Home 零对冲(ZeroHedge)每日HackerNews

x86 架构 1 字节操作码
x86 architecture 1 byte opcodes

原始链接: https://www.sandpile.org/x86/opc_1.htm

本文详细介绍了x86指令集架构，特别是单字节操作码定义。它概述了大量指令，这些指令按其十六进制操作码前缀（0xh – Fxh）进行分类。这些指令涵盖了广泛的操作，包括算术（ADD、SUB、XOR）、逻辑（AND、OR）、数据移动（MOV、PUSH、POP）、控制流（JMP、CALL、RET）以及处理器标志操作（CLC、STC）。 本文重点介绍了基于操作数大小和寻址模式的指令变体（例如，字节与字、寄存器与内存）。它还记录了80186、80286、80386等后续处理器引入的扩展，以及MMX和SSE等最新进展。 特别关注REX前缀及其对指令编码的影响，以及关于NOP（无操作）指令和旧处理器上的历史行为的说明。本文还包括关于潜在冲突以及其他实体（而非Intel或AMD）对某些操作码的积极使用的警告。最后以版权声明和免责声明结尾。

## Hacker News 讨论：x86 架构与 1 字节指令 一场 Hacker News 讨论围绕着 sandpile.org 链接，内容关于 x86 架构，特别是 1 字节指令。帖子引发了关于 **尺寸编码**（为代码尺寸优化）的讨论，以及它在 **demoscene**、漏洞利用和编译器优化等领域的应用。 用户们争论“1 字节指令”的定义，考虑到许多指令需要额外的字节来表示操作数（ModRM、SIB、立即数、前缀）。一些人分享了实际例子，例如使用有限的指令来实现 Brainfuck。 一个相关的讨论是关于提问与依赖 LLM 获取解释的问题，一些人认为人类专业知识的价值和通过讨论持续学习的重要性，而另一些人则指出 LLM 可以提供快速答案的潜力。该帖子还包括关于 x86 技巧和历史背景的轶事。最终，这次讨论突出了 x86 汇编语言的复杂性和深度，以及尺寸优化的专业技能。
相关文章
原文
x86 architecture
1 byte opcodes

xxh  
x0h
 		 x1h x2h x3h x4h x5h x6h x7h
 
0xh
 		 ADD
Eb,Gb		 ADD
Ev,Gv		 ADD
Gb,Eb		 ADD
Gv,Ev		 ADD
AL,Ib		 ADD
rAX,Iz		 PUSHI64
ES		 POPI64
ES
 
1xh
 		 ADC
Eb,Gb		 ADC
Ev,Gv		 ADC
Gb,Eb		 ADC
Gv,Ev		 ADC
AL,Ib		 ADC
rAX,Iz		 PUSHI64
SS		 POPI64
SS
 
2xh
 		 AND
Eb,Gb		 AND
Ev,Gv		 AND
Gb,Eb		 AND
Gv,Ev		 AND
AL,Ib		 AND
rAx,Iz		 ES: DAAI64
 
3xh
 		 XOR
Eb,Gb		 XOR
Ev,Gv		 XOR
Gb,Eb		 XOR
Gv,Ev		 XOR
AL,Ib		 XOR
rAX,Iz		 SS: AAAI64
 
4xh
 !REX2 		 INCI64 eAX  INCI64 eCX INCI64 eDX INCI64 eBX INCI64 eSP INCI64 eBP INCI64 eSI INCI64 eDI
REX
 
5xh
 		 PUSHD64
rAX / r8 / r16 / r24		 PUSHD64
rCX / r9 / r17 / r25		 PUSHD64
rDX / r10 / r18 / r26		 PUSHD64
rBX / r11 / r19 / r27		 PUSHD64
rSP / r12 / r20 / r28		 PUSHD64
rBP / r13 / r21 / r29		 PUSHD64
rSI / r14 / r22 / r30		 PUSHD64
rDI / r15 / r23 / r31
REX2.W1 PUSHPF64 Rq
 
6xh
 		 PUSHAI64
PUSHADI64
(80186+)		 POPAI64
POPADI64
(80186+)		 BOUNDI64 Gv,Ma
(80186+)		 ARPLI64 Ew,Gw
(80286+)		 FS:
(80386+)
Hint Alt Taken
for Jcc (P4)		 GS:
(80386+)		 OPSIZE:
(80386+)		 ADSIZE:
(80386+)
L1OM MVEX EVEX MOVSXD  Gv,Ed
(PM64)
 
