Overview

Assembly language is very simplistic; it views your computer as a combination of memory addresses and a CPU. The memory addresses contain values that can be moved into and out of the CPU registers for logical operations, arithmetic manipulation, or simply for relocation--for a value cannot be moved from one memory location to the next, but rather must be moved from a memory location to a CPU register, then from the CPU register to the destination memory location. The CPU is hard-coded with internal instructions called opcodes which are used for the manipulation and relocation of data values.

Many complex operations are used frequently and sometimes-- for example, in the case of hardware access-- rely on system-specific configuration information stored in the machine BIOS; the DOS and BIOS interrupt services are supplied to ease the burden on the programmer. The use of these services is much like using the standard C library ("stdio.h", et al); the same functionality can be duplicated without the interrupt services, though the coding will be lengthy and difficult.

One thing the high-level coder must keep in mind is that all data is considered to be a memory location of some form or another. Variables, structures, pointers, arrays...in assembly language, these are all just memory locations with a specific content. For example, the memory location

0110:0100 54 68 69 73

would contain the data 54 68 69 73 in hexadecimal, or "This" in ASCII. A pointer to this variable would look like

0110:0299 00 01 10 01

containing the address 01 10 [:] 01 00 in reverse ("little endian", used by Intel processors) notation. Thus, either of the following would put the value "This" into the CPU register EAX:

     mov  eax, [0100]             ; Direct Addresssing
     mov  eax, [0299]             ; Indirect Addressing
     mov  eax, 0100               ; Place value 0100 into eax

Note that the value at 0100 is a string, and hence an array, made up of four one-byte characters taking up four bytes of memory. Each element of the array could be accessed as an offset from the base of the array, or as a specific memory location, as in the following code:

     mov  eax, [0100]              ; eax = "T"
     mov  eax, [0101]              ; eax = "h"
     mov  eax, [0100 + 2]          ; eax = "i"
     mov  eax, [0102]              ; eax = "i"
     mov  eax, [0299 + 2]          ; eax = address of "i"
     mov  eax, [0103]              ; eax = "s"

Needless to say, you won't be dealing with specific memory locations when writing assembly programs. Rather, you will use symbolic names for variables and memory locations which the assembler will later turn into memory addresses. In order to use symbolic names in your code, you must define bytes in memory and to label portions of your code, as follows:

.DATA                              ;start of Data Segment (DS)
MyVariable    db 'This'            ;MyVariable  = 'This' (MyVariable)
MyVariable2   db MyVariable        ;MyVariable2 = 'This' (MyVariable)
ptrMyVariable db offset MyVariable ;ptrMyVariable = address of MyVariable (*MyVariable)
.CODE                              ;Start of Code Segment (CS)
CodeStart:                         ;CodeStart = address of the next line of code
     mov eax,  My Variable         ;eax contains 'This' (MyVariable)
     mov eax,  offset MyVariable   ;eax contains the address of MyVariable (*MyVariable)
     mov ebx,  offset eax          ;ebx contains the address of MyVariable (*MyVariable)
     mov ebx,  eax                 ;ebx contains 'This' (MyVariable)
     mov eax,  offset ptrMyVariable   ;eax contains the address of ptrMyVariable (*ptrMyVariable)
     mov eax,  ptrMyVariable     ;eax contains the address of MyVariable (*MyVariable)
     mov eax,  CodeStart  ;eax contains the address of the code following label CodeStart

Note how when dealing with symbolic names, it is clear that an address and not a value is being placed in the register; therefore the brackets are used to enforce indirect addressing. The keyword offset is often used--and with some compilers, required--to clarify that the address of a variable, rather than its contents, is being referred to.

In assembly language, there are inherently no IFs, ELSEs, or FORs. Instead you must make do with the basic compare and jump commands. The basic form of a conditional statement in assembly is

     cmp  op1, op2
     jne  loc1
loc2:
     misc code
     jmp  CarryOn
loc1:
     more misc code
CarryOn:
     rest of program

This has the effect of saying "if (op1 == op2) then loc2() else loc1()". There are a number of comparison and conditional jump operators, such as test, jnz, jbe, etc, but these all boil down to a simple compare-and-jump-if-equal or compare-amd-jump-if-not-equal condition, with points for style added from there. There is also a loop opcode which will decrement the value in ecx and jump to the given value until ecx==0:

     xor eax, eax      ;set eax == 0
     mov ecx, 100      ;loop 100 times
loop_1:
     add eax, 1
     loop loop_1

This will loop 100 times and execute with eax==100. With these conditional flow statements you should be able to emulate standard high-level flow control statements, albeit somewhat crudely. As examples, a "switch...case" statement would be emulated with multiple "cmp ax, valueX...jmp caseX"; "for 0 to x" would be emulated with "loop_1: mov ecx, x...misc code...loop loop_1", and the standard "if(!x)..." would be emulated with a "mov eax, x; cmp eax, 0; jne code-label".

