Index
> Windows > sar vs shr |
| Author |
|
|
AsmGuru62 02 Jul 2015, 17:59
Where is # of bits to shift?
Should it be: Code: sar dword [ebp-48], #ofbits |
|||
02 Jul 2015, 17:59 |
|
|
cod3b453 02 Jul 2015, 23:25
AsmGuru62 wrote: Where is # of bits to shift? Code: sar dword [ebp-48],1  |
|||
|
02 Jul 2015, 23:25 |
|
|
sunnysigil 21 Aug 2015, 11:20
yq8 wrote: Yo, sar and shr are not the same instruction since shr only shifts in 0s. sar is used when dealing with signed numbers as it will shift from the right side in 1's if negative or 0's if it's positive. |
|||
|
21 Aug 2015, 11:20 |
|
|
shutdownall 21 Aug 2015, 17:32
There are differences between "shift logical right" (shr) and "shift arithmetical right" (sar). See manual.
|
|||
|
21 Aug 2015, 17:32 |
|
|
catafest 27 Aug 2015, 20:20
The sar instruction shifts all the bits in the destination operand to the right one bit.
I think you need to know that: sar ax, 1 ;Signed division by 2 sar ax, 2 ;Signed division by 4 sar ax, 3 ;Signed division by 8 sar ax, 4 ;Signed division by 16 sar ax, 5 ;Signed division by 32 sar ax, 6 ;Signed division by 64 sar ax, 7 ;Signed division by 128 sar ax, 8 ;Signed division by 256 - sar truncates results toward the smaller result and idiv instruction always truncates towards zero! - sar instruction lets you sign extend one register into another register of the same size, see this example: mov cx, bx sar cx, 15 I think your answer is this: sar eax,10h mov dword ptr [ebp-8],eax tell me if I wrong ... |
|||
|
27 Aug 2015, 20:20 |
|
|
reyuki 10 Feb 2025, 23:25
are 'shr' and 'shl' instructions from x86-64 or is this a special feature provided by fasm that is executed at assembly-time?
i question this because i saw a similar example in assembly code written for nasm and when i tried (just guessing) to port the macro like this: Code: macro make_port portnum { db portnum shr 8, portnum and 0xff } it worked without any problem. i didn't expect this because this example is different from what is in the manual, why is the usage i showed still a valid syntax? |
|||
|
10 Feb 2025, 23:25 |
|
|
reyuki 10 Feb 2025, 23:32
to answers my first question:
I guess when it used like that, it's a feature from fasm and executed at assembly-time, I can confirm this by using objdump: Code: $ objdump -m i386 -M intel -b binary --start-address=0x78 -D main.bin main.bin: file format binary Disassembly of section .data: 00000078 <.data+0x78>: 78: 55 push ebp 79: 48 dec eax 7a: 89 e5 mov ebp,esp 7c: 48 dec eax 7d: 83 ec 10 sub esp,0x10 80: bf 02 00 00 00 mov edi,0x2 85: be 01 00 00 00 mov esi,0x1 8a: ba 00 00 00 00 mov edx,0x0 8f: b8 29 00 00 00 mov eax,0x29 94: 0f 05 syscall 96: 89 45 fc mov DWORD PTR [ebp-0x4],eax 99: b8 31 00 00 00 mov eax,0x31 9e: 8b 7d fc mov edi,DWORD PTR [ebp-0x4] a1: 48 dec eax a2: c7 c6 03 01 40 00 mov esi,0x400103 a8: ba 10 00 00 00 mov edx,0x10 ad: 0f 05 syscall af: 8b 7d fc mov edi,DWORD PTR [ebp-0x4] b2: be 00 00 00 00 mov esi,0x0 b7: b8 32 00 00 00 mov eax,0x32 bc: 0f 05 syscall be: 8b 7d fc mov edi,DWORD PTR [ebp-0x4] c1: 31 f6 xor esi,esi c3: 31 d2 xor edx,edx c5: b8 2b 00 00 00 mov eax,0x2b ca: 0f 05 syscall cc: 89 45 f8 mov DWORD PTR [ebp-0x8],eax cf: 8b 7d f8 mov edi,DWORD PTR [ebp-0x8] d2: be 13 01 40 00 mov esi,0x400113 d7: ba 10 00 00 00 mov edx,0x10 dc: b8 00 00 00 00 mov eax,0x0 e1: 0f 05 syscall e3: 85 c0 test eax,eax e5: 74 d7 je 0xbe e7: 8b 7d f8 mov edi,DWORD PTR [ebp-0x8] ea: be 13 01 40 00 mov esi,0x400113 ef: 89 c2 mov edx,eax f1: b8 01 00 00 00 mov eax,0x1 f6: 0f 05 syscall f8: eb d5 jmp 0xcf fa: 31 ff xor edi,edi fc: b8 3c 00 00 00 mov eax,0x3c 101: 0f 05 syscall 103: 02 00 add al,BYTE PTR [eax] 105: 1f pop ds 106: 90 nop 107: 7f 00 jg 0x109 109: 00 01 add BYTE PTR [ecx],al 1F 90 at offset 105 prove my assumption (it assembled at assembly-time instead of as assembly instruction) |
|||
|
10 Feb 2025, 23:32 |
|
|
revolution 10 Feb 2025, 23:38
Opcodes always appear first (after any label) and cannot appear within an expression.
So SHL, SHR, AND, OR, XOR are used for arithmetic within expression. Code: and eax, 42 and 33 xor 21 or 1 ; first AND is the opcode, the others are all numerical operators |
|||
|
10 Feb 2025, 23:38 |
|
|
reyuki 11 Feb 2025, 00:03
Ah, I see... thanks for the explanation!
anyway I just notice that objdump seems print some false-positive interpretation compared to gdb's output (disassemble /r $rip, $rip + 0x8b + 16), like the dec eax, do you know why objdump behave like that? Last edited by reyuki on 11 Feb 2025, 00:49; edited 1 time in total |
|||
|
11 Feb 2025, 00:03 |
|
|
reyuki 11 Feb 2025, 00:04
Eh nevermind, I found that add additional -M option fix the issue:
Code: objdump -m i386 -M intel -M x86-64 -b binary --start-address=0x78 -D main.bin just notice the register name is different, I think that is the problem |
|||
|
11 Feb 2025, 00:04 |
|
< Last Thread | Next Thread > |
Forum Rules:
|