Questions tagged [att]

AT&T Syntax is an assembly syntax used in UNIX environments, that originates from AT&T Bell Labs. It is descended from PDP-11 assembly syntax.

AT&T Syntax is an assembly syntax used mostly in UNIX environments or by tools like gcc that originated in that environment. GNU (gcc/binutils) chose AT&T syntax for compatibility with AT&T Bell Labs' Unix assembler syntax for 386. That in turn based its syntax design on the PDP-11 PAL-11 assembler. (See also: Questions about AT&T x86 Syntax design and What was the original reason for the design of AT&T assembly syntax?)

It's used by the GNU assembler, and some compatible tools like clang's built-in assembler. These tools all also use GNU assembler directives like .globl main and .byte 0x12 instead of db 12h. See the GAS manual.

Most tools that default to AT&T syntax have options to use MASM-like GNU Intel Syntax. gcc -masm=intel -S or objdump -drwC -Mintel. Or in GAS, .intel_syntax noprefix is a directive. See the tag wiki.

See also the tag wiki for more about the x86 architecture and assembly in general. See the tag wiki for more about GNU C inline asm.


x87 syntax design bug / incompatibility with Intel syntax:

AT&T syntax reverses the mnemonics for fsubr and fsub, and other non-commutative x87 instructions like fdivr, when the destination is %st(i). See the GAS manual entry. Tools like objdump -d that disassemble in AT&T syntax are also compatible with this mnemonic -> opcode mapping. See also Objdump swapping fsubrp to fsubp on compiled assembly?

Modern version of objdump -d -Mintel use the Intel-syntax interpretation of the mnemonics as expected. (Editor's note: I seem to recall older versions of objdump and/or GAS in Intel-syntax mode still using the AT&T bug-compatible mnemonics.)


Syntax details

Operands are in destination-last order, the reverse of Intel syntax (used in Intel/AMD manuals). For example pshufd $0xE4, %xmm0, %xmm1 shuffles xmm0 and puts the result into xmm1. (Intel syntax pshufd xmm1, xmm0, 0E4h. To translate to/from Intel syntax, always reverse the list of operands.

Register names are prefixed with %, and immediates are prefixed with $. Operand-size is indicated with a b/w/l/q suffix on the mnemonic, but is optional if it's not implied by a register operand, the same way that dword or dword ptr is optional in NASM. Addressing modes use a totally different syntax, disp(base, idx, scale)

Examples:

  • sub $24, %rsp reserves 24 bytes on the stack.
  • mov foo, %eax is a load from the address of symbol foo.
  • mov $foo, %rax puts that address in %rax (mov-imm32)
  • lea foo(%rip), %rax (64-bit mode only) RIP-relative addressing mode for PIC (position-independent) code. (How to load address of function or label into register in GNU Assembler and what does "mov offset(%rip), %rax" do?)
  • movabs $0x123456789ABCDEF, %rax the imm64 or 64-bit absolute memory address forms of mov use the movabs mnemonic in AT&T syntax.
  • imul $13, 16(%rdi, %rcx, 4), %eax 32-bit load from rdi + rcx<<2 + 16, multiply that by 13, put the result in %eax. Intel imul eax, [16 + rdi + rcx*4], 13.
  • addb $1, byte_table(%rdi) increment a byte in a static table. (disp32+base addressing mode, so this is technically not an indexed addressing mode). Operand-size suffix is mandatory here, because neither operand is a register to imply a size.
  • addl $1, dword_table(, %rdi, 4) increment a dword in a static table. (disp32 + scaled-index addressing mode with no base register).
  • movswl (%rdi), %eax sign-extending load from word (w) to dword (l). Intel movsx eax, word [rdi]. AT&T needs different mnemonics for each source size of movzx / movsx. What does the MOVZBL instruction do in IA-32 AT&T syntax? and what does movsbl instruction do?.
  • cltq = cdqe in Intel, cltd = cdq. They (and related instructions for other sizes) sign extend within eax/rax or from eax into edx:eax (or rax into rdx:rax). The GNU assembler accepts the more-readable Intel mnemonics where the within-rax version always ends with e (except for cbw). See What does cltq do in assembly?.


