Elegant Manual

Assembly Lanuage Programming

Registers

General purpose AX, BX, CX, DX

these are 16 bit registers

can also be used as 2 ´ 8 bit registers e.g. most significant byte of CX is CH and least significant byte is CL

these registers are mostly interchangeable but not always e.g. in the loop instruction, the count must be in CX

Pointer and index regs SP, BP, SI, DI, IP

SP stack pointer - commonly used for subroutine calls and last-in-first-out (LIFO) temporary storage

BP base pointer - array access

SI source index - string operations

DI destination index - string operations

IP instruction pointer - contains address of next instruction to be executed

Flag register

contains condition of various CPU flags which are affected by various logic and arithmetic operations

C carry - carry after addition or borrow after subtraction

if you do "add cx,1" with cx=0ffffh, the carry flag will be set

Z zero - indicates if the result of an arithmetic or logical instruction is 0

S sign - indicates if result was +ve or -ve

O overflow - when signed numbers are used, indicates an overflow e.g. for an 8 bit add, 7fh (127) + 1 = 80h which is -128 if we are using signed arithmetic

normally, we use overflow to indicate errors in signed arithmetic and carry for unsigned arithmetic

Segment registers CS, DS, SS, ES

these behave differently in "real" and "protected" mode - we will only deal with "real" mode

required so we can access >64K of memory using only 16 bit logical addresses

in fact we can address 1Mb in real mode i.e. 2²⁰ bytes

CS code segment

the physical address of the next instruction = CS ´ 10h + logical address e.g. if CS=1231h and IP=60h then next instruction executed is 12310h + 60h

full addresses are written as CS:IP e.g. 1231:0060h

DS data segment, SS stack segment, ES extra segment

similar for other segments e.g. the physical address = (segment value) ´ 10h + logical address

different instructions default to using particular segments

SEGMENT

REGISTER

CS

IP

SS

SP or BP

DS

BX, SI, DI, 16 bit address

ES

DI for string instructions

they can be overridden by explicitly specifying the segment

mov ax,cs:[bp]

Addressing Modes

Summary (also see Figure 2-2 in text which shows how these work)

Immediate mov bl,3ah

Direct mov [1234h],ax

Base plus index mov [bx+si],ax

Base relative plus index mov array[bx+si],ax

Data movement

mov - transfers between registers and/or memory

gives examples of different ways of moving

push/pop - stack operations

these implement a last-in-first-out (LIFO) stack.

PUSH this puts things on the stack e.g. push ax

writes ax to (sp-2)

sp ß sp - 2

POP retrieves the last thing that was pushed on the stack e.g. pop ax

i. puts data at sp into ax

ii. sp ß sp + 2

Address Data before Data after

sp à SS:003ah xx xx

SS:0039h yy 34

SS:0038h zz sp à 12

SS:0037h

when you push a 16 bit number in memory on Intel machines they are little-endian so least significant byte goes first e.g. suppose AX=1234h and we "push ax"

stack operations are often used to save registers e.g. after this routine ax,bx,cx will be unchanged

routine: push ax

push bx

push cx

< code which uses ax,bx,cx >

pop cx

pop bx

pop ax

ret

they are also used for subroutines (call/ret) the stack is used to store the return address during the call so when the ret is executed, it can return to the next instruction

lea - load effective address

loads a register with the address of the data

lea si,data

this is the same as "mov si,offset data" which is favored since it is smaller and faster

lea dx,[x][si]+100h

this cannot be done with a mov (can only be done with lea)

xchg - exchange (swaps the src and dst)

xchg ax,bx ; (tmp ß ax, ax ß bx, bx ß tmp)

in/out - i/o instructions

these read/write to/from a hardware port

in al,300h ; input a byte from i/o port 300h

out 300h,ax ; write ax to i/o port 300h

Arithmetic and logic instructions

add/sub

add cx,1 ; cx ß cx + 1

sub cx,[si+2] ; cx ß cx - (contents of address si+2)

add byte ptr [di],3 ; add 3 to contents of byte at di

you need to specify "byte ptr" so assembler knows you mean a 8 bit add

add word ptr [di],3 ; add 3 to contents of word at di

the flag registers described earlier are affected by arithmetic and logical operations