That should be enough of the philosophy of assembly language. There is a lot more to it, namely a number of different CPU registers and opcodes, various types of memory locations, and of course the extensive DOS and BIOS interrupt services. Finally, there is the art of structuring your source code.

In C, a basic "hello world" program would look as follows:

//----------------------------- Definitions Section
#include             //code module with definition for printf() function

//---------------------------- Data Section
char strHello = "Hello, eh?\n";

//----------------------------- Code Section
main()
{
     printf(%s, strHello);
}

Very simple, very easy. In assembly, things look a bit different:

;----------------------------- Definitions Section
.model small                         ;make this a COM file
;----------------------------- Data Section
.DATA
strHello db 'Hello, eh?',0dh,0ah,$   ;define string, CR/LF, mark end of string with '$'
;----------------------------- Code Section
.CODE
start:
     mov  dx, offset strHello        ;Put address of string in DX
     mov  ah, 09h                    ;Put function# of Int21 service "Display String" in ah
     int  21h                        ;Call Interrupt Service 21
exit:
     mov  ah, 4ch                    ;Put function# of Int21 service "Terminate to DOS" in ah
     int 21h
END

The assembly language program is a little less clear. First, in the definitions section, options must be configured for the memory model of the program (small, compact, medium, large, huge, etc) and other considerations such as target CPU. In the data section, strings must be declared according to how they will be used: often a dollar sign ('$') or a null terminator ('\0') will be appended to the string to mark its end. The code section must have a start: label to mark the program entry point and an END statement to mark the end of the file. This example uses two functions in the DOS Interrupt 21h service: Function 09h (Display String) and Function 4Ch (Terminate to DOS). Note how the function number must be loaded into ah, the lower byte of register EAX, before calling the interrupt. Some interrupts, like higher-level procedures, require that parameters be passed in specific registers: in this example, Int_21h:Func_09h requires that the address of the string be passed in the lower two bytes of the ebx register, or bx.

A more complex example, one that tests to see if the DOS version is 3.0 or above:

.model small
.DATA
strLowerVersion db 'Error! DOS version is lower than 3.0!',0dh,0ah,$
strHigherVersion db 'DOS version is 3.0 or higher.',0dh,0ah,$

.CODE
start:
     xor  eax, eax
     mov  ah, 30h                    ;GetDosVersion function
     int  21h
     cmp  al, 3
     jae  is_3
     mov  dx, offset strLowerVersion
     jmp  exit
is_3:
     mov  dx, offset strHigherVersion
exit:
     mov  ah, 09h                    ;DisplayString function
     int  21h
     mov  ah, 4ch                    ;TerminateToDOS function
     int 21h
END

This program starts by clearing eax with the xor instruction--a shortcut the more conventional mov eax, 0...in the xor operator, each bit is compared with a bit in the same position in the other register, and the first bit is replaced with "0" if the bits are equal, and "1" if the bits are unequal; thus when all bits are equal, all of the bits in the first register are set to 0.

Next comes a call to Int 21h Function 30h, which returns the DOS major version (the "3" in "3.11") in al and minor version (the "11" in "3.11) in ah. The cmp instruction compares al with "3", and is followed by a conditional jump (Jcc...these are a "j" followed by a mnemonic flag ID, such as Jz [Jump-if-Zero], Jnz [Jump-if-Not-Zero], Je [JEqual], Jne, Ja [JAbove], Jb[JBelow], Jc[Jump-if-Carry], etc) Jae [Jump-if-Above-or-Equal] ) which branches to code label "is_3". The two branches of the program ("is_3" and "is_not_3", or default) simply load pointers to different strings into dx, after which the DOS Display String function is called (Int 21h, Funct 09h). At the end, of course, the program is terminated so that the user can regain control of the machine (this can by all means be left out if the program is to be run on someone else's machine...).

