arrayW ; ptrW = Offset (address) of arrayW
• JMP Instruction
o JMP is an unconditional jump to a label that is usually within the same procedure
o Syntax: JMP target
o Logic: EIP ← target
• JMP Example
top:
.
.
jmp top
• LOOP Instruction
o The LOOP instruction creates a counting loop
o Syntax: LOOP target
o Logic:
First, ECX ← ECX – 1
Next, if ECX != 0, jump to target
o Implementation:
The assembler calculates the distance, in bytes, between the offset of the following
instruction and the offset of the target label. It is called the relative offset
The relative offset is added to EIP.
• LOOP Example
o Add 1 to AX each time the loop repeats
o When the loop ends, AX = 5 and ECX = 0
mov ax, 0
mov ecx,5
L1:
add ax
loop L1
.data
count DWORD ?
.code
mov ecx,100 ; set outer loop count
L1:
mov count,ecx ; save outer loop count
mov ecx,20 ; set inner loop count
L2:
.
.
loop L2 ; repeat the inner loop
mov ecx,count ; restore outer loop count
loop L1 ; repeat the outer loop
INCLUDE Irvine32.inc
.data
intarray WORD 100h,200h,300h,400h
.code
main PROC
exit
main ENDP
END main
INCLUDE Irvine32.inc
.data
source BYTE "This is the source string",0
target BYTE SIZEOF source DUP(0),0
.code
main PROC
exit
main ENDP
END main
• Data Transfer
o MOV – data transfer from source to destination
o MOVSX, MOVZX, XCHG
• Operand types
o direct, direct-offset, indirect, indexed
• Arithmetic instructions
o INC, DEC, ADD, SUB, NEG
• Status Flags
o Sign, Carry, Auxiliary Carry, Zero, and Overflow flags
• Operators
o OFFSET, PTR, TYPE, LENGTHOF, SIZEOF
• Loops
o JMP and LOOP – branching instructions