CS 4440 Wiki:
x86 Cheat Sheet


This page offers a brief cheat sheet of x86 Assembly fundamentals relevant to Project 2.

This page is by no means comprehensive—we encourage you to bookmark and familiarize yourself with one of the many in-depth x86 tutorials on the web. Some great examples are:


Registers

General-purpose Registers

The following are general-purpose registers: quickly-accessible locations that the CPU utilizes any time data is being operated on (e.g., for storing or reading data from).

%eax 
%ecx
%edx
%ebx
%esi
%edi

Special Registers

Below are several "special" registers critical to program execution:

%eip  // Instruction pointer (always points to the address of the next instruction).
%ebp  // Frame pointer (points to current stack frame's base); adjusted on calls/rets.
%esp  // Stack pointer (points to the top of the stack); adjusted on pushes/pops.

Instructions

Arithmetic

Below describes several common arithmetic instructions that you will likely come across:

add src,dst    // dst = dst + src
sub src,dst    // dst = dst - src
mul src,dst    // dst = dst * src
inc dst        // dst = dst + 1
dec dst        // dst = dst - 1
neg dst        // dst = -dst
not dst        // dst = ~dst

Copying Data

The following data copying operations are shown in AT&T syntax (GDB's default syntax). In Intel syntax, the src and dst operands are simply swapped.

Operands src or dst can be immediates (e.g., $0x10), registers (e.g., eax), or memory addresses.

mov src, dst   // Copies the contents of src into dst
lea src, dst   // Copies the address of src into dst

Jumps

Aside from function calls and returns, jumps are the other way of transferring control from one program location to another. Below discusses two types of jumps: unconditional (equivalent to "just go there") and conditional (equivalent to "jump there if condition X is met").

jmp label      // Unconditional jump to label
jmp *reg       // Unconditional jump to contents of register reg

cmp arg1,arg2  // Compare arg1 to arg2; must precede a conditional jump.
je label       // Conditional jump to label if arg1 == arg2.
jne label      // Conditional jump to label if arg1 != arg2.
jg label       // Conditional jump to label if arg2 > arg1.
jge label      // Conditional jump to label if arg2 >= arg1.
jl label       // Conditional jump to label if arg2 < arg1.
jle label      // Conditional jump to label if arg2 <= arg1.

Miscellaneous

Here are some other common instructions that you will likely encounter:

nop            // Short for No Op; skips-over to the next instruction.
push item      // Push item (e.g., constant, register) to stack.
pop reg        // Pop item from stack into register reg.

Functions

Calling

Function calls transfer control from the call-er (the current active function) to a call-ee (the function being invoked by the caller). When the callee returns, execution transfers back to the caller.

cal​l label     // Transfer control to the callee fun​ction named label.

Prologue Routines

The following is a common function prologue—the initial set of callee instructions that happen immediately after a call instruction transfers control from the caller.

push ebp       // Save the previous (i.e., the caller's) value of ebp.
               // When callee returns, ebp will res​et to the caller ebp.
mov esp, ebp   // U​pdate ebp to now point to the top of the stack.
sub X, esp     // Allocate X bytes of stack space for local variables.

Epilogue Routines

The following is a common function epilogue—the final set of callee instructions that cleans-up its stack frame (i.e., de-allocates the space used by local variables) immediately before a ret transfers control back to the caller. Often, this epilogue procedure is represented as the single instruction leave.

mov ebp, esp   // Reset the stack pointer to the top of the callee's frame. 
               // In other words, esp is now back to its pre-callee (caller) state.
pop ebp        // Pop frame pointer off the stack, restoring to the caller's saved ebp.
               // In other words, ebp is now back to its pre-callee (caller) state.

Returning

Following the epilogue, a return instruction is executed, transferring control from the callee back to the caller. Execution resumes in the caller at the instructiom immediately following the preceding call.

ret            // Transfer control back to the caller's next (post-call) instruction.