7xh
 !REX2 		 JODf64
Jb		 JNODf64
Jb		 JBDf64
Jb		 JNBDf64
Jb		 JZDf64 Jb JNZDf64 Jb JBEDf64
Jb		 JNBEDf64
Jb
JKZDv64 vKw,Jbv
(K1OM)		 JKNZDv64 vKw,Jbv
(K1OM)
 
8xh
 		 group #1
Eb,Ib		 group #1
Ev,Iz		 group #1*I64
Eb,Ib		 group #1
Ev,Ib		 TEST
Eb,Gb		 TEST
Ev,Gv		 XCHG
Eb,Gb		 XCHG
Ev,Gv
 
9xh
 		 (F3h) PAUSE
XCHG rAX,rAX		  
XCHG rCX,rAX 
XCHG   r9,rAX 
XCHG r17,rAX
XCHG r25,rAX		  
XCHG rDX,rAX 
XCHG r10,rAX 
XCHG r18,rAX
XCHG r26,rAX		  
XCHG rBX,rAX 
XCHG r11,rAX 
XCHG r19,rAX
XCHG r27,rAX		  
XCHG rSP,rAX 
XCHG r12,rAX 
XCHG r20,rAX
XCHG r28,rAX		  
XCHG rBP,rAX 
XCHG r13,rAX 
XCHG r21,rAX
XCHG r29,rAX		  
XCHG rSI,rAX 
XCHG r14,rAX 
XCHG r22,rAX
XCHG r30,rAX		  
XCHG rDI,rAX 
XCHG r15,rAX 
XCHG r23,rAX
XCHG r31,rAX
XCHG   r8,rAX
XCHG r16,rAX
XCHG r24,rAX
 
Axh
 !REX2 		 MOV
AL,Ob		 MOV
rAX,Ov		 MOV
Ob,AL		 MOV
Ov,rAX		 MOVS
Yb,Xb		 MOVS
Yv,Xv		 CMPS
Yb,Xb		 CMPS
Yv,Xv
REX2.W0
JMPABS Aq
 
Bxh
 		 (!REX) MOV AL,Ib
 (REX) MOV AL,Ib
MOV   R8B,Ib
MOV R16B,Ib
MOV R24B,Ib		 (!REX) MOV CL,Ib
 (REX) MOV CL,Ib
MOV   R9B,Ib
MOV R17B,Ib
MOV R25B,Ib		 (!REX) MOV DL,Ib
 (REX) MOV DL,Ib
MOV R10B,Ib
MOV R18B,Ib
MOV R26B,Ib		 (!REX) MOV BL,Ib
 (REX) MOV BL,Ib
MOV R11B,Ib
MOV R19B,Ib
MOV R27B,Ib		 (!REX) MOV AH,Ib
(REX) MOV SPL,Ib
MOV R12B,Ib
MOV R20B,Ib
MOV R28B,Ib		 (!REX) MOV CH,Ib
(REX) MOV BPL,Ib
MOV R13B,Ib
MOV R21B,Ib
MOV R29B,Ib		 (!REX) MOV DH,Ib
(REX)  MOV SIL,Ib
MOV R14B,Ib
MOV R22B,Ib
MOV R30B,Ib		 (!REX) MOV BH,Ib
(REX)  MOV DIL,Ib
MOV R15B,Ib
MOV R23B,Ib
MOV R31B,Ib
 
Cxh
 		 group #2
Eb,Ib
(80186+)		 group #2
Ev,Ib
(80186+)		 RET nearDf64
Iw		 RET nearDf64
 		 LESI64 Gv,Mp (w:v) LDSI64 Gv,Mp (w:v) group #11
Eb,Ib		 group #11
Ev,Iz
VEX3 VEX2
 
Dxh
 		 group #2
Eb,1		 group #2
Ev,1		 group #2
Eb,CL		 group #2
Ev,CL		  AAMI64 Ib  AADI64 Ib  S(ET)ALCI64 XLAT
reserved REX2 L1OM UDB
 
Exh
 !REX2 		 LOOPNEDf64
LOOPNZDf64
Jb		 LOOPEDf64
LOOPZDf64
Jb		  
LOOPDf64
Jb		 JCXZDf64
JECXDf64
JRCXDf64
Jb		 IN
AL,Ib		 IN
eAX,Ib		 OUT
Ib,AL		 OUT
Ib,eAX
 
Fxh
 		 LOCK: #UD (80186/80188)
UMPF: (80286)
INT1 aka ICEBP
(80386+)		  
REPNE:
BND: (MPX)
XACQUIRE: (HLE)		 REP:
REPE:
 
XRELEASE: (HLE)		 HLT CMC group #3
Eb		 group #3
Ev
notes
on 90h		 XCHG   AX,  AX – classic 16-bit NOP (8086) If CPUID does indicate support, then a REP prefix will apply PAUSE semantics to a NOP. The blame for that "special treatment" of PM64 O32 NOP – effectively D64 – falls on me.
 