"add cx,1" if after operation cx == 0 then the zero flag will be set

inc/dec - increment/decrement

dec cx ; cx ß cx - 1

we often use these for loops e.g. to loop 5 times with ax = 5,4,3,2,1 in the loop

mov ax,5 ; load ax register with the count

l1: call print ; ax must not be destroyed

; in this call

dec ax ; update counter

jnz l1 ; jump if not zero

this is equivalent to the following C code

for (a = 5; a != 0; a--)

print();

the "loop" instruction does the same thing but smaller and faster. However, you must use cx

mov cx,5

l1: call print ; assume cx not destroyed

loop l1

cmp - compare

this is a subtraction which doesn’t change the destination register. It is used for setting flag bits

e.g. cmp cl,10

jl l2 ; jumps if cl < 10 (cl not affected)

mul/div - multiplication/division

mul cl ; ax ß al * cl (unsigned)

imul cl ; ax ß al * cl (signed)

mul cx ; dx ax ß ax * cx (unsigned)

imul word ptr [si] ; dx ax ß ax * [si] (signed)

div cl ; ax / cl (quotient in al, remainder in ah)

idiv si ; dx ax / si (quotient in ax, remainder in dx)

Logical operations AND, OR, XOR, TEST, NOT, NEG

operate as for other arithmetic operations

the fastest way to clear a register (better than mov ax,0) is "xor ax,ax"

NOT inverts all the bits

NEG changes the sign of a twos-complement number

TEST is an AND which doesn’t change the destination register - we can use it to check if a certain bit is set or not

to check if bit 2 is set

test cx,4h

jnz bitset

shl,sal,shr,sar,rol,rcl,ror,rcr - shift and rotate operations

these are mostly used for arithmetic since we can multiply by powers of two shifting left, and divide by shifting right

to multiply by 10 = (1010 in binary) - faster than using mul

shl ax,1

mov ax,bx

shl ax,2

add ax,bx ; now ax = 10 * bx

String instructions

lods, stos, movs, ins, outs

these allow repetitive operations to be done in a single command

the direction flag (D) is used to indicate autoincrement (D=0) or autodecrement (D=1)

cld clears direction flag (D=0)

std sets direction flag (D=1)

during string instructions, DI always uses ES. SI defaults to DS but this can be changed with a segment override

lods - loads al or ax with a byte or word

lodsb ; al = ds:[si]; si ß si ± 1

lodsw ; ax = ds:[si]; si ß si ± 2

stos - stores al or ax

stosb ; es:[di] = al; di ß di ± 1

stosw ; es:[di] = ax; di ß di ± 2

movs - move string (useful for copying)

movsw ; es:[di] ß ds:[si], di ß di ± 2, si ß si ± 2

ins and outs used to in and out strings

e.g. insb ; es:[di] ß [dx], di ß di ± 1

; (dx is a port addr)

The advantage of string instructions is that we can combine them with "rep"

e.g. to clear 10 bytes of memory

les di, buffer ; loads es:di buffer addr

mov cx,5 ; we will use words - faster

mov ax,0

cld ; autoincrement mode

rep stosw ; does "stosw" cx(=5) times

scas and cmps - string scan and string compare

scans a string looking for a certain character

compares two strings

Program control instructions

jumps

these are use to implement loops, ifs, gotos etc

unconditional jump

jmp start

start is a label which indicates where to jump

we also need conditional jumps to implement loops,if etc

(see table of conditional jump instructions)

different types of jumps

short - these can only span between -128 to +127 and occupy 2 bytes (1 for opcode & 1 for distance)

near - these are the same as short but 3 bytes so they can span ± 32K

far - these are 5 bytes long and specify the segment to jump to as well

if our code segment is smaller than 64K, we will not need far jumps and do not need to modify cs. Similarly, if our data segment is <64K, we do not need to change ds.

