X86 Opcode and Instruction Reference

This reference is intended to be precise opcode and instruction set reference (including x86-64). Its principal aim is exact definition of instruction parameters and attributes.

Quick Navigation

coder32, coder32-abc, geek32, geek32-abc

coder64, coder64-abc, geek64, geek64-abc

coder, coder-abc, geek, geek-abc (these contain both x86-32 and x64 instructions).

In contrast to other references, primary source of this reference is an XML document, which guarantees clear and structured information base and therefore ability to extract many various informations such as a list of instructions from requested groups, etc.

The reference is primarily based on Intel manuals as Intel is the originator of x86 architecture. Additionally, it describes undocumented instructions as well. On appropriate places, it gives a notice if an opcode act differently on AMD architecture. Support for Cyrix, NexGen etc. specific instructions is not scheduled at all.

HTML Editions

These editions are available at the moment: The coder suite is intended to more common use and contains the following editions: coder32, coder64, and coder (sorted by opcode), and coder32-abc, coder64-abc, and coder-abc (sorted by mnemonic). The geek suite is intended for deeper research of x86 architectures' instruction set. This includes geek32, geek64, and geek editions (by opcode) and geek32-abc, geek64-abc, and geek-abc editions (by mnemonic). More on the purpose and use of this suite see close below.

Don't get confused by geek(-abc) and coder(-abc) editions. Both of them contains instruction set of both x86-32 and x86-64 architectures. If you don't have a particular reason to use them (such as to view the differencies between the architectures), the other editions would probably suit you better.

Editions coder32 a geek32 relate exclusively to x86-32 architecture. Similarly, editions coder64 and geek64 relate exclusively to x86-64 architecture.

The following chart illustrates the differencies between editions for current release:

Edition coder coder32 coder64 geek geek32 geek64 Supported Architectures both pure x86-32 pure x86-64 both pure x86-32 pure x86-64 Operand Codes traditional traditional traditional special special special Abandoned Instructions no no no yes yes yes Opcode Bitfields Information no no no yes yes yes Instruction Extension Indicated yes yes yes yes yes yes Instruction Group Indicated no no no yes yes yes Present Instructions general yes yes yes yes yes yes system yes yes yes yes yes yes x87 FPU yes yes yes yes yes yes MMX yes yes yes yes yes yes Intel SSE (all) yes yes yes yes yes yes VMX yes yes yes yes yes yes SMX yes yes yes yes yes yes Itanium no no no yes yes yes

The Purpose of Geek Editions in Short

The geek editions contains as much complete information from the source XML document as possible. That's why they may seem quite unclear. You appreciate them only if you need to get to know the instruction set deeply or if you investigate the source XML and you need to visualize it better.

These editions use specific operand codes (which are described in Instruction Operand Codes chapter below). These codes may look strange and obscure at the first sight. The reason to use them is that they hold more information than the more common ones. One example can be operand combination rAX, imm16/32 , such as in instruction ADD rAX, imm16/32 in coder64 edition. One can determine that the destination operand is either ax , eax , or rax , and the source one is either imm16 or imm32 . A problem arises when one needs to determine what magic is behind rax, imm32 combination. If one is just getting started with x64 architecture, it is not clear how exactly is 32-bit immediate added to 64-bit rax . This question is answered by corresponding geek edition, ADD rAX, Ivds in geek64 edition. The immediate value is encoded there using Ivds code. I code means Immediate , v means word or doubleword ( imm16 or imm32 ). The most important part is ds code, which means doubleword, sign-extended to 64 bits for 64-bit operand size . Now is it clear.

As for Itanium-specific instructions, they are added just for the sake of interest - they give a notice that the appropriate opcodes are already used.

Hypertext Reference to Particular Opcode

If you want to refer to particular opcode (in any edition), e. g., 0FA0 PUSH FS , it can be easily achieved this way:

ref.x86asm.net/geek.html#x0FA0 (try it)

It works for opcode extension similarly, e. g., 83 /7 CMP :

ref.x86asm.net/coder32.html#x83_7 (try it)

Using HTML Editions

Since HTML editions can look complicated at first sight, here goes an outline how to work with them. Following examples come from coder32's edition because it is easier to use than geek's editions.

