X86 Assembly and

Disassembly
Prof. John Cole
Computer Science Department
The University of Texas at Dallas
 What We Will Cover
• Basic x86 register model
• Instruction set
• Addressing modes
• Diassembling code

x86 Assembly and Disassembly 2

 Assumed Background Knowledge
• Basics of computer architecture, but not necessarily Intel
• Understanding of binary and hexadecimal
• Ability to program in C/C++

x86 Assembly and Disassembly 3

 About the x86 Architecture
• These processors have many, often complex, instructions
• They contain essentially two separate instruction sets: the original
8086, plus extended 32-bit instructions
• We won’t cover the x64 architecture, but it is even more complex and
interesting
• Floating point operations are done by a separate processor core on
the chip, and will not be covered in this talk

x86 Assembly and Disassembly 4

 About the x86 Architecture
• CISC vs. RISC
• The x86 family are not RISC machines
• They have complex instructions that can do a lot in relatively few
clock cycles if you know how to use them
• Instructions are variable length

x86 Assembly and Disassembly 5

 Register Model
• 8-bit 8080 Registers:
• A, B, C, D, E (H and L registers were not included)
• 16-bit 8086 Registers:
• AX, BX, CX, DX, EX
• 8-bit counterparts: AH, AL, etc.
• SI and DI index registers
• Segment registers: DS, ES, SS, CS
• Stack registers: SP and BP

x86 Assembly and Disassembly 6

 Register Model
• 32-bit registers (80386 and later)
• EAX, EBX, ECX, EDX, EEX
• ESI, EDI
• ESP, EBP
• Segment registers: CS, DS, ES, SS, FS, and GS

x86 Assembly and Disassembly 7

 Status Flags
• The status flags are stored in what appears to the programmer as a
register. They are:
• Overflow: Result exceeds positive or negative limit of number range
• Sign: Result is negative
• Zero: Result is zero
• Carry: Carry out of most significant bit of result
• Auxiliary Carry: Carry out of bit position 3, used for BCD
• Parity: Low byte of result has even number of bits set

x86 Assembly and Disassembly 8

 Instruction Format
• Machine instructions have the following format:
• Prefix
• Opcode
• Register specifier
• Addressing-mode specifier
• SIB (Scale, Index, Base) byte
• Displacement
• Immediate operands
• Not all instructions have all of these. The only required element is the
opcode

x86 Assembly and Disassembly 9

 Operand Selection
• All operations affect the state of the processor
• Most have some operand, explicit or implicit, that gets changed
• Operand locations:
• Immediate, contained in the instruction
• In a register
• In memory
• At an I/O port

x86 Assembly and Disassembly 10

 Operand Selection
• Implicit and explicit operands
• Some instructions, like AAM, always operate on the same register (AX in this
case)
• Most require you to specify the operands, such as XCHG EAX, EBX
• Some, such as PUSH AX, have both. It explicitly puts AX on top of the stack,
and implicitly changes the stack pointer and the contents of memory.
• Many instructions have implicit operands, such as arithmetic
instructions that change the contents of the flags

x86 Assembly and Disassembly 11

 Operands
• For most instructions, one of the two explicitly specified operands
may be in either a register or memory. The other operand must be in
a register or it must be an immediate source operand.
• Explicit two-operands instructions fall into these groups:
• Register to register
• Register to memory
• Memory to register
• Immediate to register
• Immediate to memory

x86 Assembly and Disassembly 12

 Immediate Operands
• Some instructions use data from within the instruction as one, or
sometimes two, of the operands
• This may be a byte, a word, or a doubleword
• For example:
SHR EAX,2
• Shifts the EAX register right two bits
IMUL CX,MEMWORD,3
• Multiplies the contents of MEMWORD by 3 and puts the result in CX

x86 Assembly and Disassembly 13

 Memory Models
• Flat memory model maps different logical segments to one physical
address space. That is, all segment registers map to the same place in
physical memory.
• Segmented memory model maps different logical segments to
different address space in physical memory
• The segment registers (CS, DS, ES, SS, FS, and GS) hold 16-bit pointers
to a table in memory that holds the base address of the segment and
other information about it.

x86 Assembly and Disassembly 14

 Segment Selection
• You can optionally specify a segment for memory operands in many
instructions
• If you don’t, the following rules apply:
• Instruction use the CS (Code Segment) register
• The stack uses the SS (Stack Segment) register
• Local data uses the DS (Data Segment) register
• Destination for some string instructions uses the ES (Extra Segment) register
• You can use segment override prefixes
• You cannot override instruction fetch, the stack, or destination strings

x86 Assembly and Disassembly 15

 Effective Address Computation
• The ModR/M (Mode: Register or Memory) byte provides the most
flexible form of addressing
• Instructions which have the ModR/M byte after the opcode are the
most common in the x86 instruction set
• For memory operands specified in this mode, the offset within the
selected segment is the sum of 3 components:
• A displacement
• A base register
• An index register, which may be multiplied by a factor of 2, 4, or 8

x86 Assembly and Disassembly 16

 Addressing Modes
• Displacement
• Base
• Base + displacement
• (Index * scale) + displacement
• Base + index + displacement
• Base + (index * scale) + displacement

x86 Assembly and Disassembly 17

 Data Element Sizes
• Byte: 8-bit quantity, signed or unsigned
• Word: 16-bit quantity, usually signed
• DWORD: 32 bits, usually signed

x86 Assembly and Disassembly 18

 Visual Studio C Runtime Source
• You can look at source code and disassembly of much of the C++
runtime, including initialization
• For VS2019, it’s here:
C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\
Tools\MSVC\14.16.27023\crt\src\vcruntime

x86 Assembly and Disassembly 19

 Inline Assembly in MS Visual C++
• You can use the keyword _asm followed by an assembly-language
instruction
• You can also use _asm { } and put a group of assembly-language
instructions in the braces
• Variables declared in your program are accessible by name from
within your assembly code
• Things that are hard to do in some languages, such as checking for
overflow, are relatively easy in assembly

x86 Assembly and Disassembly 20

 Instruction Set
• I’ll explain instructions as we go through disassembly, since it would
be impossible to cover the entire set in one lecture

x86 Assembly and Disassembly 21