for "call" there are near and far

loop instructions

we have already seen the loop command - there are also conditional loops

loope ; loop while equal

loops while cx != 0 AND Z flag = 0

loopne ; loop while not equal … AND Z != 0

set instructions (80386-80486)

e.g. setc mem ; sets mem to 1 if carry set, otherwise 0

PC I/O function calls (see Appendix A)

DOS int 21h

used to perform I/O to keyboard, disk, com ports, set date etc

to use you just load the registers as specified and do an int 21h

e.g. to read a character without echo

mov ah,08h

int 21h ; returns with char in al

ah always contains the function call number which specifies which operation you would like to do

all registers not used in the call are preserved

the "int" performs a software interrupt which you can think of as a funny subroutine call (we will talk about interrupts in detail later)

int only takes 2 bytes whereas a far call takes 5 bytes

BIOS int 10h-17h

the bios is sometimes used to perform more specific lower level i/o

e.g. low level video i/o, serial i/o, raw access to the disk

Using the assembler (tasm - which is mostly compatible with masm)

Structure of a line of assembly language

An assembly language instruction has 4 fields (optional ones are in brackets)

[label:] mnemonic [operands] [;comment]

the label gives us a way to refer to an address (try to choose meaningful names for your labels)

the mnemonic is an 80x86 instruction or some assembler directive

operands are those arguments of the instruction or directive

comments make a program much easier to read

Sample program (asm1.asm)

.MODEL SMALL

.STACK 200h

.DATA

Message db "This was printed using function 9 "

db "of the DOS interrupt 21h.$"

.CODE

START:

mov ax,seg Message ;moves SEGMENT of `Message' to AX

mov ds,ax ;moves ax into ds (ds=ax)

;you cannot do this -> mov ds,seg Message

mov dx,offset Message ;move OFFSET of `Message' to DX

mov ah,9 ;DOS Function 9, int 21h prints a string that

int 21h ;terminates with a "$". Requires FAR pointer to

;what is to be printed in DS:DX

mov ax,4c00h ;Returns control to DOS

int 21h ;MUST be here! Program will crash without it!

END START

.MODEL SMALL - tells the assembler that our code<64K and our data<64K (together they can be 128K)

.STACK 200h - defines stack segment to be 200h in size (strange things can happen if stack overflows)

.DATA - this indicates the start of the data segment

MESSAGE - this is a label for the data so we can reference it later. It gets translated to an address by the assembler

db - this places the bytes corresponding to the message in consecutive addresses in memory, starting at MESSAGE. It allocates memory

.CODE - start of code segment

START: - a label which is the first address that gets executed (data doesn’t get executed)

END START - exit point of the whole program (START) is the entry point

Assembler directives

these give instructions to the assembler but don’t generate machine code

org - sets the beginning of the offset address

e.g. org 100h ; forces the offset address to be 100h here

db - define byte

e.g. db 100h, 1010b, 10, ?, "Hello", 0

the ? means that the value can be anything

dup can be used to define many bytes all the same e.g. "db 16 dup (?)" sets aside 16 bytes

there is also dw - define word, dd - define double word

equ - is used to define a constant

e.g. bufz equ 100

buf1 db bufz dup (?)

buf2 db bufz dup (?)