Coding with Debug

All versions of DOS and Windows come with debug.exe--an extraordinary 20K file that allow you to write code directly into memory, edit disks and partition tables, debug software, and compile COM programs. Debug has absolutely no user interface, like adb (or, to speak out of context, vi ;) in the Unix world, yet it has a very simple set of mnemonic commands:

? HELP       display debug commands
a ASSEMBLE   assemble 8086/87/88 mnemonics to binary
c COMPARE    compare two portions of memory
d DUMP       display the contents of an area of memory
e ENTER      enter data in memory at specificed address
f FILL       fill range of memory with specified values
g GO         run executable
h HEX        perform hex math
i INPUT      input 1 byte from specified port
l LOAD       load contents of file or disk sector
m MOVE       copy contents of a bloack of memory
n NAME       specify file to L or W
o OUTPUT     output one byte to port
p PROCEED    execute a loop, reps, int or subroutine
q QUIT       exit debug
r REGISTER   display/alter registers
s SEARCH     search memory for pattern of bytes
t TRACE      execute one instruction, then display registers/flags/cs:IP
u UNASSEMBLE disassemble binary to 8086/87/88 mnemonics
w WRITE      write file to disk
xa XALLOC    allocate expanded memory
xd XDEALLOC  deallocate expanded
xm XMAP      map expanded memory pages
xs XSTATUS   display status of expanded memory

"Live" Coding

When running debug, you can assemble code directly into memory using the a command. It is best to start assembling at offset 100h, though by no means necessary; however doing so will get you into the habit by the time COM file coding comes around, a few paragraphs down.

Start debug and type a100 at the "-" prompt, then enter the following:

mov dl, 48
mov ah, 2
int 21
mov dl, 65
int 21
mov dl, 79
int 21
mov dl, 21
int 21
mov dl, 0d
int 21
mov dl, 0a
int 21
int 20

Be sure to hit enter at the end to complete your code entry. Note that Int 21h, Func 02h is the Display Character function, with the character to be displayed loaded into dl. Therefore, 02h (you may note that debug assumes hexadecimal numbers) is loaded into ah and kept there while successive values are loaded into dl--the hex values for certain ascii characters which, when you run the program by typing "g" at the "-" prompt, will spell

Hey!

A long way to go for nothing, to be sure. The Int 20h at the end is an older Terminate To DOS function which is useful in "debug programming" because it requires no parameters (ergo one less line to type).

It is considered easier to define your data at startup in strings, rather than outputting it one character at a time. To do so, you must initiate your debug code with a jmp past the data area, then you must refer to the string explicitly (not by a symbolic name) when preparing the Display String service. The following code, which you can enter as before by typing "a100" at the "-" prompt and running with the "g" command, should become clearer as you type it (i.e., watch the address of the db statement):

jmp 0114
db 'Hey! ASM rocks!'0d,0a'$'
mov dx, 102
mov ah, 9
int 21
int 20

Once again, using 0D and 0A as a CR/LF to avoid screwing up the console display. 102 is the address of the string (the jmp statement takes two bytes), and 114 is the start of the code. At this point one might be tempted to ask, how do you know the offset of the code to jump to when defining the data? Trial and error, naturally; of course, if one wanted to waste a few meager bytes of RAM, one could start with a jmp 200, enter a few strings which will hopefully be less than 100h (unless one is coding a VB app through debug ;), finish the assembling with a carriage return, and then re-entering the assembler mode with the a200 (assemble at 200h) command.

But enough bare-metal programming; these are not the days of mainframes after all. We are a civilized people, and we have a compiler! Known affectionately as...debug.

Using debug as a compiler

Debug can be used more or less as a standard assembler by preparing .asm files beforehand and invoking them through standard dos redirection, i.e.

debug.exe < hello.asm

A text file can be prepared for assembly as follows:

-----hello.asm-----
a100
jmp 0114
db 'Hey! ASM rocks!'0d,0a'$'
mov dx, 102
mov ah, 9
int 21
int 20

rcx
1d
n hello.com
w
q

This is essentially a script of commands you would enter in debug; it can be called from a batch file with the line debug < hello.asm. The first line stands for "Assemble at 100h", or "start coding a com file". At this point each line of asm code you enter will be assembled into the final file, starting with address 100h. Note that the string ends with a 0D + 0A CR/LF combo, as well as the requisite '$'; the 102 loaded into dx is the address of the first byte of the string, following which there is a call to Function 09h of Interrupt 21h (Display '$'-terminated string) and a call to Interrupt 20h (Terminate) to return control to DOS.

