LOGBOOK

HELP

1 / 72
Other keys: showSpace: good1-4: rate0: skip5: flag

Question

In AT&T syntax, what is the operand order and how does it differ from Intel syntax?

Answer

AT&T puts the source first, destination second (mov src, dst); Intel is the reverse (mov dst, src).

AT&T mov src, dst versus Intel mov dst, src with arrows showing source-into-destination for AT&T and the reversed order for Intel

* AT&T lists the source first and destination second (read the comma as an arrow, into); Intel reverses it. *

AT&T Intel Meaning
mov %eax, %ebx mov ebx, eax ebx = eax
add %ecx, %edx add edx, ecx edx = edx + ecx
sub $5, %eax sub eax, 5 eax = eax - 5

Mnemonic: AT&T reads like an arrow: mov %eax, %ebx means "move eax into ebx."

Go deeper:

or press any other key

Question

What prefixes does AT&T syntax use for registers, immediates, and how does it format memory operands?

Answer

Registers are prefixed with %, immediate constants with $, and memory operands are written offset(base, index, scale).

The AT&T memory operand offset(base,index,scale) decomposed into its four parts and mapped to the address MEMbase + index*scale + offset

* offset(base, index, scale) resolves to MEM[base + index*scale + offset]; scale is limited to 1, 2, 4, or 8. *

Element AT&T Intel equivalent
Register %eax eax
Immediate $5, $0x10 5, 10h
Memory 8(%rbp) [rbp + 8]
Scaled (%rdi,%rsi,4) [rdi + rsi*4]
Full 0x10(%rax,%rcx,8) [rax + rcx*8 + 0x10]

Memory formula: offset(base, index, scale) = MEM[base + index*scale + offset]

Scale can only be 1, 2, 4, or 8. Omitted parts default to 0.

Go deeper:

or press any other key