Macros

sometimes instead of a subroutine, we want to insert a sequence of instructions - we can use a macro
use this for code which needs to be inline don’t use it if a subroutine is suitable since it generates a lot of extra code
comments should use ";;" (why?)
it is equivalent to a #define in C compared with a subroutine
e.g.

pushregs macro

push ax

push bx

push cx

push dx

push si

push di

endm

local labels can be defined using local (otherwise a global l1 will be created and this macro can only be used once)

xx macro reg

local l1

push dx

l1: …

jmp l1

endm

an example that shows all of this (produced using "tasm /l ex1")

2 0000 .MODEL SMALL

3 0000 .STACK 200h

4 =0064 bufz equ 100

6 pushregs macro

7 push ax

8 push bx

9 push cx

10 push dx

11 push si

12 push di

13 endm

14 ; macro with parameters

15 addmac macro x,y,res

16 push ax ; saves ax

17 mov ax,x

18 add ax,y

19 mov res,ax

20 pop ax

21 endm

23 0000 .DATA

24 org 200h

25 0200 A0 0A ?? 0A 48 65 6C+ db 0a0h, 1010b, ?, 10, "Hello", 0

26 6C 6F 00

27 020A 0001 0002 0003 dw 1, 2, 3

28 0210 64*(??) buf1 db bufz dup (?)

29 0274 64*(??) buf2 db bufz dup (?)

31 02D8 .CODE

33 0000 START: pushregs

1 34 0000 50 push ax

1 35 0001 53 push bx

1 36 0002 51 push cx

1 37 0003 52 push dx

1 38 0004 56 push si

1 39 0005 57 push di

40 addmac 2,4,bx

1 41 0006 50 push ax ; saves ax

1 42 0007 B8 0002 mov ax,2

1 43 000A 05 0004 add ax,4

1 44 000D 8B D8 mov bx,ax

1 45 000F 58 pop ax

46 END START

proc

equivalent to a function in C

a procedure provides a easy way to encapsulate some calculation which can then be used without worrying how it works

we will talk more about these when we discuss linking

; this a procedure to print a block on the screen using

; registers to pass parameters (cursor position of where to

; print it and colour).

.model tiny

.code

org 100h

Start:

mov dh,4 ; row to print character on

mov dl,5 ; column to print character on

mov al,254 ; ascii value of block to display

mov bl,4 ; colour to display character

call PrintChar ; print our character

mov ax,4C00h ; terminate program

int 21h

PrintChar PROC NEAR

push bx ; save registers to be destroyed

push cx

xor bh,bh ; clear bh - video page 0

mov ah,2 ; function 2 - move cursor

int 10h ; row and col are already in dx

pop bx ; restore bx

xor bh,bh ; display page - 0

mov ah,9 ; function 09h write char & attrib

mov cx,1 ; display it once

int 10h ; call bios service

pop cx ; restore registers

ret ; return to where it was called

PrintChar ENDP

end Start

Passing parameters to procedures

the previous example passed parameters through registers

passing through memory

easy to do but it makes your program larger and can be slower

simply copy them to a variable instead of a register - you can have as many variables as you like (registers are limited), but registers are faster

.model tiny

.code

org 100h

Start:

mov Row,4 ; row to print character

mov Col,5 ; column to print character on

mov Char,254 ; ascii value of block to display

mov Colour,4 ; colour to display character

call PrintChar ; print our character

mov ax,4C00h ; terminate program

int 21h

PrintChar PROC NEAR

push ax cx bx ; save registers to be destroyed

xor bh,bh ; clear bh - video page 0

mov ah,2 ; function 2 - move cursor

mov dh,Row

mov dl,Col

int 10h ; call Bios service

mov al,Char

mov bl,Colour

xor bh,bh ; display page - 0

mov ah,9 ; function 09h write char & attrib

mov cx,1 ; display it once

int 10h ; call bios service

pop bx cx ax ; restore registers

ret ; return to where it was called

PrintChar ENDP

; variables to store data

Row db ?

Col db ?

Colour db ?