I did spot that zeroing the upper 32 bits of RAX leads to undesired non-NOP behavior, but
failed to convince our team in 2001 to use one of the freed up 1-byte opcodes (a la UDB).
XCHG eAX,eAX – wider 32-bit NOP (80386)
XCHG  rAX, rAX – wider 64-bit NOP (x86-64) In PM64 with O32, XCHG EAX,EAX must not zero the upper 32 bits of RAX. Thus it is D64.
XCHG    rN, rAX (N=8 ,16,24) is not a NOP!

xxh  
x8h
 		 x9h xAh xBh xCh xDh xEh xFh
 
0xh
 		 OR
Eb,Gb		 OR
Ev,Gv		 OR
Gb,Eb		 OR
Gv,Ev		 OR
AL,Ib		 OR
rAX,Iz
PUSHI64
CS
As of 2025 byte 0Eh
is in active use by a
corporate entity other
than Intel or AMD.
POP CS (8086/8088)
#UD (80186/80188)
2 byte opcodes
(80286+)
 
1xh
 		 SBB
Eb,Gb		 SBB
Ev,Gv		 SBB
Gb,Eb		 SBB
Gv,Ev		 SBB
AL,Ib		 SBB
rAX,Iz		 PUSHI64
DS		 POPI64
DS
 
2xh
 		 SUB
Eb,Gb		 SUB
Ev,Gv		 SUB
Gb,Eb		 SUB
Gv,Ev		 SUB
AL,Ib		 SUB
rAX,Iz		 CS:
&nbsp
Hint Not Taken
for Jcc (P4)		 DASI64
 
3xh
 		 CMP
Eb,Gb		 CMP
Ev,Gv		 CMP
Gb,Eb		 CMP
Gv,Ev		 CMP
AL,Ib		 CMP
rAX,Iz		 DS:
CET: (CET)
Hint Taken
for Jcc (P4)		 AASI64
 
4xh
 !REX2 		 DECI64 eAX  DECI64 eCX DECI64 eDX DECI64 eBX DECI64 eSP DECI64 eBP DECI64 eSI DECI64 eDI
REX
 
5xh
 		 POPD64
rAX / r8 / r16 / r24		 POPD64
rCX / r9 / r17 / r25		 POPD64
rDX / r10 / r18 / r26		 POPD64
rBX / r11 / r19 / r27		 POPD64
rSP / r12 / r20 / r28		 POPD64
rBP / r13 / r21 / r29		 POPD64
rSI / r14 / r22 / r30		 POPD64
rDI / r15 / r23 / r31
REX2.W1 POPPF64 Rq
 
6xh
 		 PUSHD64
Iz
(80186+)		 IMUL
Gv,Ev,Iz
(80186+)		 PUSHD64
Ib
(80186+)		 IMUL
Gv,Ev,Ib
(80186+)		 INS
Yb,DX
(80186+)		 INS
Yz,DX
(80186+)		 OUTS
DX,Xb
(80186+)		 OUTS
DX,Xz
(80186+)
 
7xh
 !REX2 		 JSDf64
Jb		 JNSDf64
Jb		 JPDf64
Jb		 JNPDf64
Jb		 JLDf64
Jb		 JNLDf64
Jb		 JLEDf64
Jb		 JNLEDf64
Jb
 
8xh
 		 MOV
Eb,Gb		 MOV
Ev,Gv		 MOV
Gb,Eb		 MOV
Gv,Ev		 MOV Mw,Sw
MOV Rv,Sw		 LEA Gv,M
 		 MOV Sw,Mw
MOV Sw,Rv		 group #1A
 
9xh
 		 CBW (8088)
CWDE (80386+)
CDQE (PM64)		 CWD (8088)
CDQ (80386+)
CQO (PM64)		 CALLI64
Ap (w:z)		 WAIT
FWAIT		 PUSHFD64
Fv		 POPFD64
Fv		 SAHF
(LM: if AHF64)		 LAHF
(LM: if AHF64)
 