The blank line at the end of the code is important as it signifies that the code input is over. Next you must edit the register CX (using the "rcx" command) to reflect the byte count of the file; the "rcx" goes on one line and the number of bytes to write--1D--goes on another. The file must be named of course, which is taken care of in the "n hello.com" line, then written with the "w" line (remember, each line in a dos text file has a CR/LF, which is the equivalent of pressing ENTER when writing scripts like this). Finally, debug is exitted with the "q" command followed by a blank line (the last is very important, for without it debug will lock up and receive no further input, which as you remember is coming from a file).

Note that this method is a little tricky as you do not know the address of each line while you are writing the code. Thus, the starting JMP statement is usually a guess (e.g. JMP 1FF) that is fixed later; ditto for any jumps or data references in the code. A good practice would be to write the asm file as follows:

hello.asm
a100
jmp FFFF
...
mov dx, FFFF
...
int 20
...

Then, after running the .asm file through debug, unassemble the resulting com file in debug and fix the jumps:

debug hello.com
-u
0C93:0100 EB12          JMP     FFFF
0C93:0102 48            DEC     AX
0C93:0103 65            DB      65
0C93:0104 7921          JNS     0127
0C93:0106 204153        AND     [BX+DI+53],AL
0C93:0109 4D            DEC     BP
0C93:010A 20726F        AND     [BP+SI+6F],DH
0C93:010D 63            DB      63
0C93:010E 6B            DB      6B
0C93:010F 7321          JNB     0132
0C93:0111 0D0A24        OR      AX,240A
0C93:0114 BA0201        MOV     DX,FFFF
0C93:0117 B409          MOV     AH,09
0C93:0119 CD21          INT     21
0C93:011B CD20          INT     20
0C93:011D 46            INC     SI
0C93:011E EBBB          JMP     00DB
-a100
0C93:0100 JMP 114

-a114
0C93:0114 mov DX,102

-w
-q

Notice how the data between 102 and 114 is unassembled as code; this is because debug is a "dumb" (i.e., not following the flow of execution) disassembler. However, with practice--and good habits like placing all data at the start of your code, therefore enabling you to simply count the number of bytes (or characters) following the DB in order to determine where the first JMP should point to--you will be able to interpret such crudely disassembled code with ease. Or, to go the easier route, pad each of your data declarations with two or three nop's, which should stand out enough to make differentiating the strings a trivial problem.

Alas, the days of relying on debug are over. Now the closest you can get is NASM (just kidding ;), as many of the commerical assemblers are trying to make things easier for the programmer by allowing such luxuries as multiple segments, symbolic names, decimal integers, and code labels (all of which, thanks to this past section, you will now be able to really appreciate).

Templates

It is often useful to have a base program to work from...something more useful than the banal "hello"-style programs that mimic no known functionality in the real world. What follows are two templates, one for a .COM and one for an .EXE file, which can be used as building blocks upon which to build your own assembly-language programs. Each template, if compiled as-is, will produce a program which will check the command-line parameters for "-h" or "-v" (case insensitive); on "h" it will display a help screen, on "v" it will display the DOS version currently running, and on neither it will give an error message and the help screen. Quick, easy, and ready to be mutated into your own command-line option utilities...

DOS COM File Template

.286
.model tiny                      ; COM file: use EXE2BIN or link with TLINK /t
                                 ; Set up some PSP definitions for later use
NUM_ARGS        equ     80h      ; 80h = # of Command Line Arguments
ARGS            equ     81h      ; 81-FFh = Arguments

.CODE
org  100h                        ; load image at 100h

start:
        jmp  CodeStart           ; Jump over data declarations
;               Replace from here with your own data
szNoArgs        db      'Incorrect number of arguments',0Dh,0Ah, '$'
szHelp          db      'Command-Line Arguments:',0Dh,0Ah
                db      '-h : Display this Help screen',0Dh,0Ah
                db      '-v : Display DOS Version',0Dh,0Ah,'$'
szDOSVer        db      'DOS Version X.X ',0Dh,0Ah,'$'

