31

In a disassembled program I'm analyzing, I found the command

sar %eax

What does this do? I know that sar with two arguments performs a right shift, but I can't find what it means with only one parameter.

This program was compiled for an Intel x86 processor.

Kevin
  • 14,655
  • 24
  • 74
  • 124

2 Answers2

34

Looks like the dissembler used short-hand for SAR EAX,1 which has an opcode of 0xD1F8. when the immediate is not 1, aka SAR EAX,xx, the opcode is 0xC1F8 xx, see the Intel Instruction reference, Vol. 2B, 4-353.

Necrolis
  • 25,836
  • 3
  • 63
  • 101
7

When there is only one operand the implied shift is 1.

So....

SAR %EAX implies signed %EAX >> 1

therefor,

SAR %eax = SAR $1, %eax

I have successfully proven this analyzing some code in GDB.

Peter Cordes
  • 328,167
  • 45
  • 605
  • 847
Siri
  • 106
  • 1
  • 2
  • 4
    What part of the other answer is wrong? It says `used short-hand for SAR EAX,1` . The other answer represented the output as Intel syntax rather than AT&T but the answer seems okay. The x86 has a special short encoding for the 4 shift instructions that can be used with no 2nd operand or you can encode the value 1 as a 2nd operand which is a longer instruction that does the same thing. – Michael Petch Oct 07 '17 at 23:11
  • Fortunately `gas` will optimize `sar $1, %eax` into the implicit by-one opcode, so you don't get inefficient code if you write it that way. And BTW, there are also by-one short forms of `ror`, `rol`, `rcl`, and `rcr`, as well as `shl` (aka `sal`), `shr`, and `sar`. But not `shrd`, that was added later with only imm8/cl versions. – Peter Cordes Oct 08 '17 at 02:05