Assembly Language for Intel-Based Computers, 5th Edition
Published byModified over 4 years ago
Presentation on theme: "Assembly Language for Intel-Based Computers, 5th Edition"— Presentation transcript:
0 Data Transfers, Addressing, and Arithmetic Department of Computer ScienceNational Tsing Hua University
1 Assembly Language for Intel-Based Computers, 5th Edition Kip IrvineChapter 4: Data Transfers, Addressing, and ArithmeticSlides prepared by the authorRevision date: June 4, 2006(c) Pearson Education, All rights reserved. You may modify and copy this slide show for your personal use, or for use in the classroom, as long as this copyright statement, the author's name, and the title are not changed.
2 Chapter Overview Data Transfer Instructions Addition and Subtraction MOV InstructionOperand TypesDirect Memory OperandsDirect-Offset OperandsZero and Sign ExtensionXCHG InstructionAddition and SubtractionData-Related Operators and DirectivesIndirect AddressingJMP and LOOP Instructions
3 Data Transfer Instructions MOV is for moving data between:MemoryRegisterImmediate (constant)Almost all combinations, except:Memory to Memory!
4 MOV Instruction Syntax: MOV destination,source Both operands have the same sizeNo more than one memory operand permittedCS, EIP, and IP cannot be the destinationNo immediate to segment register moves.datacount BYTE 100wVal WORD 2.codemov bl,countmov ax,wValmov count,almov al,wVal ; errormov ax,count ; errormov wVal,count ; errorCS: code segment register
5 Your Turn . . .Explain why each of the following MOV statements are invalid:.databVal BYTE 100bVal2 BYTE ?wVal WORD 2dVal DWORD 5.codemov ds,45mov esi,wValmov eip,dValmov 25,bValmov bVal2,bVal
6 Memory to Memory? Must go through a register… .data Var1 WORD 100h .codeMOV ax, var1MOV var2, ax
7 Three Types of Operands Immediate: a constant integer (8, 16, or 32 bits)Value of the operand is encoded directly within the instructionRegister: the id of a registerRegister name is converted to a number (id) and encoded within the instructionMemory: a location in memoryMemory address is encoded within the instruction, or a register holds the address of a memory location
8 Direct-Memory Operands A named reference to storage in memory a memory operandThe named reference (label) is automatically dereferenced by the assembler.datavar1 BYTE 10h.codemov al,var1 ; al = 10hmov al,[var1] ; al = 10halternate format:  implies a dereference operation
9 Direct-Offset Operands A constant offset is added to a label to produce an effective address (EA)The address is dereferenced to get the content inside its memory location.dataarrayB BYTE 10h,20h,30h,40h.codemov al,arrayB+1 ; al = 20hmov al,[arrayB+1] ; alternative notationQ: Why doesn't arrayB+1 produce 11h?
10 Direct-Offset Operands (cont) .dataarrayW WORD 1000h,2000h,3000harrayD DWORD 1,2,3,4.codemov ax,[arrayW+2] ; AX = 2000hmov ax,[arrayW+4] ; AX = 3000hmov eax,[arrayD+4] ; EAX = h; Will the following statements assemble?mov ax,[arrayW-2] ; ??mov eax,[arrayD+16] ; ??What will happen when they run?
11 Zero or Sign Extension What happens to ECX if –1 is moved to CX? .datasignedVal SWORD -16.codemov ecx,0mov cx,signedValAre the higher 16 bits of ECX all 0?What number does ECX represent now?The solution: MOVZX and MOVSXMOVZX always fills higher bits with 0.MOVSX fills higher bits by “sign extension”.Just extend the left-most bit!