;===========================================
;start of program, equivalent to main() in C
Codestart:
;             Replace from here with your own command-line parser
        mov  si, ARGS + 2    ;Get third byte of CmdLine into al
        lodsb
        cmp  al, 48h            ;is it "H" ?
        je  callHelp
        cmp  al, 68h            ;is it "h" ?
        je  callHelp
        cmp  al, 56h            ;is it "V" ?
        je  callGetDosVer
        cmp  al, 76h            ;is it "v" ?
        je  callGetDosVer
;             Handler routines...Replace these with your own handlers
callNoArgs:
        mov  dx, offset szNoArgs
        mov  ah, 09h
        int  21h                ;note follow-through to display Help
callHelp:
        mov  dx, offset szHelp
        mov  ah, 09h
        int  21h
        jmp  exit
callGetDosVer:
        mov  ah, 33h            ;Get DOS Verison Number
        mov  al, 06h            ;Int 21h, Func 33-06
        int  21h
        add  bl, 30h            ;convert hex to ASCII decimal number
        mov  szDOSVer + 12, bl
        add  bh, 30h            ;convert hex to ASCII decimal number
        cmp  bh, 39h            ;is Minor Version # less than 10?
        jle  OutputDosVer       ;yes, keep it for output
        mov  bl, bh
        sub  bl, 0Ah            ;Find "ones" column by subtracting 10 from version byte
        mov  szDOSVer + 15, bl
        mov  bh, 31h            ;set "tens" column to "1"
OutputDosVer:
        mov  szDOSVer + 14, bh
        mov  dx, offset szDOSVer
        mov  ah, 09             ;OutPut String
        int  21h                ;Int21h Func 09
exit:
        mov ah,4ch              ;Terminate to DOS
        int 21h                 ;Int 21h Func 4C
        ;End of main() routine
end     start

Notes: The file begins with ".286" to specify the miniminum processor needed, followed by a ".model" directive with a "tiny" specification (tiny == COM file). Some useful equates --like #define's in C-- provide useful definitions for locations in the Program Segment Prefix of the COM file. After that, the ".CODE" directive marks the start of the executable code, followed by an "org 100h" directive (like a100 in debug, this causes the image to be loaded at 100h, just after the PSP) and a "start:" label to mark the program entry point.

The program immediately jumps over the data declarations and starts loading the command-line parameters with the mov si, ARGS + 2 instruction. This is merely a setup for the lodsb (LOaD String Byte) instruction that follows; lodsb loads a byte from si into al. The byte loaded is the third byte of the command-line arguments (the first is a space, the second is a "-"), and it is compared with the hexadecimal values of the ASCII characters h, H, v, and V (now you know what those weird ASCII tables in the back of your old DOS manuals were for, eh?).

The rest of the program is fairly straightforward, merely a few Display String calls, except for the GetDosVersion area. The problem here is converting the hexadecimal major and minor versions ( version [0-f].[0-f] ) into decimal for output. The major version is no problem; DOS is only on 7.0 and so adding 30h to the major version number will bump it nicely into the ASCII decimal-digits areas. The same goes for the minor version...until v.10-15 comes up. This is bypassed by adding a "tens" digit which is always set to 1 (to make things a little simpler; this was tested on a Win95 machine...DOS 7.10 ;), and subtracting 10 (0Ah) from the "ones" digit to bring it back in the realm of the 30's (the flaw here is that only the first nibble, or half-byte, of the minor version number is being treated...but it is sufficient for the exercise). The converted values are then written directly to their place in the string using offsets which represent the number of bytes from the start of the string that the value is to be written at.

