Questions tagged [x86]

x86 is an architecture derived from the Intel 8086 CPU. The x86 family includes the 32-bit IA-32 and 64-bit x86-64 architectures, as well as legacy 16-bit architectures. Questions about the latter should be tagged [x86-16] and/or [emu8086]. Use the [x86-64] tag if your question is specific to 64-bit x86-64. For the x86 FPU, use the tag [x87]. For SSE1/2/3/4 / AVX* also use [sse], and any of [avx] / [avx2] / [avx512] that apply

The x86 family of CPUs contains 16-, 32-, and 64-bit processors from several manufacturers, with backward-compatible instruction sets, going back to the Intel 8086 introduced in 1978.

There is an tag for things specific to that architecture, but most of the info here applies to both. It makes more sense to collect everything here. Questions can be tagged with either or both. Questions specific to features only found in the x86-64 architecture, like RIP-relative addressing, clearly belong in x86-64. Questions like "how to speed up this code with vectors or any other tricks" are fine for x86, even if the intention is to compile for 64bit.

Related tag with tag-wikis:

  • wiki (some good SIMD guides), and (not much there)
  • wiki for guides specific to interfacing with a compiler that way.
  • wiki and wiki have more details about the differences between the two major x86 assembly syntaxes. And for Intel, how to spot which flavour of Intel syntax it is, like NASM vs. MASM/TASM.

Learning resources


Guides for performance tuning / optimisation:

Instruction set / asm syntax references:

OS-specific stuff: ABIs and system-call tables:






  • 16bit interrupt list: PC BIOS system calls (int 10h / int 16h / etc, AH=callnumber), DOS system calls (int 21h/AH=callnumber), and more.

memory ordering:

Specific behaviour of specific implementations

Q&As with good links, or directly useful answers:


FAQs / canonical answers:

If you have a problem involving one of these issues, don't ask a new question until you've read and understood the relevant Q&A.

(TODO: find better question links for these. Ideally questions that make a good duplicate target for new dups. Also, expand this.)


How to get started / Debugging tools + guides

Find a debugger that will let you single-step through your code, and display registers while that happens. This is essential. We get many questions on here that are something like "why doesn't this code work" that could have been solved with a debugger.

On Windows, Visual Studio has a built-in debugger. See Debugging ASM with Visual Studio - Register content will not display. And see Assembly programming - WinAsm vs Visual Studio 2017 for a walk-through of setting up a Visual Studio project for a MASM 32-bit or 64-bit Hello World console application.

On Linux: A widely-available debugger is gdb. See Debugging assembly for some basic stuff about using it on Linux. Also How can one see content of stack with GDB?

There are various GDB front-ends, including GDBgui. Also guides for vanilla GDB:

With layout asm and layout reg enabled, GDB will highlight which registers changes since the last stop. Use stepi to single-step by instructions. Use x to examine memory at a given address (useful when trying to figure out why your code crashed while trying to read or write at a given address). In a binary without symbols (or even sections), you can use starti instead of run to stop before the first instruction. (On older GDB without starti, you can use b *0 as a hack to get gdb to stop on an error.) Use help x or whatever for help on any command.

GNU tools have an Intel-syntax mode that's similar to MASM, which is nice to read but is rarely used for hand-written source (NASM/YASM is nice for that if you want to stick with open-source tools but avoid AT&T syntax):

Another key tool for debugging is tracing system calls. e.g. on a Unix system, strace ./a.out will show you the args and return values of all the system calls your code makes. It knows how to decode the args into symbolic values like O_RDWR, so it's much more convenient (and likely to catch brain-farts or wrong values for constants) than using a debugger to look at registers before/after an int or syscall instruction. Note that it doesn't work correctly on Linux int 0x80 32-bit ABI system calls in 64-bit processes: What happens if you use the 32-bit int 0x80 Linux ABI in 64-bit code?.

To debug boot or kernel code, boot it in Bochs, qemu, or maybe even DOSBox, or any other virtual machine / simulator / emulator. Use the debugging facilities of the VM to get way better information than the usual "it locks up" you will experience with buggy privileged code.

Bochs is generally recommended for debugging real-mode bootloaders, especially ones that switch to protected mode; Bochs's built-in debugger understands segmentation (unlike GDB), and can parse a GDT, IDT, and page tables to make sure you got the fields right.

For DOS programs, see the x86-16 tag wiki for debuggers that run inside the guest, and thus can debug a specific DOS program maybe more easily than Bochs for the whole system.


REPL (Read Eval Print Loop) environments for typing an instruction and seeing what it does to register values. Maybe only useful for user-space, perhaps not osdev stuff.

16952 questions
8
votes
1 answer

How many XMM registers are available on an x86 processor supporting SSE?