12 The destination must be a register Zero ExtensionWhen copy a smaller value into a larger destination, MOVZX instruction fills (extends) the upper half of the destination with zeros(bl)(ax)mov bl, bmovzx ax,bl ; zero-extensionThe destination must be a register
13 The destination must be a register Sign ExtensionMOVSX fills the upper half of the destination with a copy of the source operand's sign bitDoes it affect the value?(bl)(ax)mov bl, bmovsx ax,bl ; sign extensionThe destination must be a register
14 LAHF/SAHF and XCHG LAHF to load flags (EFLAGS) into AH Loads Sign, Zero, Auxiliary Carry, Parity, CarrySAHF to store contents of AH to EFLAGSXCHG for exchanging data between:Register, registerRegister, memoryMemory, register(again, no memory to memory)
15 XCHG InstructionXCHG exchanges the values of two operands. At least one operand must be a register. No immediate operands are permitted.datavar1 WORD 1000hvar2 WORD 2000h.codexchg ax,bx ; exchange 16-bit regsxchg ah,al ; exchange 8-bit regsxchg var1,bx ; exchange mem, regxchg eax,ebx ; exchange 32-bit regsxchg var1,var2 ; error: two memory operands
16 Your Turn. . . Rearranges values of following double words as 3, 1, 2: .dataarrayD DWORD 1,2,3Step1: copy the first value into EAX and exchange it with the value in the second position.mov eax,arrayDxchg eax,[arrayD+4]Step 2: Exchange EAX with the third array value and copy the value in EAX to the first array position.xchg eax,[arrayD+8]mov arrayD,eax
17 Evaluate This . . . Add the following three bytes: .data myBytes BYTE 80h,66h,0A5hWhat is your evaluation of the following code?mov al,myBytesadd al,[myBytes+1]add al,[myBytes+2]What is your evaluation of the following code?mov ax,myBytesadd ax,[myBytes+1]add ax,[myBytes+2]Any other possibilities?
18 What's Next Data Transfer Instructions Addition and Subtraction INC and DEC InstructionsADD and SUB InstructionsNEG InstructionImplementing Arithmetic ExpressionsFlags Affected by ArithmeticZero, Sign, Carry, OverflowData-Related Operators and DirectivesIndirect AddressingJMP and LOOP Instructions
19 INC and DEC Instructions Add 1/subtract 1 from destination operandoperand may be register or memory.datamyWord WORD 1000hmyDword DWORD h.codeinc myWord ; 1001hdec myWord ; 1000hinc myDword ; hmov ax,00FFhinc ax ; AX = 0100hinc al ; AX = 0000h
20 Your Turn...Show the value of the destination operand after each of the following instructions executes:.datamyByte BYTE 0FFh, 0.codemov al,myByte ; AL =mov ah,[myByte+1] ; AH =dec ah ; AH =inc al ; AL =dec ax ; AX =
22 NEG (negate) Instruction Reverses the sign of an operand. Operand can be a register or memory operand.datavalB BYTE -1valW WORD.codemov al,valB ; AL = -1neg al ; AL = +1neg valW ; valW == 1000 …00 negate still gives 1000…00 invalid16-bit sign number range: toSuppose AX contains –32,768 and we apply NEG to it. Will the result be valid?
23 NEG Instruction and the Flags NEG implemented using internal operation:SUB 0,operandAny nonzero operand causes Carry flag to be set.datavalB BYTE 1,0valC SBYTE -128.codeneg valB ; CF = 1, OF = 0neg [valB + 1] ; CF = 0, OF = 0neg valC ; CF = 1, OF = 1
24 Arith. Expression in Assembly HLL mathematical expressions are translated into assembly language by compiler, e.g.Rval = -Xval + (Yval – Zval)Rval DWORD ?Xval DWORD 26Yval DWORD 30Zval DWORD 40.codemov eax,Xvalneg eax ; EAX = -26mov ebx,Yvalsub ebx,Zval ; EBX = -10add eax,ebxmov Rval,eax ; -36
25 Your Turn...Translate the following expression into assembly language. Do not modify Xval, Yval, or Zval.Rval = Xval - (-Yval + Zval)Assume that all values are signed doublewords.mov ebx,Yvalneg ebxadd ebx,Zvalmov eax,Xvalsub eax,ebxmov Rval,eaxCan you do it using only one register? compiler optimization
26 Flags Affected by Arithmetic ALU has a number of status flags that reflect the outcome of arithmetic (and bitwise) operationsbased on the contents of the destination operandEssential flags:Zero: set when destination equals zeroSign: set when destination is negativeCarry: set when unsigned value is out of rangeOverflow: set when signed value is out of rangeThe MOV instruction never affects the flags
27 Zero Flag (ZF)Zero flag is set when the result of an operation produces zero in the destination operandmov cx,1sub cx,1 ; CX = 0, ZF = 1mov ax,0FFFFhinc ax ; AX = 0, ZF = 1inc ax ; AX = 1, ZF = 0Remember...A flag is set when it equals 1.A flag is clear when it equals 0.