Canonical Q&As:

1033 questions
7
votes
3 answers

Declaring Arrays In x86 Assembly

I am learning Assembly and I need to make a large array. I have looked around at how to declare arrays and I have come across this. array db 10 dup(?) Where an array of 10 uninitialized bytes is declared. I tried this and tried to assemble it and…
CMilby
  • 624
  • 1
  • 6
  • 23
7
votes
3 answers

gas: too many memory reference

When compiling the following instruction: movl 4(%ebp), 8(%ebp) I got: too many memory reference. What's wrong with it?
freenight
  • 163
  • 1
  • 1
  • 5
7
votes
3 answers

xorl %eax - Instruction set architecture in IA-32

I am experiencing some difficulties interpreting this exercise; What does exactly xorl does in this assembly snippet? C Code: int i = 0; if (i>=55) i++; else i--; Assembly xorl ____ , %ebx cmpl ____ , %ebx Jel .L2 ____ %ebx .L2: ____…
Hélder Moreira
  • 181
  • 1
  • 1
  • 9
7
votes
2 answers

How to translate "pushl 2000" from AT&T asm to Intel syntax on i386

I'm trying to translate the following from AT&T assembly to Intel assembly: pushl 2000 Now this compiles down to: ff 35 d0 07 00 00 pushl 0x7d0 But no matter what I try, I cannot get the same in Intel synax, I've tried: intel…
Sverre Rabbelier
  • 1,456
  • 2
  • 16
  • 22
6
votes
2 answers

what is jmpl instruction in x86?

x86 assembly design has instruction suffix, such as l(long), w(word), b(byte). So I thought that jmpl to be long jmp But it worked quite weird when I assemble it: Test1 jmp: assembly source, and disassembly main: jmp main eb fe jmp 0x0804839b…
Jiwon
  • 1,074
  • 1
  • 11
  • 27
6
votes
2 answers

Assembly executing a long jump with an offset with different syntax

I am writing a GDT for a Kernel and all is going well, I'm following this tutorial. http://www.osdever.net/bkerndev/Docs/gdt.htm When link the C code to the assembly code he uses this piece of code. ; This will set up our new segment registers. We…
user5930979
6
votes
2 answers

Calculating padding length with GAS AT&T directives for a boot sector?

So I want to add padding in the bootsector. Let's say, there is currently just an endless loop in there: jmp .. The sector needs to be 512 bytes long. Also, the magic num 0xaa55 is needed which is added at the end. jmp . .skip 508, 0 .word…
6
votes
1 answer

Division in x86 Assembly GAS

Im not quite sure yet how division works in x86 assembly (GAS AT&T syntax). What i wanna do is to divide two longs, and then multiply the quotient with the divisor to see if the new number is equal to the initial number (n/m * m = n). movl %ebx,…
mmoe
  • 95
  • 1
  • 2
  • 7
6
votes
1 answer

struct allocation in x86 assembly

So I'm trying to write some x86 to allocate memory for a struct. My c code looks like this... struc *uno = malloc(sizeof(struc)); uno->first = 0; uno->second = 0; uno->third = 0; //And the struct struct struc { int first; …
user3474256
6
votes
2 answers

Chosing suffix (l-b-w) for mov instruction

I am new to assembly.I am reading computers system programmer's perspective. I don't understand how I choose suffix for mov instruction. I know each register and bit count. Suffix usage is determined by bit count (32 bit l, 16 bit w, 8 bit b). Few…
Melih Altıntaş
  • 2,495
  • 1
  • 22
  • 35
6
votes
3 answers

Understanding C disassembled call

I want to learn about C calling convention. To do this I wrote the following code: #include #include struct tstStruct { void *sp; int k; }; void my_func(struct tstStruct*); typedef struct tstStruct strc; int…
user2290802
  • 253
  • 2
  • 7
6
votes
2 answers

How much space is allocated by subtracting from %esp in a function call?

C++, ATT Assembly I have the following assembly code: push %ebp mov %esp, %ebp sub $0x28, %esp (...) My textbook claims that by subtracting 0x28 from the %esp (as part of the formation of the stack), 12 bytes get allocated for variables. Why does…
amorimluc
  • 1,661
  • 5
  • 22
  • 32
5
votes
2 answers

64 bit assembly on Mac OS X runtime errors: "dyld: no writable segment" and "Trace/BPT trap"

When attempting to run the following assembly program: .globl start start: pushq $0x0 movq $0x1, %rax subq $0x8, %rsp int $0x80 I am receiving the following errors: dyld: no writable segment Trace/BPT trap Any idea what could be…
Hawken
  • 2,059
  • 19
  • 34
5
votes
2 answers

"call" after switching to Protected Mode

I'm trying to switch to the protected mode in intel x86. I've loaded my gdt with lgdt, set the P flag of cr0 to 1 and all the segments selectors but when I return from the function call, I can't call any other function or I get this error qemu:…
marmottus
  • 351
  • 1
  • 3
  • 18
5
votes
1 answer

Forcing a JMP rel32

If I do something like (dummy example): jmp 1f 1: ret on gcc/clang it generates a short relative jump because the label is near. I'm curious, is it possible to force a JMP rel32 regardless of the label's distance?
Petr Skocik
  • 58,047
  • 6
  • 95
  • 142