How to find out the number of XMM registers on a processor which supports SSE? On Intel X5550, for example.
klm123
  • 12,105
  • 14
  • 57
  • 95
7
votes
1 answer

c pointers - warning format '%x' expects arguments of type 'unsigned int'

I'm currently reading Hacking the art of exploitation and there is an example on there that I cannot seem to get correct. Attempting to compile results in the error: ./addressof.c: In function ‘main’: ./addressof.c:8:4: warning: format ‘%x’ expects…
bigl
  • 1,063
  • 3
  • 13
  • 23
7
votes
1 answer

How to map 1GB (or more) of physical memory under a 32-bit Linux kernel

I have a setup with 2GB of memory and I would like to map 1GB (or more) of physical memory into user space virtual address. It is in theory possible since with 32-bit setup, 3GB of virtual address is available to user land apps. I updated the kernel…
user1259743
  • 73
  • 1
  • 3
7
votes
3 answers

operand generation of CALL instruction on x86-64 AMD

Following is the output of objdump of a sample program, 080483b4 : 80483b4: 55 push %ebp 80483b5: 89 e5 mov %esp,%ebp 80483b7: 83 ec 18 sub $0x18,%esp …
Samir Baid
  • 1,128
  • 2
  • 11
  • 20
7
votes
4 answers

Why does the mov instruction have use ax instead of two segment registers directly?

I see code like: mov ax, cs mov ds, ax mov es, ax Why can't I just compress this to: mov ds, cs mov es, cs Is the first way faster since its using the accumulator register? But that wouldn't seem intuitive since cs and ds are segment registers. Or…
samoz
  • 56,849
  • 55
  • 141
  • 195
7
votes
3 answers

Software initialization code at 0xFFFFFFF0H

Intel says after reset the processor is placed in real mode and the software initialization code starts at 0xFFFFFFF0H. My questions: If processor is in real-mode how can it acess the memory > 1MB (0xFFFFFFF0H) How this happens or what happens when…
Albert
  • 385
  • 1
  • 4
  • 17
7
votes
3 answers

Why is the compiler generating a push/pop instruction pair?

I compiled the code below with the VC++ 2010 compiler: __declspec(dllexport) unsigned int __cdecl __mm_getcsr(void) { return _mm_getcsr(); } and the generated code was: push ECX stmxcsr [ESP] mov EAX, [ESP] pop ECX retn Why is there a push…
user541686
  • 205,094
  • 128
  • 528
  • 886
7
votes
3 answers

Printing a character to standard output in Assembly x86

I'm a little confused about how to print a character to the screen using Assembly. The architecture is x86 (linux). Is it possible to call one of the C functions or is there a simpler way? The character I want to output is stored in a…
user973758
  • 707
  • 1
  • 9
  • 22
7
votes
1 answer

Why makecontext does not work with pthreads

From makecontext() manual... Due to limitations in the current pthread implementation, makecontext should not be used in programs which link against the pthread(3) library (whether threads are used or not). Now my question is, why it doesn't work…
MetallicPriest
  • 29,191
  • 52
  • 200
  • 356
7
votes
4 answers

In assembler, why does the use of registers differ between addition and subtraction?

I have a very basic doubt here. I have two very simple C codes and their assembly codes: program 1: main() { int temp1, temp2, temp3; char temp5, temp6, temp7, temp8, temp9; temp1 = 5; temp1 = 9 - temp1; } Assembly: 0x080483b4…
pkumar
  • 4,743
  • 2
  • 19
  • 21
7
votes
5 answers

Why is gcc using jmp to call a function in the optimized version

When I diassembled my program, I saw that gcc was using jmp for the second pthread_wait_barrier call when compiled with -O3. Why is it so? What advantage does it get by using jmp instead of call. What tricks the compiler is playing here? I guess…
MetallicPriest
  • 29,191
  • 52
  • 200
  • 356
7
votes
2 answers

Automated x86 instruction obfuscation

I'm working on an x86 asm obfuscator that takes Intel-syntax code as a string and outputs an equivilent set of opcodes that are obfuscated. Here's an example: mov eax, 0x5523 or eax, [ebx] push eax call someAPI Becomes something like: mov eax,…
Polynomial
  • 27,674
  • 12
  • 80
  • 107
7
votes
1 answer

Using Assembly On Mac

I'm using a MacBook Pro with an Intel Core 2 Duo processor at 2.53 GHz, but I was told Mac users must follow AT&T syntax (which adds to my confusion since I am running Intel) and x86 (not sure what this means exactly). So I need to get into assembly…
Airon Zagarella
  • 707
  • 2
  • 11
  • 17
7
votes
2 answers

Assembly Converting MOV / MOVZX and MOVSX to C code (no inline asm)

For the asm emulator i'm trying to write to convert ASM code to equivalent working code just working.. best code would be the one that can either be done in one line or two-three the most, don't care about speed. From my understanding. MOVZX would…
SSpoke
  • 5,656
  • 10
  • 72
  • 124
7
votes
1 answer

AMD DE_CFG[9] documentation

As a mitigation against the recent zenbleed vulnerability (https://lock.cmpxchg8b.com/zenbleed.html) it is advised to set DE_CFG[9] = 1. I have not manage to find anything on this MSR, except for Is LFENCE serializing on AMD processors? which…
Unlikus
  • 1,419
  • 10
  • 24
1 2 3
99
100