Axh
 !REX2 		 TEST
AL,Ib		 TEST
rAX,Iz		 STOS
Yb,AL		 STOS
Yv,rAX		 LODS
AL,Xb		 LODS
rAX,Xv		 SCAS
Yb,AL		 SCAS
Yv,rAX
 
Bxh
 		 MOV rAX,Iv
MOV   r8,Iv
MOV r16,Iv
MOV r24,Iv		 MOV rCX,Iv
MOV   r9,Iv
MOV r17,Iv
MOV r25,Iv		 MOV rDX,Iv
MOV r10,Iv
MOV r18,Iv
MOV r26,Iv		 MOV rBX,Iv
MOV r11,Iv
MOV r19,Iv
MOV r27,Iv		 MOV rSP,Iv
MOV r12,Iv
MOV r20,Iv
MOV r28,Iv		 MOV rBP,Iv
MOV r13,Iv
MOV r21,Iv
MOV r29,Iv		 MOV rSI,Iv
MOV r14,Iv
MOV r22,Iv
MOV r30,Iv		 MOV rDI,Iv
MOV r15,Iv
MOV r23,Iv
MOV r31,Iv
 
Cxh
 		 ENTERD64
Iw,Ib
(80186+)		 LEAVED64
 
(80186+)		 RET far
Iw		 RET far
 		 INT3 INT
Ib		 INTOI64 IRET
 
Dxh
 		 ESC
0		 ESC
1		 ESC
2		 ESC
3		 ESC
4		 ESC
5		 ESC
6		 ESC
7
 
Exh
 !REX2 		 CALLDf64
Jz		 JMPDf64
Jz		 JMPI64
Ap (w:z)		 JMPDf64
Jb		 IN
AL,DX		 IN
eAX,DX		 OUT
DX,AL		 OUT
DX,eAX
 
Fxh
 		 CLC STC  
 CLI 
(F0h) CLX (REX32)		  
 STI 
(F0h) STX (REX32)		 CLD STD group #4
INC/DEC		 group #5
INC/DEC/etc.


On 8086/8088 processors the following behavior was supported instead.
xxh  
x0h
 		 x1h x2h x3h x4h x5h x6h x7h
... ...
 
6xh
 		 JO*
Jb		 JNO*
Jb		 JB*
Jb		 JNB*
Jb		 JZ*
Jb		 JNZ*
Jb		 JBE*
Jb		 JNBE*
Jb
 
7xh
 		 JO
Jb		 JNO
Jb		 JB
Jb		 JNB
Jb		 JZ
Jb		 JNZ
Jb		 JBE
Jb		 JNBE
Jb
 
8xh
 		 group #1
Eb,Ib		 group #1
Ew,Iw		 group #1*
Eb,Ib		 group #1
Ew,Ib		 TEST
Eb,Gb		 TEST
Ew,Gw		 XCHG
Eb,Gb		 XCHG
Ew,Gw
... ...
 
Cxh
 		 RET* near
Iw		 RET* near
 		 RET near
Iw		 RET near
 		 LES Gw,Mp (w:w)
 		 LDS Gw,Mp (w:w)
 		 group #11
Eb,Ib		 group #11
Ew,Iw
LES Gw,(IND:TMP)
 		 LDS Gw,(IND:TMP)
 
... ...
 
Fxh
 		 LOCK: LOCK:* REPNE: REP:
REPE:		 HLT CMC group #3
Eb		 group #3
Ew

xxh  
x8h
 		 x9h xAh xBh xCh xDh xEh xFh
... ...
 
6xh
 		 JS*
Jb		 JNS*
Jb		 JP*
Jb		 JNP*
Jb		 JL*
Jb		 JNL*
Jb		 JLE*
Jb		 JNLE*
Jb
 
7xh
 		 JS
Jb		 JNS
Jb		 JP
Jb		 JNP
Jb		 JL
Jb		 JNL
Jb		 JLE
Jb		 JNLE
Jb
 
8xh
 		 MOV
Eb,Gb		 MOV
Ew,Gw		 MOV
Gb,Eb		 MOV
Gw,Ew		 MOV Mw,Sw
MOV Rw,Sw		 LEA Gv,M
 		 MOV Sw,Mw
MOV Sw,Rw		 group #1A
LEA Gv,IND
 
... ...
 
Cxh
 		 RET* far
Iw		 RET* far
 		 RET far
Iw		 RET far
 		 INT3 INT
Ib		 INTO IRET
... ...
 
Fxh
 		 CLC STC CLI STI CLD STD group #4
INC/DEC		 group #5
INC/DEC/etc.


note: The opcodes marked with * are aliases to other opcodes.

main page

© 1996-2025 by Christian Ludloff. All rights reserved. Use at your own risk.

联系我们 contact @ memedata.com