Reverse Engineering for Beginners

APPENDIX A. X86 APPENDIX A. X86

STD(M) set DF flag. This instruction is not generated by compilers and generally rare. For example, it can be found in the

ntoskrnl.exeWindows kernel file, in the hand-written memory copy routines.

STI(M) set IF flag

SYSCALL(AMD) call syscall (66 on page 661)

SYSENTER(Intel) call syscall (66 on page 661)

UD2(M) undefined instruction, raises exception. Used for testing.

A.6.4 FPU instructions

-R in the mnemonic usually implies that the operands are reversed, -P implies that one element is popped from the stack
after the instruction’s execution, -PP implies that two elements are popped.

-P instructions are often useful when we do not need the value in the FPU stack to be present anymore after the operation.

FABSreplace value in ST(0) by absolute value in ST(0)

FADDop: ST(0)=op+ST(0)

FADDST(0), ST(i): ST(0)=ST(0)+ST(i)

FADDPST(1)=ST(0)+ST(1); pop one element from the stack, i.e., the values in the stack are replaced by their sum

FCHSST(0)=-ST(0)

FCOMcompare ST(0) with ST(1)

FCOMop: compare ST(0) with op

FCOMPcompare ST(0) with ST(1); pop one element from the stack

FCOMPPcompare ST(0) with ST(1); pop two elements from the stack

FDIVRop: ST(0)=op/ST(0)

FDIVRST(i), ST(j): ST(i)=ST(j)/ST(i)

FDIVRPop: ST(0)=op/ST(0); pop one element from the stack

FDIVRPST(i), ST(j): ST(i)=ST(j)/ST(i); pop one element from the stack

FDIVop: ST(0)=ST(0)/op

FDIVST(i), ST(j): ST(i)=ST(i)/ST(j)

FDIVPST(1)=ST(0)/ST(1); pop one element from the stack, i.e., the dividend and divisor values in the stack are replaced by

quotient

FILDop: convert integer and push it to the stack.

FISTop: convert ST(0) to integer op

FISTPop: convert ST(0) to integer op; pop one element from the stack

FLD1push 1 to stack

FLDCWop: load FPU control word (A.3 on page 882) from 16-bit op.

FLDZpush zero to stack

FLDop: push op to the stack.

FMULop: ST(0)=ST(0)*op

FMULST(i), ST(j): ST(i)=ST(i)*ST(j)

FMULPop: ST(0)=ST(0)*op; pop one element from the stack

FMULPST(i), ST(j): ST(i)=ST(i)*ST(j); pop one element from the stack

FSINCOS: tmp=ST(0); ST(1)=sin(tmp); ST(0)=cos(tmp)

FSQRT:ST(0) =

√

ST(0)

FSTCWop: store FPU control word (A.3 on page 882) into 16-bit op after checking for pending exceptions.

FNSTCWop: store FPU control word (A.3 on page 882) into 16-bit op.

FSTSWop: store FPU status word (A.3.2 on page 883) into 16-bit op after checking for pending exceptions.

FNSTSWop: store FPU status word (A.3.2 on page 883) into 16-bit op.

FSTop: copy ST(0) to op