1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
|
Bytecode specification
----------------------
These are the bytecodes generated by x86/insn.pl into x86/insnsb.c
and consumed by asm/assemble.c and disasm/disasm.c.
Values prefixed with \ are in octal, values prefixed with \x are in
hexadecimal.
The mnemonics are the ones used in x86/insns.txt, where applicable.
Codes Mnemonic Explanation
\0 terminates the code. (Unless it's a literal of course.)
\1..\4 that many literal bytes follow in the code stream
\5 add 4 to the primary operand number (b, low octdigit)
\6 add 4 to the secondary operand number (a, middle octdigit)
\7 add 4 to both the primary and the secondary operand number
\10..\13 a literal byte follows in the code stream, to be added
to the register value of operand 0..3
\14..\17 the position of index register operand in MIB (BND insns)
\20..\23 ib a byte immediate operand, from operand 0..3
\24..\27 ib,u a zero-extended byte immediate operand, from operand 0..3
\30..\33 iw a word immediate operand, from operand 0..3
\34..\37 iwd select between \3[0-3] and \4[0-3] depending on 16/32 bit
assembly mode or the operand-size override on the operand
\40..\43 id a long immediate operand, from operand 0..3
\44..\47 iwdq select between \3[0-3], \4[0-3] and \5[4-7]
depending on the address size of the instruction.
\50..\53 rel8 a byte relative operand, from operand 0..3
\54..\57 iq a qword immediate operand, from operand 0..3
\60..\63 rel16 a word relative operand, from operand 0..3
\64..\67 rel select between \6[0-3] and \7[0-3] depending on 16/32 bit
assembly mode or the operand-size override on the operand
\70..\73 rel32 a long relative operand, from operand 0..3
\74..\77 seg a word constant, from the _segment_ part of operand 0..3
\1ab /r a ModRM, calculated on EA in operand a, with the reg
field the register value of operand b.
\171\mab /mrb (e.g /3r0) a ModRM, with the reg field taken from operand a, and the m
and b fields set to the specified values.
\172\ab /is4 the register number from operand a in bits 7..4, with
the 4-bit immediate from operand b in bits 3..0.
\173\xab the register number from operand a in bits 7..4, with
the value b in bits 3..0.
\174..\177 the register number from operand 0..3 in bits 7..4, and
an arbitrary value in bits 3..0 (assembled as zero.)
\2ab /b a ModRM, calculated on EA in operand a, with the reg
field equal to digit b.
\240..\243 this instruction uses EVEX rather than REX or VEX/XOP, with the
V field taken from operand 0..3.
\250 this instruction uses EVEX rather than REX or VEX/XOP, with the
V field set to 1111b.
EVEX prefixes are followed by the sequence:
\cm\wlp\tup where cm is:
cc 00m mmm
c = 2 for EVEX and mmmm is the M field (EVEX.P0[3:0])
and wlp is:
00 wwl lpp
[l0] ll = 0 (.128, .lz)
[l1] ll = 1 (.256)
[l2] ll = 2 (.512)
[lig] ll = 3 for EVEX.L'L don't care (always assembled as 0)
[w0] ww = 0 for W = 0
[w1] ww = 1 for W = 1
[wig] ww = 2 for W don't care (always assembled as 0)
[ww] ww = 3 for W used as REX.W
[p0] pp = 0 for no prefix
[60] pp = 1 for legacy prefix 60
[f3] pp = 2
[f2] pp = 3
tup is tuple type for Disp8*N from %tuple_codes in insns.pl
(compressed displacement encoding)
\254..\257 id,s a signed 32-bit operand to be extended to 64 bits.
\260..\263 this instruction uses VEX/XOP rather than REX, with the
V field taken from operand 0..3.
\270 this instruction uses VEX/XOP rather than REX, with the
V field set to 1111b.
VEX/XOP prefixes are followed by the sequence:
\tmm\wlp where mm is the M field; and wlp is:
00 wwl lpp
[l0] ll = 0 for L = 0 (.128, .lz)
[l1] ll = 1 for L = 1 (.256)
[lig] ll = 2 for L don't care (always assembled as 0)
[w0] ww = 0 for W = 0
[w1 ] ww = 1 for W = 1
[wig] ww = 2 for W don't care (always assembled as 0)
[ww] ww = 3 for W used as REX.W
t = 0 for VEX (C4/C5), t = 1 for XOP (8F).
\271 hlexr instruction takes XRELEASE (F3) with or without lock
\272 hlenl instruction takes XACQUIRE/XRELEASE with or without lock
\273 hle instruction takes XACQUIRE/XRELEASE with lock only
\274..\277 ib,s a byte immediate operand, from operand 0..3, sign-extended
to the operand size (if o16/o32/o64 present) or the bit size
\310 a16 indicates fixed 16-bit address size, i.e. optional 0x67.
\311 a32 indicates fixed 32-bit address size, i.e. optional 0x67.
\312 adf (disassembler only) invalid with non-default address size.
\313 a64 indicates fixed 64-bit address size, 0x67 invalid.
\314 norexb (disassembler only) invalid with REX.B
\315 norexx (disassembler only) invalid with REX.X
\316 norexr (disassembler only) invalid with REX.R
\317 norexw (disassembler only) invalid with REX.W
\320 o16 indicates fixed 16-bit operand size, i.e. optional 0x66.
\321 o32 indicates fixed 32-bit operand size, i.e. optional 0x66.
\322 odf indicates that this instruction is only valid when the
operand size is the default (instruction to disassembler,
generates no code in the assembler)
\323 o64nw indicates fixed 64-bit operand size, REX on extensions only.
\324 o64 indicates 64-bit operand size requiring REX prefix.
\325 nohi instruction which always uses spl/bpl/sil/dil
\326 nof3 instruction not valid with 0xF3 REP prefix. Hint for
disassembler only; for SSE instructions.
\331 norep instruction not valid with REP prefix. Hint for
disassembler only; for SSE instructions.
\332 f2i REP prefix (0xF2 byte) used as opcode extension.
\333 f3i REP prefix (0xF3 byte) used as opcode extension.
\334 rex.l LOCK prefix used as REX.R (used in non-64-bit mode)
\335 repe disassemble a rep (0xF3 byte) prefix as repe not rep.
\336 mustrep force a REP(E) prefix (0xF3) even if not specified.
\337 mustrepne force a REPNE prefix (0xF2) even if not specified.
\336-\337 are still listed as prefixes in the disassembler.
\340 resb reserve <operand 0> bytes of uninitialized storage.
Operand 0 had better be a segmentless constant.
\341 wait this instruction needs a WAIT "prefix"
\360 np no SSE prefix (== \364\331)
\361 66 SSE prefix (== \366\331)
\364 !osp operand-size prefix (0x66) not permitted
\365 !asp address-size prefix (0x67) not permitted
\366 operand-size prefix (0x66) used as opcode extension
\367 address-size prefix (0x67) used as opcode extension
\370,\371 jcc8 match only if operand 0 meets byte jump criteria.
jmp8 370 is used for Jcc, 371 is used for JMP.
\373 jlen assemble 0x03 if bits==16, 0x05 if bits==32;
used for conditional jump over longer jump
\374 vsibx|vm32x|vm64x this instruction takes an XMM VSIB memory EA
\375 vsiby|vm32y|vm64y this instruction takes an YMM VSIB memory EA
\376 vsibz|vm32z|vm64z this instruction takes an ZMM VSIB memory EA
|