Example: ADC Instruction

Let's start with more known instruction, such as ADC . We find something similar to the following:

|pf|0F|po|so|flds|o|proc|st|m|rl|l|mnemonic|op1 |op2 |op3|op4|iext|grp1|grp2 |tested f|modif f |def f |undef f|f values|description, notes| | | |11| | |r| | | | |L|ADC |r/m16/32|r16/32| | | |gen |arith|.......c|o..szapc|o..szapc| | |Add with Carry |

First column pf (Prefix) is empty. That means the instruction's opcode doesn't contain any fixed prefix.

Next column 0F is just allocated for 0F prefix for multiple-byte opcodes so it is empty.

Next column po (Primary Opcode) holds primary opcode value itself.

Because the instruction's opcode doesn't contain any added byte, the column so (Secondary Opcode) is empty too.

The opcode doesn't contain any specific bits so the column flds (Opcode Fields) is empty.

The column o (Register/Opcode Field) here holds "r", which indicates that the instruction uses "full" ModR/M byte (no opcode extension).

Because this instruction is supported since 8086 processor, proc column (Introduced with Processor) is empty.

This instruction is officially documented so st column is empty too.

Instruction ADC can work on any ring level so the column rl, Ring Level, is empty.

The column x holds "L", which means that LOCK prefix is allowed with this instruction.

Next three columns, mnemonic, op1 and op2 show instruction's syntax. The destination operand of this instruction is set up using bold, what always means the operand is modified by the instruction.

The column iext (Instruction Extension Group) is empty because the instruction doesn't belong to any instruction set extension.

Columns grp1 and grp2 classify the instruction among general arithmetic instructions.

ADC instruction is influenced by CF flag, what represents tested f column.

This instruction influences (overwrites) all status flags. These can be found in next column modif f column.

All of these flags are defined (don't contain random values) so the same flags are in next def f column, and undef f column must be empty.

No flag is set to a fixed value (all modified flags depend on input operands) so f values column is empty.

Last column description, notes contains only a general description of the instruction.

Example: Opcode Extensions

Some opcodes (only a few) depend on Opcode Extension Field in ModR/M byte. Using this field, the opcode is actually extended by three bits. In most cases, different extension of the same opcode means more or less different instruction. An example can be opcode F6 . We choose last three extensions of the opcode:

|pf|0F|po|so|flds|o|proc|st|m|rl|l|mnemonic|op1|op2|op3 |op4 |iext|grp1|grp2 |tested f|modif f |def f |undef f |f values|description, notes| ---------------------------------------------------------------------------------------------------------------------------------------------- | | |F6| | |5| | | | | |IMUL |AX |AL |r/m8| | |gen |arith| |o..szapc|o......c|...szap.| |Signed Multiply | ---------------------------------------------------------------------------------------------------------------------------------------------- | | |F6| | |6| | | | | |DIV |AL |AH |AX |r/m8| |gen |arith| |o..szapc| |o..szapc| |Unsigned Divide | ---------------------------------------------------------------------------------------------------------------------------------------------- | | |F6| | |7| | | | | |IDIV |AL |AH |AX |r/m8| |gen |arith| |o..szapc| |o..szapc| |Signed Divide |

The opcode extension can be a value from 0 through 7. These values are indicated in o (Register/Opcode Field) column. In this example, values 5, 6, and 7 are chosen.

Additionally, this example shows that operands, which are not explicitly used ( AL , AH , and AX operands), are set up using italic. It also shows that DIV and IDIV instructions always destroy all status flags: both modif f and undef f column contain these flags.

Example: One Opcode, More Syntaxes

Some opcodes are represented by more instructions with the same meaning, using different syntaxes. (This doesn't apply to the case when an opcode depends on Opcode Extension field in ModR/M byte. In this case, these instructions act more or less differently). Best known example are conditional jumps, for example JZ/JE , where we find something similar:

|pf|0F|po|so|flds|o|proc|st|m|rl|l|mnemonic|op1 |op2|op3|op4|iext|grp1|grp2 |tested f|modif f|def f|undef f|f values|description, notes | | | |74| | | | | | | | |JZ |rel8 | | | | |gen |branch|....z...| | | | |Jump short if zero/equal (ZF=0)| | | | | | | | | | | | |JE |rel8 | | | | | | | | | | | | |

Each syntax has dedicated row in mnemonic column and in columns with instruction operands.