28 Sign Flag (SF)Sign flag is set when the destination operand is negative and clear when destination is positiveSign flag is a copy of the destination's highest bit:mov cx,0sub cx,1 ; CX = -1, SF = 1add cx,2 ; CX = 1, SF = 0mov al,0sub al, ; AL = b, SF = 1add al, ; AL = b, SF = 0
29 Signed and Unsigned Integers A Hardware Viewpoint:All CPU instructions operate exactly the same on signed and unsigned integersThe CPU cannot distinguish between signed and unsigned integersYOU, the programmer, are solely responsible for using the correct data type with each instruction
30 Carry Flag (CF)The Carry flag is set when the result of an operation generates an unsigned value that is out of range (too big or too small for the destination operand) carry or borrowmov al,0FFhadd al,1 ; CF = 1, AL = 00; Try to go below zero:mov al,0sub al,1 ; CF = 1, AL = FF
31 Your Turn . . .For each of the following marked entries, show the values of the destination operand and the Sign, Zero, and Carry flags:mov ax,00FFhadd ax,1 ; AX= SF= ZF= CF=sub ax,1 ; AX= SF= ZF= CF=add al,1 ; AL= SF= ZF= CF=mov bh,6Chadd bh,95h ; BH= SF= ZF= CF=mov al,2sub al,3 ; AL= SF= ZF= CF=
32 Overflow Flag (OF)The Overflow flag is set when the signed result of an operation is invalid or out of range; Example 1mov al,+127add al,1 ; OF = 1, AL = ??; Example 2mov al,7Fh ; OF = 1, AL = 80hadd al,1The two examples are identical at binary level because 7Fh equals To determine the value of destination operand, it is often easier to calculate in hexadecimal.
33 A Rule of ThumbWhen adding two integers, remember that the Overflow flag is only set when . . .Two positive operands are added and their sum is negativeTwo negative operands are added and their sum is positiveWhat will be the values of the Overflow flag?mov al,80hadd al,92h ; OF =mov al,-2add al,+127 ; OF =1
34 Your Turn . . .What will be the values of the given flags after each operation?mov al,-128neg al ; CF = OF =mov ax,8000hadd ax,2 ; CF = OF =mov ax,0sub ax,2 ; CF = OF =mov al,-5sub al,+125 ; OF =
35 Interpreted by assembler What's NextData Transfer InstructionsAddition and SubtractionData-Related Operators and DirectivesOFFSET OperatorPTR OperatorTYPE OperatorLENGTHOF OperatorSIZEOF OperatorLABEL DirectiveIndirect AddressingJMP and LOOP InstructionsInterpreted by assembler35
36 OFFSET OperatorOFFSET returns the distance in bytes of a label from the beginning of its enclosing segmentProtected mode: 32 bitsReal mode: 16 bitsThe protected-mode programs that we write only have a single segment (we use the flat memory model)36
38 OFFSET Example Let's assume that the data segment begins at 00404000h Result of execution:… EAX= EBX=7FFD0002 ECX= EDX=ESI= EDI= EBP=0012FF94 ESP=0012FF8CEIP= D EFL= CF=0 SF=0 ZF=1 OF=0EAX= EBX= ECX= EDX=EIP= EFL= CF=0 SF=0 ZF=1 OF=0…38
39 OFFSET Example Let's assume that the data segment begins at 00404000h: bVal byte 1wVal word 2dVal dword 3dVal2 dword 4codemain PROCA R mov al, bval| 8B 1D mov bx, wValRC 8B 0D R mov ecx, dValB R mov edx, dVal2E E call DumpRegsD B R mov eax, offset bvalBB R mov ebx, offset wValB R mov ecx, offset dValC BA R mov edx, offset dVal2E E call DumpRegsLet's assume that the data segment begins at h:.databVal BYTE ?wVal WORD ?dVal DWORD ?dVal2 DWORD ?.codemov esi,OFFSET bVal ; ESI =mov esi,OFFSET wVal ; ESI =mov esi,OFFSET dVal ; ESI =mov esi,OFFSET dVal2 ; ESI =39
40 Relating to C/C++ The value returned by OFFSET is a pointer Compare the following code written for both C++ and assembly language:; C++ version:char array;char * p = array;.dataarray BYTE 1000 DUP(?).codemov esi,OFFSET array ; ESI is p
41 PTR OperatorOverrides default type of a label (variable) and provides the flexibility to access part of a variableRecall that little endian order is used when storing data in memory (see Section 3.4.9).datamyDouble DWORD h.codemov ax,myDouble ; error – why?mov ax,WORD PTR myDouble ; loads 5678hmov WORD PTR myDouble,4321h ; saves 4321h
43 PTR Operator (cont)PTR can also be used to combine elements of a smaller data type and move them into a larger operandThe processor will automatically reverse the bytes.datamyBytes BYTE 12h,34h,56h,78h.codemov ax,WORD PTR [myBytes] ; AX = 3412hmov ax,WORD PTR [myBytes+2] ; AX = 7856hmov eax,DWORD PTR myBytes ; EAX = h
44 Your Turn . . . Write down value of each destination operand: .data varB BYTE 65h,31h,02h,05hvarW WORD 6543h,1202hvarD DWORD h.codemov ax,WORD PTR [varB+2] ; a.mov bl,BYTE PTR varD ; b.mov bl,BYTE PTR [varW+2] ; c.mov ax,WORD PTR [varD+2] ; d.mov eax,DWORD PTR varW ; e.
