Show Menu
Cheatography

x86 assembly (DRAFT) by

This is a draft cheat sheet. It is a work in progress and is not finished yet.

Jump Instru­ctions

JZ Jump if zero ZF = 1
JNZ Jump if not zero ZF = 0
JC Jump if carry CF = 1
JNC Jump if not carry CF = 0
JO Jump if overflow OF = 1
JNO Jump if not overflow OF = 0
JS Jump if signed SF = 1
JNS Jump if not signed SF = 0
JP Jump if parity (even) PF = 1
JNP Jump if not parity (odd) PF = 0

Data Types

BYTE 8-bit unsigned integer.
SBYTE 8-bit signed integer.
WORD 16-bit unsigned integer
SWORD 16-bit signed integer
DWORD 32-bit unsigned integer.
SDWORD 32-bit signed integer.

Arrays - (from book pg 120-124)

.data
    arrayB BYTE 10h,20h,30h 
.code
    mov ESI,OFFSET arrayB 
    mov AL,[ESI]
    inc ESI
--------OFFSET-------------
.data
    arrayW WORD 1000h,2000h,3000h
.code
    mov ESI,OFFSET arrayW
    mov AX,[ESI]

LOOP

.data
    mov ax,0
    mov ecx,5
.code
    L1:
        inc ax 
    loop L1

ASCII

CMP Instru­ction

Compares the destin­ation operand to the source operand
Nondes­tru­ctive subtra­ction of source from destin­ation (desti­nation operand is not changed) Syntax: CMP destin­ation, source.
destin­ation < source ....carry flag set
destin­ation > source.... ZF=0, CF=0
 

Registers

32-Bit
16-Bit
8-bit (high)
8 bit (low)
EAX
AX
AH
AL
EBX
BX
BH
BL
ECX
CX
CH
CL
EDX
DX
DH
DL
ESI
SI
EDI
DI
EBP
BP
ESP
SP

FLAGS

• The Carry flag (CF) is set when the result of an unsigned arithmetic operation is too large to fit into the destin­ation.
• The Overflow flag (OF) is set when the result of a signed arithmetic operation is too large or too small to fit into the destin­ation.
• The Sign flag (SF) is set when the result of an arithmetic or logical operation generates a negative result.
• The Zero flag (ZF) is set when the result of an arithmetic or logical operation generates a result of zero.
• The Auxiliary Carry flag (AC) is set when an arithmetic operation causes a carry from bit 3 to bit 4 in an 8-bit operand.
• The Parity flag (PF) is set if the least-­sig­nif­icant byte in the result contains an even number of 1 bits. Otherwise, PF is clear. In general, it is used for error checking when there is a possi- bility that data might be altered or corrupted.

TEST Instru­ction

Performs a nondes­tru­ctive AND operation between each pair of matching bits in two operan­ds.No operands are modified, but the Zero flag is affected.
Example: jump to a label if either bit 0 or bit 1 in AL is set.
test al,000­00011b
jnz ValueFound

ROT SHIFT

SAL (shift arithmetic left) is identical to SHL.
SAR (shift arithmetic right) performs a right arithmetic shift on the destin­ation operand.
ROL (rotate) shifts each bit to the left
The highest bit is copied into both the Carry flag and into the lowest bit
No bits are lost
ROR (rotate right) shifts each bit to the right
The lowest bit is copied into both the Carry flag and into the highest bit
No bits are lost
RCL (rotate carry left) shifts each bit to the left
Shifts a destin­ation operand a given number of bits to the right
The bit positions opened up by the shift are filled by the least signif­icant bits of the source operand
The source operand is not affected
Copies the Carry flag to the least signif­icant bit
Copies the most signif­icant bit to the Carry flagRCR (rotate carry right) shifts each bit to the right
Copies the Carry flag to the most signif­icant bit
Copies the least signif­icant bit to the Carry flag
Shifts a destin­ation operand a given number of bits to the left
The bit positions opened up by the shift are filled by the most signif­icant bits of the source operand
The source operand is not affected
Syntax:
SHLD destin­ation, source, count

OR, XOR, AND, NOT

OR destin­ation, source. 0,0=0. 0,1=1, 1,0=1. 1,1 = 1
XOR destin­ation, source. 0,0=0. 0,1=1, 1,0=1. 1,1 = 0
NOT destin­ati­on...i­nvert all
AND destin­ation, source 0,0=0. 0,1=0, 1,0=0. 1,1 = 1
 

Procedures

SumOf PROC
    add EAX, EBX 
    add EAX, ECX 
    ret
SumOf ENDP
END main

Irvine 32 lib procedures

DumpMemm                               
  mov ESI,OFFSET array                
  mov ECX,LENGTHOF array        
  mov EBX,TYPE array 
  call DumpMem

ReadChar                                       
    char BYTE ?                              
    .code                                        
    call ReadChar                        
    mov  char, AL       

Random32
  call Random32 
  mov randVal, EAX

ReadDec   ;same for dec, hex, int
  intVal DWORD ?
.code
  call ReadDec
  mov  intVal,eax      

ReadString
.data
  buffer BYTE 21 DUP(0)             ; input buffer
  byteCount DWORD ?                ; holds counter
.code
  mov EDX,OFFSET buffer         ; point to the buffer
  mov ECX,SIZEOF buffer          ; specify max characters
  call ReadString                         ; input the string
  mov byteCount, EAX                ; number of characters
              
WriteChar
  mov AL, 'A'
  call WriteChar

WriteDec,hex,int
  mov eax,295
  call WriteDec

WriteString
  .data
  prompt BYTE "Enter your name: ",0 .code
  mov edx,OFFSET prompt
  call WriteString

Unsigned Comparison

PUSHAD POPAD

The PUSHAD instru­ction pushes all of the 32-bit genera­l-p­urpose registers on the stack in the following order: EAX, ECX, EDX, EBX, ESP (value before executing PUSHAD), EBP, ESI, and EDI.The POPAD instru­ction pops the same registers off the stack in reverse order.

Signed

MUL IMUL

In 32-bit mode, MUL (unsigned multiply) instruction multiplies an 8-, 16-, or 32-bit operand by either AL, AX, or EAX
.data
val1 WORD 2000h
val2 WORD 100h
.code
mov ax,val1
mul val2	; DX:AX = 00200000h, CF=1

IMUL (signed integer multiply ) multiplies an 8-, 16-, or 32-bit signed operand by either AL, AX, or EAX
Preserves the sign of the product by sign-extending it into the upper half of the destination register

mov eax,4823424
mov ebx,-423
imul ebx	; EDX:EAX = FFFFFFFF86635D80h, OF=0