More complex case is, for example, MOVS/MOVSW/MOVSD instruction:

|pf|0F|po|so|flds|o|proc|st|m|rl|l|mnemonic|op1 |op2 |op3|op4|iext|grp1|grp2 |tested f|modif f|def f|undef f|f values|description, notes | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | |A5| | | | | | | | |MOVS |m16 |m16 | | | |gen |datamov|.d......| | | | |Move Data from String to String| | | | | | | | | | | | |MOVSW |m16 |m16 | | | | |string | | | | | | | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | |A5| | | |03+ | | | | |MOVS |m16/32|m16/32| | | |gen |datamov|.d......| | | | |Move Data from String to String| | | | | | | | | | | | |MOVSD |m32 |m32 | | | | |string | | | | | | |

Here, the opcode's record is complicated by the fact that since 80386 processor, the syntax is extended (thanks to 32-bit operands) with MOVSD mnemonic and MOVS syntax is changed. That's why all four syntaxes have to be split by twos.

More examples with multiple syntaxes: PUSHA/PUSHAD , SHL/SAL , or SLDT .

Example: Undocumented Instruction SETALC

All main editions contain a few undocumented instructions (from the Intel manual point of view). No that in this reference, undocumented doesn't equal invalid. All undocumented instructions mentioned by this reference work well in their shape. It is, for example, SETALC instruction:

|pf|0F|po|so|flds|o|proc|st|m|rl|l|mnemonic|op1|op2|op3|op4|iext|grp1|grp2 |tested f|modif f |def f|undef f|f values|description, notes | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | |D6| | | |02+ |D5| | | |undefined | | | | | | | | |Undefined and Reserved; Does not Generate #UD| --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | |D6| | | |02+ |U6| | | |SALC |AL | | | | |gen |datamov|.......c| | | | |Set AL If Carry | | | | | | | | | | | | |SETALC |AL | | | | | | | | | | | | |

In this case, the documented meaning goes first, as indicated in st column by "D" value. Since this opcode's documented meaning is not a common one, there is additional reference to the description where the opcode is documented. The column mnemonic implies by the value "undefined" (which is set up using italic, which always means here that it is not an original mnemonic) that the documented meaning of this opcode is "undefined and reserved". This is also stated in the last column.

Below goes the undocumented meaning of the opcode - st column holds "U" value. Each undocumented meaning should contain a reference to the description where is the opcode unofficially documented, like in this case.

More examples of undocumented instructions: INT1/ICEBP or TEST .

Columns Description

Quick navigation:

Instruction Operand Codes

These codes come from official codes used in Intel manual Instruction Set Reference, N-Z for Pentium 4 processor, revision 17. The reason of using this particular, out-of-date revision is that the codes from this revision are most apposite ones. In next revisions the codes changed unfortunately. These codes were modified and completed mainly because of the possibility to code operands simultaneously for 64-bit mode. Ideally, it would be the best to make brand new codes, but I'm afraid those wouldn't be widely acceptable.

The State column says if the code is original, added or changed.

The "Geek" part in these tables in the first column indicates codes used in HTML geek's editions and in the source XML document as well. The "Coder" part indicates alternative codes used in HTML coder's editions. These are used also within instruction reference in Intel manual.

Codes for Addressing Method

The following abbreviations are used for addressing methods:

Geek State Description Coder A Original Direct address. The instruction has no ModR/M byte; the address of the operand is encoded in the instruction; no base register, index register, or scaling factor can be applied (for example, far JMP ( EA )). ptr BA Added Memory addressed by DS:EAX , or by rAX in 64-bit mode (only 0F01C8 MONITOR ). m BB Added Memory addressed by DS:eBX+AL , or by rBX+AL in 64-bit mode (only XLAT ). (This code changed from single B in revision 1.00) m BD Added Memory addressed by DS:eDI or by RDI (only 0FF7 MASKMOVQ and 660FF7 MASKMOVDQU ) (This code changed from YD (introduced in 1.00) in revision 1.02) m C Original The reg field of the ModR/M byte selects a control register (only MOV ( 0F20 , 0F22 )). CRn D Original The reg field of the ModR/M byte selects a debug register (only MOV ( 0F21 , 0F23 )). DRn E Original A ModR/M byte follows the opcode and specifies the operand. The operand is either a general-purpose register or a memory address. If it is a memory address, the address is computed from a segment register and any of the following values: a base register, an index register, a scaling factor, or a displacement. r/m ES Added (Implies original E ). A ModR/M byte follows the opcode and specifies the operand. The operand is either a x87 FPU stack register or a memory address. If it is a memory address, the address is computed from a segment register and any of the following values: a base register, an index register, a scaling factor, or a displacement. STi/m EST Added (Implies original E ). A ModR/M byte follows the opcode and specifies the x87 FPU stack register. STi F Original rFLAGS register. - G Original The reg field of the ModR/M byte selects a general register (for example, AX ( 000 )). r H Added The r/m field of the ModR/M byte always selects a general register, regardless of the mod field (for example, MOV ( 0F20 )). r I Original Immediate data. The operand value is encoded in subsequent bytes of the instruction. imm J Original The instruction contains a relative offset to be added to the instruction pointer register (for example, JMP ( E9 ), LOOP )). rel M Original The ModR/M byte may refer only to memory: mod != 11bin ( BOUND , LEA , CALLF , JMPF , LES , LDS , LSS , LFS , LGS , CMPXCHG8B , CMPXCHG16B , F20FF0 LDDQU ). m N Original The R/M field of the ModR/M byte selects a packed quadword MMX technology register. mm O Original The instruction has no ModR/M byte; the offset of the operand is coded as a word, double word or quad word (depending on address size attribute) in the instruction. No base register, index register, or scaling factor can be applied (only MOV ( A0 , A1 , A2 , A3 )). moffs P Original The reg field of the ModR/M byte selects a packed quadword MMX technology register. mm Q Original A ModR/M byte follows the opcode and specifies the operand. The operand is either an MMX technology register or a memory address. If it is a memory address, the address is computed from a segment register and any of the following values: a base register, an index register, a scaling factor, and a displacement. mm/m64 R Original The mod field of the ModR/M byte may refer only to a general register (only MOV ( 0F20 - 0F24 , 0F26 )). r S Original The reg field of the ModR/M byte selects a segment register (only MOV ( 8C , 8E )). Sreg SC Added Stack operand, used by instructions which either push an operand to the stack or pop an operand from the stack. Pop-like instructions are, for example, POP , RET , IRET , LEAVE . Push-like are, for example, PUSH , CALL , INT . No Operand type is provided along with this method because it depends on source/destination operand(s). - T Original The reg field of the ModR/M byte selects a test register (only MOV ( 0F24 , 0F26 )). TRn U Original The R/M field of the ModR/M byte selects a 128-bit XMM register. xmm V Original The reg field of the ModR/M byte selects a 128-bit XMM register. xmm W Original A ModR/M byte follows the opcode and specifies the operand. The operand is either a 128-bit XMM register or a memory address. If it is a memory address, the address is computed from a segment register and any of the following values: a base register, an index register, a scaling factor, and a displacement xmm/m X Original Memory addressed by the DS:eSI or by RSI (only MOVS , CMPS , OUTS , and LODS ). In 64-bit mode, only 64-bit ( RSI ) and 32-bit ( ESI ) address sizes are supported. In non-64-bit modes, only 32-bit ( ESI ) and 16-bit ( SI ) address sizes are supported. m Y Original Memory addressed by the ES:eDI or by RDI (only MOVS , CMPS , INS , STOS , and SCAS ). In 64-bit mode, only 64-bit ( RDI ) and 32-bit ( EDI ) address sizes are supported. In non-64-bit modes, only 32-bit ( EDI ) and 16-bit ( DI ) address sizes are supported. The implicit ES segment register cannot be overriden by a segment prefix. m Z Added The instruction has no ModR/M byte; the three least-significant bits of the opcode byte selects a general-purpose register r

The following abbreviations are used for addressing methods only in case of direct segment registers and are accessible only in HTML geek's editions as segment register's title. As for source XML document, they are used within address atribute of syntax/dst or syntax/src elements. All of them are added:

S2 The two bits at bit index three of the opcode byte selects one of original four segment registers (for example, PUSH ES ). S30 The three least-significant bits of the opcode byte selects segment register SS , FS , or GS (for example, LSS ). S33 The three bits at bit index three of the opcode byte selects segment register FS or GS (for example, PUSH FS ).