DOS EXE File Template

.286
.model small
.stack 200h

PSP segment at 00h                      ; Define PSP as a segment for easy access
        org     2ch                     ; 2Ch = Environment Field (not used)
ENVIRON_PTR     dw      ?
        org     80h                     ; 80h = Command Line Arguments Field
NUM_ARGS        db      ?               ; Byte 1 = # of Arguments
ARGS            db      127 dup(?)      ; Bytes 2-128 = Command Line Args
PSP ends

.DATA              ; Replace from here with your own data
szNoArgs        db      'Incorrect number of arguments',0Dh,0Ah, '$'
szHelp          db      'Command-Line Arguments:',0Dh,0Ah
                db      '-h : Display this Help screen',0Dh,0Ah
                db      '-v : Display DOS Version',0Dh,0Ah,'$'
szDOSVer        db      'DOS Version X.X ',0Dh,0Ah,'$'

.CODE
;===========================================
;start of program, equivalent to main() in C
start:
assume  es:PSP
        mov     ax,@data                ;set segment registers
        mov     ds, ax
        ;                 Replace from here with your own command-line parser
        mov  al, es:ARGS + 2    ;Get third byte of CmdLine
        cmp  al, 48h            ;is it "H" ?
        je  callHelp
        cmp  al, 68h            ;is it "h" ?
        je  callHelp
        cmp  al, 56h            ;is it "V" ?
        je  callGetDosVer
        cmp  al, 76h            ;is it "v" ?
        je  callGetDosVer
callNoArgs:
        call  NoArgs            ;note follow-through to display Help
callHelp:
        call  Help
        jmp  exit
callGetDosVer:
        call  GetDosVer
exit:
        mov ah,4ch              ;Terminate to DOS
        int 21h                 ;Int 21h Func 4C
;===========================================
;End of main() routine

;                     Procedures: Replace these with your own routines
;-------------------------------------------
;GetDosVer:  Gets DOS version, prepares it for output, displays
;            output to screen and returns
GetDosVer       proc
        mov  ah, 33h            ;Get DOS Verison Number
        mov  al, 06h            ;Int 21h, Func 33-06
        int  21h
        add  bl, 30h            ;convert hex to ASCII decimal number
        mov  szDOSVer + 12, bl
        add  bh, 30h            ;convert hex to ASCII decimal number
        cmp  bh, 39h            ;is Minor Version # less than 10?
        jle  OutputDosVer       ;yes, keep it for output
        mov  bl, bh
        sub  bl, 0Ah            ;Find "ones" column by subtracting 10 from version byte
        mov  szDOSVer + 15, bl
        mov  bh, 31h            ;set "tens" column to "1"
OutputDosVer:
        mov  szDOSVer + 14, bh
        mov  dx, offset szDOSVer
        mov  ah, 09             ;OutPut String
        int  21h                ;Int21h Func 09
        ret
GetDosVer       endp

;-------------------------------------------
;Help: Prints the message in szHelp and returns
Help            proc
        mov  dx, offset szHelp
        mov  ah, 09h
        int  21h
        ret
Help            endp

;-------------------------------------------
;NoArgs : Prints the error message in szNoArgs and returns
NoArgs          proc
assume DS: DGROUP
        mov  dx, offset szNoArgs
        mov  ah, 09h
        int  21h
        ret
NoArgs          endp

end     start

Notes: EXE files allow a bit more flexibility. This example has 3 segments: the PSP (defined for convenience; it will not be present in the final executable), the data segment, and the code segment. The PSP segment is organized to allow certain parameters to be readily accessible; the code segment (beginning at the "start:" label) demonstrates the advantage of this definition with the line mov al, es:ARGS + 2. This is followed by the asm equivalent of a switch...case statement (very inelegant, to be sure) to handle the command-line options. This template also demonstrates the use of procedures to break up the code and make it more modular (since procedures can be stored in separate .asm files and included into the main asm file using the include statement): the procedures contain code very similar to that in the COM file template.

Registers

The first thing you will need to become familiar with in order to learn Assembly Language (ASM) is the idea of a register. A register is a specific piece of memory located within the cpu itself (it is not counted as part of your RAM), usually from 8 to 32 bits in size, that is used to store information for CPU processing. Some registers can only hold certain information--such as the memory address of the line of code currently being executed--while other registers are "scratch-pad" registers that can be used for the dynamic storage or manipulation of data.