45 TYPE OperatorThe TYPE operator returns the size, in bytes, of a single element of a data declaration.datavar1 BYTE ?var2 WORD ?var3 DWORD ?var4 QWORD ?.codemov eax,TYPE var1 ; 1mov eax,TYPE var2 ; 2mov eax,TYPE var3 ; 4mov eax,TYPE var4 ; 8
46 LENGTHOF OperatorThe LENGTHOF operator counts the number of elements in a single data declaration.data LENGTHOFbyte1 BYTE 10,20,30 ; 3array1 WORD 30 DUP(?),0,0 ; 32array2 WORD 5 DUP(3 DUP(?)) ; 15array3 DWORD 1,2,3,4 ; 4digitStr BYTE " ",0 ; 9.codemov ecx,LENGTHOF array1 ; 32
47 SIZEOF OperatorSIZEOF returns a value that is equivalent to multiplying LENGTHOF by TYPE..data SIZEOFbyte1 BYTE 10,20,30 ; 3array1 WORD 30 DUP(?),0,0 ; 64array2 WORD 5 DUP(3 DUP(?)) ; 30array3 DWORD 1,2,3,4 ; 16digitStr BYTE " ",0 ; 9.codemov ecx,SIZEOF array1 ; 64
48 Spanning Multiple Lines (1 of 2) A data declaration spans multiple lines if each line (except the last) ends with a comma. The LENGTHOF and SIZEOF operators include all lines belonging to the declaration:.dataarray WORD 10,20,30,40,50,60.codemov eax,LENGTHOF array ; 6mov ebx,SIZEOF array ; 12
49 Spanning Multiple Lines (2 of 2) In the following example, array identifies only the first WORD declaration. Compare the values returned by LENGTHOF and SIZEOF here to those in the previous slide:.dataarray WORD 10,20WORD 30,40WORD 50,60.codemov eax,LENGTHOF array ; 2mov ebx,SIZEOF array ; 4
50 LABEL DirectiveAssigns an alternate label name and type to a storage locationDoes not allocate any storage of its ownRemoves the need for the PTR operator.datadwList LABEL DWORDwordList LABEL WORDintList BYTE 00h,10h,00h,20h.codemov eax,dwList ; hmov cx,wordList ; 1000hmov dl,intList ; 00h
51 What's Next Data Transfer Instructions Addition and Subtraction Data-Related Operators and DirectivesIndirect AddressingIndirect OperandsArray Sum ExampleIndexed OperandsPointersJMP and LOOP Instructions
52 Direct-Offset Addressing We have discussed Direct-Offset operands:Problem: the offset is fixed.Can’t handle array index, like A[i].dataarrayB BYTE 10h,20h,30h,40h.codemov al,arrayB+1 ; al = 20hmov al,[arrayB+1] ; alternative notation
53 address fixed statically Indirect AddressingThe solution? The memory address must be a variable too! Store it in a register!Compare these:MOV AL, [10000h]MOV AL, [Var1+1]MOV AL, [ESI] indirect addressingaddress fixed statically
54 Indirect Operands (1 of 2) An indirect operand holds the address of a variable, usually an array or stringIt can be dereferenced (just like a pointer).dataval1 BYTE 10h,20h,30h.codemov esi,OFFSET val1mov al,[esi] ; dereference ESI (AL = 10h)inc esimov al,[esi] ; AL = 20hmov al,[esi] ; AL = 30h
55 Indirect Operands (2 of 2) Use PTR to clarify the size attribute of a memory operand..datamyCount WORD 0.codemov esi,OFFSET myCountinc [esi] ; error: can’t tell; from contextinc WORD PTR [esi] ; okShould PTR be used here?add [esi],20
56 Array Traversal Indirect operands good for traversing an array The register in brackets must be incremented by a value that matches the array type..dataarrayW WORD 1000h,2000h,3000h.codemov esi,OFFSET arrayWmov ax,[esi]add esi,2 ; or: add esi,TYPE arrayWadd ax,[esi]add esi,2add ax,[esi] ; AX = sum of the arrayTry:mov eax,[esi]ToDo: Modify this example for an array of doublewords.