Codes for Operand Type

The following abbreviations are used for operand types:

Geek State Description Coder a Original Two one-word operands in memory or two double-word operands in memory, depending on operand-size attribute (only BOUND ). 16/32&16/32 b Original Byte, regardless of operand-size attribute. 8 bcd Added Packed- BCD . Only x87 FPU instructions (for example, FBLD ). 80dec bs Added; simplified bsq Byte, sign-extended to the size of the destination operand. 8 bsq Original; replaced by bs (Byte, sign-extended to 64 bits.) - bss Original Byte, sign-extended to the size of the stack pointer (for example, PUSH ( 6A )). 8 c Original Byte or word, depending on operand-size attribute. (unused even by Intel?) ? d Original Doubleword, regardless of operand-size attribute. 32 di Added Doubleword-integer. Only x87 FPU instructions (for example, FIADD ). 32int dq Original Double-quadword, regardless of operand-size attribute (for example, CMPXCHG16B ). 128 dqp Added; combines d and qp Doubleword, or quadword, promoted by REX.W in 64-bit mode (for example, MOVSXD ). 32/64 dr Added Double-real. Only x87 FPU instructions (for example, FADD ). 64real ds Original Doubleword, sign-extended to 64 bits (for example, CALL ( E8 ). 32 e Added x87 FPU environment (for example, FSTENV ). 14/28 er Added Extended-real. Only x87 FPU instructions (for example, FLD ). 80real p Original 32-bit or 48-bit pointer, depending on operand-size attribute (for example, CALLF ( 9A ). 16:16/32 pi Original Quadword MMX technology data. ( 64 ) pd Original 128-bit packed double-precision floating-point data. ps Original 128-bit packed single-precision floating-point data. ( 128 ) psq Added 64-bit packed single-precision floating-point data. 64 pt Original; replaced by ptp (80-bit far pointer.) - ptp Added 32-bit or 48-bit pointer, depending on operand-size attribute, or 80-bit far pointer, promoted by REX.W in 64-bit mode (for example, CALLF ( FF /3 )). 16:16/32/64 q Original Quadword, regardless of operand-size attribute (for example, CALL ( FF /2 )). 64 qi Added Qword-integer. Only x87 FPU instructions (for example, FILD ). 64int qp Original Quadword, promoted by REX.W (for example, IRETQ ). 64 s Changed to 6-byte pseudo-descriptor, or 10-byte pseudo-descriptor in 64-bit mode (for example, SGDT ). - Changed from 6-byte pseudo-descriptor. sd Original Scalar element of a 128-bit packed double-precision floating data. - si Original Doubleword integer register (e. g., eax ). (unused even by Intel?) ? sr Added Single-real. Only x87 FPU instructions (for example, FADD ). 32real ss Original Scalar element of a 128-bit packed single-precision floating data. - st Added x87 FPU state (for example, FSAVE ). 94/108 stx Added x87 FPU and SIMD state ( FXSAVE and FXRSTOR ). 512 t Original; replaced by ptp 10-byte far pointer. - v Original Word or doubleword, depending on operand-size attribute (for example, INC ( 40 ), PUSH ( 50 )). 16/32 vds Added; combines v and ds Word or doubleword, depending on operand-size attribute, or doubleword, sign-extended to 64 bits for 64-bit operand size. 16/32 vq Original Quadword (default) or word if operand-size prefix is used (for example, PUSH ( 50 )). 64/16 vqp Added; combines v and qp Word or doubleword, depending on operand-size attribute, or quadword, promoted by REX.W in 64-bit mode. 16/32/64 vs Original Word or doubleword sign extended to the size of the stack pointer (for example, PUSH ( 68 )). 16/32 w Original Word, regardless of operand-size attribute (for example, ENTER ). 16 wi Added Word-integer. Only x87 FPU instructions (for example, FIADD ). 16int

