Instructions
8 methodsThe fundamental x86-64 integer instructions. Sizes are 8/16/32/64-bit (byte/word/dword/qword); mnemonics follow Intel syntax (dst, src).
mov dst, srcCopy src into dst. Operand sizes must match; memory-to-memory moves are not allowed.
Parameters
| Name | Type | Description |
|---|---|---|
| dst | reg | mem | Destination register or memory location. |
| src | reg | mem | imm | Source register, memory, or immediate. |
Returns
Sets dst = src. Does not modify flags.
Example
mov rax, 42 ; imm -> reg
mov rbx, rax ; reg -> reg
mov qword [rsp-8], 7 ; imm -> mem
mov rcx, [rsp-8] ; mem -> reg
; mov [a], [b] ; INVALID — use a register in betweenadd dst, src / sub dst, srcAdd (or subtract) src from dst, storing the result in dst and updating flags.
Parameters
| Name | Type | Description |
|---|---|---|
| dst | reg | mem | Destination operand; also receives the result. |
| src | reg | mem | imm | Source operand (not memory if dst is memory). |
Returns
dst = dst +/- src. Sets CF, OF, SF, ZF, AF, PF.
Example
add rax, rbx ; rax += rbx
sub rsp, 32 ; allocate 32 bytes of stack
add [counter], 1 ; increment a memory counter
; signed overflow check:
add rax, rbx
jo .overflow ; jump if OF=1 (signed overflow)imul dst, src[, imm] (two/three-operand form)Signed multiply. Two-operand: dst = dst * src (low 64 bits). Three-operand: dst = src * imm. One-operand form returns 128-bit result in rdx:rax.
Parameters
| Name | Type | Description |
|---|---|---|
| dst | reg | Destination register (must be a register in 2/3-operand form). |
| src | reg | mem | Multiplier. |
| imm | imm (optional) | Immediate multiplier (3-operand form). |
Returns
dst = dst * src (or src * imm). Sets CF and OF if the result overflowed the low half.
Example
imul rax, rbx ; rax = rax * rbx
imul rcx, 10 ; rcx = rcx * 10
imul r8, r9, 5 ; r8 = r9 * 5
; full 128-bit signed:
mov rax, 1234567890
imul rbx ; rdx:rax = rax * rbxcmp a, b / test a, bCompare (cmp) computes a-b and sets flags; test computes a&b and sets flags. Neither modifies operands — they set up flags for jcc.
Parameters
| Name | Type | Description |
|---|---|---|
| a | reg | mem | First operand. |
| b | reg | mem | imm | Second operand. |
Returns
Sets ZF, SF, CF, OF, AF, PF per the result. Operands unchanged.
Example
cmp rax, rbx
je .equal ; jump if rax == rbx
jl .less ; signed: rax < rbx
jb .below ; unsigned: rax < rbx
test rax, rax
jz .is_zero ; rax == 0
js .is_neg ; rax < 0 (high bit set)
test rcx, 0x1
jnz .odd ; rcx is oddjmp label / jcc labelUnconditional (jmp) or conditional (jcc) jump to a label or address. Conditional jumps test flags set by cmp/test/arithmetic.
Parameters
| Name | Type | Description |
|---|---|---|
| label | label | reg | mem | Jump target (direct label, or indirect via register/memory). |
Returns
Transfers control to label. No register/flag changes (jcc may consume flags).
Example
; signed comparisons:
cmp rax, rbx
je .eq ; equal (ZF=1)
jne .ne ; not equal (ZF=0)
jl .lt ; less than (SF!=OF)
jge .ge ; greater or equal (SF==OF)
; unsigned:
jb .below ; below (CF=1)
ja .above ; above (CF=0 and ZF=0)
; indirect jump (jump table):
jmp rdi ; jump to address in rdipush src / pop dstpush decrements rsp by 8 (64-bit mode) and stores src at [rsp]; pop loads [rsp] into dst and increments rsp by 8.
Parameters
| Name | Type | Description |
|---|---|---|
| src/dst | reg | mem | imm (push only) | Value to push or destination for pop. |
Returns
push: rsp -= 8, [rsp] = src. pop: dst = [rsp], rsp += 8. Flags unchanged.
Example
push rax ; save rax
push qword 42 ; push an immediate
pop rbx ; rbx = top of stack
; save/restore callee-saved registers
push rbx
push r12
; ... function body ...
pop r12
pop rbx
retcall label / retcall pushes the return address (8 bytes) onto the stack and jumps to label. ret pops the return address back into rip, returning control to the caller.
Parameters
| Name | Type | Description |
|---|---|---|
| label | label | reg | mem | Function entry point. |
Returns
call: rsp -= 8, [rsp] = return addr, rip = label. ret: rip = [rsp], rsp += 8.
Example
; set up args (System V AMD64): rdi, rsi, rdx, ...
mov rdi, 1
mov rsi, 2
call add_two ; rax = add_two(1, 2)
add_two:
mov rax, rdi
add rax, rsi
ret ; return to caller, rax holds result
; tail call: jmp instead of call+ret
jmp other_func ; other_func returns directly to OUR callersyscall (Linux x86-64)Enter the kernel to perform a system call. The syscall number goes in rax; up to six arguments in rdi, rsi, rdx, r10, r8, r9. Returns in rax; clobbers rcx and r11.
Parameters
| Name | Type | Description |
|---|---|---|
| rax | reg | Syscall number (write=1, read=0, exit=60, mmap=9). |
| rdi..r9 | reg | Up to 6 arguments (note: r10, not rcx, is the 4th arg). |
Returns
Result in rax (negative value indicates -errno). rcx and r11 are clobbered.
Example
; write(1, msg, 12)
mov rax, 1 ; write
mov rdi, 1 ; fd = stdout
lea rsi, [rel msg]
mov rdx, 12
syscall ; rax = bytes written
; exit(0)
mov rax, 60
xor rdi, rdi
syscall ; never returns