From aldeid
Jump to navigation Jump to search
You are here:


The mov instruction is used to move data into registers or RAM. In other words, it is used to read and write into memory.

MOVSX (Move with sign extension) and MOVZX (Move with zero extension) are special versions of the mov instruction that perform sign extension or zero extension from the source to the destination. This is the only instruction that allows the source and destination to be different sizes. (And in fact, they must be different sizes).

MOVSXD: (MOVSXD r64, r/m32) Move doubleword to quadword with sign-extension.

# Emulate the movsx machine instruction in python
def movsx_32(a):
    return ((a & 0x80) << 24) | (a & 0x7F)

def movsx_16(a):
    return ((a & 0x80) << 8) | (a & 0x7F)


mov destination, source


mov eax, ebx
Copies the content of EBX into EAX register. Since EBX equals 0x00403A40, EAX will also equal 0x00403A40 after the instruction.
mov eax, [ebx+8]
Copies the 4 byte at memory location specified by the the result of the operation [ebx+8] into EAX register. After this instruction, EAX will equal 0x0012C140.
 +------------------+                  +------------+
 | Registers        |                  | Memory     |
 +------------------+                  +------------+
 | EAX = 0x00000000 |       0x00403A40 | 0x7C81776F |
 | EBX = 0x00403A40 |       0x00403A44 | 0x7C911000 |
 +------------------+       0x00403A48 | 0x0012C140 |
                            0x00403A4C | 0x7FFDB000 |
mov     bx, 0C3EEh  ; Sign bit of bl is now 1: BH == 1100 0011, BL == 1110 1110
movsx   ebx, bx     ; Load signed 16-bit value into 32-bit register and sign-extend
                    ; EBX is now equal FFFFC3EEh
movzx   dx, bl      ; Load unsigned 8-bit value into 16-bit register and zero-extend
                    ; DX is now equal 00EEh