Assembly Guide — Common Instructions and Operations

In this tutorial, you will learn about Assembly Guide. We cover key concepts, practical examples, and best practices to help you master this topic.

x86-64 instructions are categorized into data movement (mov, push, pop), arithmetic (add, sub, mul, div), logic (and, or, xor), and control flow (jmp, jcc, call, ret) operations.

What You'll Learn

• Data movement instructions
• Arithmetic and logic operations
• Control flow instructions
• Shift and rotate operations
• String instructions

Why It Matters

Instructions are the building blocks of all programs. Understanding them enables optimization, reverse engineering, and low-level debugging. Durga Antivirus Pro traces instructions during malware analysis.

Real-World Use

Operating system kernels, device drivers, embedded firmware, and performance-critical algorithms.

flowchart LR
    A["Instructions"] --> B["Data Movement"]
    B --> C["Arithmetic"]
    C --> D["Control Flow"]
    D --> E["String Ops"]
    A:::current --> B
    style A fill:#2563eb,stroke:#2563eb,color:#fff
    style B fill:#dbeafe,stroke:#2563eb,color:#1e40af
    style C fill:#dbeafe,stroke:#2563eb,color:#1e40af
    style D fill:#dbeafe,stroke:#2563eb,color:#1e40af
    style E fill:#f1f5f9,stroke:#94a3b8,color:#64748b

Data Movement

; mov: copy data
mov rax, rbx        ; Register to register
mov rax, [rbx]      ; Memory to register
mov [rbx], rax      ; Register to memory
mov rax, 42         ; Immediate to register
mov [rbx], 42       ; Immediate to memory

; movzx: move with zero-extension
movzx rax, byte [rbx]   ; Zero-extend byte to 64-bit

; movsx: move with sign-extension
movsx rax, byte [rbx]   ; Sign-extend byte to 64-bit

; xchg: exchange values
xchg rax, rbx       ; Swap RAX and RBX

Arithmetic

; Addition
add rax, rbx        ; RAX = RAX + RBX
add rax, 5          ; RAX = RAX + 5
inc rax             ; RAX = RAX + 1

; Subtraction
sub rax, rbx        ; RAX = RAX - RBX
sub rax, 5          ; RAX = RAX - 5
dec rax             ; RAX = RAX - 1

; Multiplication
mul rbx             ; RDX:RAX = RAX * RBX (unsigned)
imul rbx            ; RDX:RAX = RAX * RBX (signed)
imul rax, rbx, 5    ; RAX = RBX * 5

; Division
div rbx             ; RAX = RDX:RAX / RBX, RDX = remainder (unsigned)
idiv rbx            ; Same for signed

Logic Operations

; Bitwise AND
and rax, rbx        ; RAX = RAX & RBX
and rax, 0xFF       ; Keep only lowest byte

; Bitwise OR
or rax, rbx         ; RAX = RAX | RBX
or rax, 0x100       ; Set bit 8

; Bitwise XOR
xor rax, rbx        ; RAX = RAX ^ RBX
xor rax, rax        ; Zero RAX (common idiom)

; NOT
not rax             ; RAX = ~RAX

; TEST (AND without storing)
test rax, rbx       ; Sets flags based on RAX & RBX
test rax, rax       ; Check if RAX is zero/negative

Shift and Rotate

; Shift left
shl rax, 3          ; RAX = RAX << 3 (multiply by 8)
shl rax, cl         ; Shift by CL register

; Shift right (logical)
shr rax, 4          ; RAX = RAX >> 4 (unsigned divide by 16)

; Shift right (arithmetic)
sar rax, 4          ; Preserves sign bit

; Rotate
rol rax, 8          ; Rotate left 8 bits
ror rax, 8          ; Rotate right 8 bits

; Shift example
; Multiply by 10: RAX * 10 = RAX * 8 + RAX * 2
lea rax, [rax + rax*4]  ; RAX *= 5
shl rax, 1              ; RAX *= 2 (result: *10)

Control Flow

; Unconditional jump
jmp label

; Conditional jumps (based on flags)
je label    ; Jump if equal (ZF=1)
jne label   ; Jump if not equal (ZF=0)
jg label    ; Jump if greater (signed)
jl label    ; Jump if less (signed)
jge label   ; Jump if greater or equal
jle label   ; Jump if less or equal
ja label    ; Jump if above (unsigned)
jb label    ; Jump if below (unsigned)
jz label    ; Jump if zero (same as je)
jnz label   ; Jump if not zero

; Compare (sets flags, like sub without storing)
cmp rax, rbx

String Instructions

; rep: repeat prefix
; movsb/movsw/movsd/movsq: move string
; cld: clear direction flag (forward)
; std: set direction flag (backward)

; Copy ECX bytes from [RSI] to [RDI]
cld
rep movsb

; Compare strings
repe cmpsb          ; Compare until mismatch or ECX=0

; Scan for value
repne scasb         ; Scan for AL in [RDI]

Common Mistakes

1. DIV/IDIV operand confusion

div rbx divides RDX:RAX by RBX, not just RAX. Zero-extend or sign-extend RAX first.

2. MUL destination fixed

mul always uses RAX and stores to RDX:RAX. You can't choose a different destination.

3. Flag side effects

Arithmetic instructions modify flags. Don't assume flags survive across unrelated instructions.

4. Shift count limitation

Shift counts are masked to 6 bits (0-63). Shift beyond 63 is modulo 64.

5. String instruction direction

Always set direction with cld/std before using string instructions. Default is forward (cld).

Practice Questions

1. How do you zero a register? Best: xor rax, rax (smaller encoding). Also: mov rax, 0 or sub rax, rax.

2. What does mul rbx do? Multiplies RAX by RBX. Result goes to RDX:RAX (high 64 bits in RDX, low in RAX).

3. How do conditional jumps work? They check specific flags (ZF, SF, CF, OF) set by a previous cmp or arithmetic instruction.

Challenge: Write assembly that computes n * 10 using only shifts and additions.

FAQ

{{< faq question="What is the fastest way to zero a register?" >} xor reg, reg is the fastest. It's recognized by the CPU as a zeroing idiom with register renaming. {{< /faq >}}

{{< faq question="What does test do?" >} test performs AND without storing the result, only setting flags. Used for checking if a value is zero. {{< /faq >}}

{{< faq question="When would I use SAR vs SHR?" >} SAR (arithmetic shift right) preserves the sign bit. Use for signed division by powers of 2. SHR for unsigned. {{< /faq >}}

{{< faq question="Can I multiply by a constant other than power of 2?" >} Yes. Use LEA for common constants, or multiply and add: x10 = x8 + x*2. {{< /faq >}}

{{< faq question="What is the difference between JMP and CALL?" >} JMP is unconditional transfer. CALL pushes return address first. RET pops and returns to that address. {{< /faq >}}

Mini Project

Implement a simple arithmetic expression evaluator:

; Compute: result = (a * b) + (c / d) - e
; Args: RDI=a, RSI=b, RDX=c, RCX=d, R8=e

compute:
    mov rax, rdi        ; rax = a
    imul rax, rsi       ; rax = a * b
    push rax            ; Save product

    mov rax, rdx        ; rax = c
    xor rdx, rdx        ; Clear RDX for division
    idiv rcx            ; rax = c / d, rdx = remainder

    pop rbx             ; rbx = a * b
    add rax, rbx        ; rax = (a*b) + (c/d)
    sub rax, r8         ; rax = result - e
    ret

What's Next

Now that you understand instructions, explore conditional execution and branching.