57 Indexed OperandsAdds a constant to a register to generate an effective address: two notational forms:[label + reg] label[reg].dataarrayW WORD 1000h,2000h,3000h.codemov esi,0mov ax,[arrayW + esi] ; AX = 1000hmov ax,arrayW[esi] ; alternate formatadd esi,2add ax,[arrayW + esi]ToDo: Modify this example for an array of doublewords.
58 PointersYou can declare a pointer variable that contains the offset of another variableAlternate format:.dataarrayW WORD 1000h,2000h,3000hptrW DWORD arrayW.codemov esi,ptrWmov ax,[esi] ; AX = 1000hptrW DWORD OFFSET arrayW
59 What's Next Data Transfer Instructions Addition and Subtraction Data-Related Operators and DirectivesIndirect AddressingJMP and LOOP InstructionsJMP InstructionLOOP InstructionLOOP ExampleSumming an Integer ArrayCopying a String
60 JMP Instruction top: . jmp top An unconditional jump to a label that is usually within the same procedureSyntax: JMP targetLogic: EIP targetExample:top:.jmp topA jump outside the current procedure must be to a special type of label called a global label (see Section ).
61 LOOP Instruction The LOOP instruction creates a counting loop Syntax: LOOP targetLogic:ECX ECX – 1if ECX != 0, jump to targetImplementation:The assembler calculates the distance, in bytes, between the offset of the following instruction and the offset of the target label the relative offsetThe relative offset is added to EIP
62 LOOP Example Calculates the sum 5 + 4 + 3 +2 + 1: offset machine code source codeB mov ax,0B mov ecx,5C1 L1:add ax,cxC E2 FB loop L1EWhen LOOP is executed, the current location = E (offset of the next instruction). Then, –5 (FBh) is added to the current location, causing a jump to location : E + FB
63 Your Turn . . .If the relative offset is encoded in a single signed byte,(a) what is the largest possible backward jump?(b) what is the largest possible forward jump?-128+127
64 Your Turn . . . mov ax,6 mov ecx,4 L1: inc axloop L1What will be the final value of AX?How many times will the loop execute?mov ecx,0X2:inc axloop X2
65 Nested Loop Must save the outer loop counter's ECX value Example: the outer loop executes 100 times, and the inner loop 20 times.datacount DWORD ?.codemov ecx,100 ; set outer loop countL1:mov count,ecx ; save outer loop countmov ecx,20 ; set inner loop countL2: ..loop L2 ; repeat the inner loopmov ecx,count ; restore outer loop countloop L1 ; repeat the outer loopSaved in register or memory?
66 Summing an Integer Array The following code calculates the sum of an array of 16-bit integers.dataintarray WORD 100h,200h,300h,400h.codemov edi,OFFSET intarray ; address of intarraymov ecx,LENGTHOF intarray ; loop countermov ax,0 ; zero the accumulatorL1:add ax,[edi] ; add an integeradd edi,TYPE intarray ; point to next integerloop L1 ; repeat until ECX = 0
67 Copying a StringThe following code copies a string from source to target:.datasource BYTE "This is the source string",0target BYTE SIZEOF source DUP(0).codemov esi,0 ; index registermov ecx,SIZEOF source ; loop counterL1:mov al,source[esi] ; get char from sourcemov target[esi],al ; store it in the targetinc esi ; move to next characterloop L1 ; repeat for entire stringgood use of SIZEOF
68 Summary Data Transfer Operand types Arithmetic Operators MOV – data transfer from source to destinationMOVSX, MOVZX, XCHGOperand typesdirect, direct-offset, indirect, indexedArithmeticINC, DEC, ADD, SUB, NEGSign, Carry, Zero, Overflow flagsOperatorsOFFSET, PTR, TYPE, LENGTHOF, SIZEOF, TYPEDEFJMP and LOOP – branching instructions