Char db ?

end Start

Passing through the stack

most powerful and flexible method of passing parameters and is the way C does it

.model tiny

.code

org 100h

Start:

mov dh,4 ; row to print string on

mov dl,5 ; column to print string on

mov al,254 ; ascii value of block to display

mov bl,4 ; colour to display character

push dx ax bx ; put parameters onto the stack

call PrintString ; print our string

pop bx ax dx ;restore registers

mov ax,4C00h ;terminate program

int 21h

PrintString PROC NEAR

push bp ; save bp

mov bp,sp ; put sp into bp

push cx ; save registers to be destroyed

xor bh,bh ; clear bh - video page 0

mov ah,2 ; function 2 - move cursor

mov dx,[bp+8] ; restore dx

int 10h ; call bios service

mov ax,[bp+6] ; character

mov bx,[bp+4] ; attribute

xor bh,bh ; display page - 0

mov ah,9 ; function 09h write char & attrib

mov cx,1 ; display it once

int 10h ; call bios service

pop cx ; restore registers

pop bp

ret ; return to where it was called

PrintString ENDP

end Start

Linking

in C we can separately compile files and then link them together

different people can write, debug & test different modules of the same program

debugging and testing is made easier if the prog is split into smaller modules

libraries of useful functions can be collected

only the files that are modified need to be recompiled

this is why in assembler we separately assemble and link files

all the reasons of above

we often combine C and assembler together - the same linker is used

extern - much like "external" in C, this tells assembler that a variable or procedure is defined in a different file

extrn name:type[,name,type]*

for procedure names, the type can be "near", "far" or "proc" (proc means "near" for small models and "far" for larger models)

for variable names, type can be "byte" (1), "word" (2), "dword" (4), "fword" (6), "qword" (8) or "tbyte" (10)

e.g. extrn print:near, input:far

public - in the file that you actually define a procedure or variable you need to declare that as being public

public print,input

public var1

.data

dw var1 ; need an extrn var1:word to use this in the other file

Unsigned numbers (revisited)

recall that we use carry to detect errors in unsigned arithmetic (and the sign bit for signed arithmetic)

thus for branching, we use ja, jae, jb, jbe, jc, jz etc for jumps on errors (all the ones that don’t rely on the S flag) and jl, jle, jg, jge etc for signed branches

suppose we want to do multiprecision arithmetic i.e. 548fb9963ce7h + 3fcd4fa23b8dh with 8 byte precision, we add with carry (adc) which computes DST=DST+SRC +C so if there was overflow from the previous addition, it gets added to the next word

similarly for subtraction, we use subtract with borrow (sbb) which computes DST=DST - SRC - C

Interrupts

Introduction

we use interrupts to stop executing programs for a while and then return to exactly where we left off with the flag the same

the interrupt vectors reside in a fixed table in memory so they are not linked with the program like subroutines

we might use them, for example

to update a clock - we get a timer interrupt every second and update the time

to update the mouse pointer

to make system calls

note that in each example, the interrupts and program executing can run virtually independently of each other

interrupts

interrupt sequence:

push PSW ; processor status word - contains all flags

clears T and I flag bits

push CS

push IP

gets the CS:IP from interrupt vector table which is at a FIXED memory address, dependent on the interrupt number

jump to interrupt routine at CS:IP

when we return from an interrupt service routine using "iret" the reverse is done and all flags, CS and IP are restored
address for interrupt n is 0000:4*n since each interrupt vector is a far address and takes 4 bytes (32 bits)

there are 256 interrupts available occupying the 1^st 1024 bytes of memory

I bit - interrupt enable bit

hardware interrupts are enabled when I is set and cannot occur if they are clear

can be set and cleared with STI and CLI

(with the exception of a nonmaskable interrupt)

T bit is the trace bit

when set, you get a type 1 interrupt after every instruction

to set do a "pushf, "or" top of stack with 0100h and then popf.

to clear, "pushf", "and" top of stack with 0feffh and then "popf"

mostly used by debuggers which can take snapshots of executing software

the INTO instruction does a type 4 interrupt IF the overflow flag is set

used after arithmetic instructions to jump to an error handler

SEGMENT	REGISTER
CS	IP
SS	SP or BP
DS	BX, SI, DI, 16 bit address
ES	DI for string instructions