Reverse Engineering for Beginners

(avery) #1

APPENDIX A. X86 APPENDIX A. X86
Bit (mask) Abbreviation (meaning) Description
0 (1) CF (Carry)
The CLC/STC/CMC instructions are used
for setting/resetting/toggling this flag
2 (4) PF (Parity) (17.7.1 on page 221).
4 (0x10) AF (Adjust)
6 (0x40) ZF (Zero) Setting to 0
if the last operation’s result was 0.
7 (0x80) SF (Sign)
8 (0x100) TF (Trap) Used for debugging.
If turned on, an exception is to be
generated after each instruction’s execution.
9 (0x200) IF (Interrupt enable) Are interrupts enabled.
The CLI/STI instructions are used
for setting/resetting the flag
10 (0x400) DF (Direction) A directions is set for the
REP MOVSx, REP CMPSx, REP LODSx, REP SCASx instructions.
The CLD/STD instructions are used
for setting/resetting the flag
11 (0x800) OF (Overflow)
12, 13 (0x3000) IOPL (I/O privilege level)^80286
14 (0x4000) NT (Nested task)^80286
16 (0x10000) RF (Resume)^80386 Used for debugging.
The CPU ignores the hardware breakpoint in DRx
if the flag is set.
17 (0x20000) VM (Virtual 8086 mode)^80386
18 (0x40000) AC (Alignment check)^80486
19 (0x80000) VIF (Virtual interrupt)Pentium
20 (0x100000) VIP (Virtual interrupt pending)Pentium
21 (0x200000) ID (Identification)Pentium


All the rest flags are reserved.


A.3 FPU registers


8 80-bit registers working as a stack: ST(0)-ST(7). N.B.:IDAcalls ST(0) as just ST. Numbers are stored in the IEEE 754 format.


long doublevalue format:


79 78 64 63 62 0

S exponent I mantissa or fraction

( S—sign, I—integer part )

A.3.1 Control Word


Register controlling the behaviour of theFPU.

Free download pdf