The following abbreviations are used for operand types and are accessible only in HTML geek's editions as operand's code title. They are issued to indicate a dependency on address-size attribute instead of operand-size attribute. As for source XML document, they are used within address atribute of syntax/dst or syntax/src elements. All of them are added:

va Word or doubleword, according to address-size attribute (only REP and LOOP families). dqa Doubleword or quadword, according to address-size attribute (only REP and LOOP families). wa Word, according to address-size attribute (only JCXZ instruction). wo Word, according to current operand size (e. g., MOVSW instruction). ws Word, according to current stack size (only PUSHF and POPF instructions in 64-bit mode). da Doubleword, according to address-size attribute (only JECXZ instruction). do Doubleword, according to current operand size (e. g., MOVSD instruction). qa Quadword, according to address-size attribute (only JRCXZ instruction). qs Quadword, according to current stack size (only PUSHFQ and POPFQ instructions).

Current State

In this version, the reference is almost complete. It contains general, system, x87 FPU , MMX, SSE , SSE1 , SSE2 , SSE3 , SSSE3 , SSE4 , VMX , and SMX instructions (both one-byte and two-byte ones). We are working on AMD -specific instructions and Intel AVX instructions now.

The MMX and SSE * instruction classification among groups is considered experimental and may change in future.

Note that from the point of project's progress, modifications of any of HTML editions is almost useless. A HTML edition is just a result of transformation of source XML file, so all modifications need to be done there.

Implementations

Bukowski's disassembler is first public implementation of the XML reference.

Mediana, maintained by Mikae, is table-based x86/x86-64 disassembler engine. However, the transformation from source XML file is not a part of the project.

License

Since version 1.12, the reference is licensed under GPL-3.0. For more see its GitHub repository.

The old license (used up to version 1.12) is not available anymore.

Resources

This reference has been completed using the following resources:

Intel manuals

Sandpile.org

AMD manuals

Intel iAPX 86/88, 186/188 User's manual

Credits

Thanks to all these geeks involved in some way in this project:

Christian Ludloff: maintainer of Sandpile.org site, one of important sources for this project

Martin Mocko a.k.a. vid: many design ideas for HTML editions

Anthony Lopes: great XML and XSL contributions

Aquila: many great contributions

EliCZ: bug reports, design ideas

Cephexin: many great contributions to XML

Miloslav Ponkrác: helped with PHP and JavaScript on this site

William Whistler: valuable reviews and bug reports

Mikae: reviews, bug reports

References

Handily-organized x86 instruction and opcode references

x86オペコードリファレンスその後の後

Referencia de Instrucciones y Códigos de Operación (OPCodes) x86

Download

The source files can be downloaded from GitHub repository.

HTML Editions Files

My contact information is here.

Revisions

2017-02-18 1.12 Various bugfixes. See GitHub releases for details. MazeGen 2010-01-20 1.11 Mostly a bugfix release MazeGen 2009-08-19 1.10 All SSE4 instructions (Aquila contribution)

instructions (Aquila contribution) All VMX instructions

instructions (the only) SMX instruction

instruction All new general instructions: POPCNT , MOVBE

, All new system instructions: XGETBV , XSETBV , RDTSCP , XSAVE , XRSTOR

, , , , Processor code C7 to indicate Core i7

to indicate Core i7 Implicate register operand group xcr (extended control register) added because of XGETBV and XSETBV instructions MazeGen 2009-06-30 1.02 The first version considered stable MazeGen 2008-12-17 1.01β Various bugfixes and updates MazeGen 2008-10-19 1.00β All SSE , SSE2 , SSE3 , and SSSE3 instructions added (Aquila and Cephexin contributions)

, , , and instructions added (Aquila and Cephexin contributions) Alphabetically sorted editions (postfixed with -abc ) MazeGen 2008-05-15 0.40β All MMX instructions added (Anthony Lopes contribution) MazeGen 2008-03-11 0.30β All x87 FPU instructions added, including new ones MazeGen 2007-11-29 0.21β Various changes MazeGen 2007-11-06 0.20β Added coder, coder32, coder64, geek32, and geek64 editions. All main project's files modified. Project's documentation completed. MazeGen 2007-06-04 0.10β First public version MazeGen

(dates format correspond to ISO 8601)