The General Purpose registers are EAX, EBX, ECX, and EDX. These are 32-bit registers that have evolved from 8-bit and 16-bit registers, so their lowest 16 bits (0-15) can be accessed as the AX, BX, CX, and DX registers, each of which can further be divided into 8-bit H (high) and L (low) registers, such that AX can be divided into AH and AL. Remember that 8 bits is one byte, so that AH and AL are each 1 byte, AX is two bytes (or 1 word), and EAX is four bytes (2 words or 1 double word, or dword). These registers are used for manipulating data, such as variable compares (MOV EAX, 003F; MOV EBX, [EBP-04); CMP EAX, EBX) or mathematical operations (MOV AX,2; MOV BX,4; ADD AX,BX), as well as for writing a value to a memory location, for a memory location cannot be written to directly but can be "dumped" the contents of a register. Note that CX is often used as a Count register; in fact the LOOP instruction in assembly will decrement CX with each "looping" and will end the loop when CX=0. Also, AH is used to determine what service of an interrupt function (discussed below) is to be used when the INT (interrupt) call is generated.

The Segment Registers are CS, DS, ES, FS, GS, and SS. These registers are all 16 bits (0-15) and contain the first half of a segment:offset memory address (segment:offset addresses are converted by the OS kernel to physical memory locations, for the OS will move code and data all over hell and back in the course of "paging" and "memory management"; thus you will always deal with segment:offset addresses when accessing memory, as physical memory locations are in a constant state of flux that is only handled or understood by the OS). CS is the Code Segment, of the segment containing the executable code of the program currently being executed (note that "currently being executed" is determined by what program has its code in the CS:IP of the CPU; this can be changed and managed by the OS, though it still seems to be an example of the serpent biting its own tail...); DS is the Data Segment of the program currently being located (i.e., string tables, constants, etc); SS is the Stack Segment of the program currently being executed (the stack being the dynamic data area of the program, where variables and "scratch" information are kept); and ES, FS and GS are all extra data segments that may or may not be used, depending on the memory model of the currently executing program.

The Offset Registers are EIP, ESP, EBP, ESI, and EDI. These are 32-bit registers whose lower halves can be accessed as the 16-bit registers IP, SP, BP, SI, and DI. EIP is the Instruction Pointer, and contains the offset of the line of code to be executed next (such that CS:IP forms the complete address); ESP is the Stack Pointer, and contains the address of the "top" of the stack, or where the next item pushed onto the stack will go to (with the complete address being SS:SP); EBP is the Base Pointer, and contains a memory address in the stack from which data in the stack can be referenced (to quote Fravia, when examining a program's code, "function parameters have positive offsets from BP [eg, BP 04], local variables have negative offsets from BP [eg, BP-04]"; the complete address referenced by this register would be SS:BP)"; ESI is the Source Index, and contains the source of data in a "block move" (the complete address being DS:SI); and EDI is the Destination Index, and contains the destination of data in a "block move" (the complete address being ES:EDI).

The Control Registers are CR0, CR1, CR2, and CR3. These are 32-bit registers that are responsible for things like processor mode (real or protected or V86), paging, FPU emulation, etc.. They are accessible only to Ring-0 (kernel) programs; if you attempt to write to a CR with a Ring-3 (application) you will cause a GPF.

The Debug Registers are DR0, DR1, DR2, DR3, DR4, DR5, DR6, and DR7, they are 32-bits in size ( bits 0-31). DR0 through 3 contain breakpoint addresses, the rest set what happens when a breakpoint is activated (i.e., they determine how a debug exception is generated). Apparently you can access these from DOS or using the Dos Protected-Mode Interface in Windows, if you are intent on writing a debugger.

The Test Registers are TR6 and TR7. These are 32-bit registers that are used only to test the memory-paging system in an OS. If you are writing your own operating system, these will be handy for determining whether or not your memory management is up to snuff.

The protected mode Memory Management Registers are TR for the TSS (Task State Segment), LDTR for the LDT (Local Descriptor Table), IDTR for the IDT (interrupt Descriptor Table), and GDTR for the GDT (Global Descriptor Table). TR and LDTR are 68-bit registers, the first 20 bits setting the TSS or LDT limit, the next 32 bits setting the TSS or LDT base address, and the final 16 bits setting the TSS or LDT selector. IDTR and GDTR are 52-bit registers, with the first 20 bits setting the IDT or GDT limit, and the last 32 bits setting the IDT or GDT base address. These registers are used in conjunction with CR0 by the kernel to manage tasks, interrupts, and memory allocation.

The Flag Register is EFLAG. This is a 32-bit register whose lower 16 bits (0-15) contain the Carry, Parity, Auxilliary, Zero, Sign, Trap, Interrupt Enable, Direction, Overflow, I/O Privelege Level, and Nested Task flags; bits 16-31 contain the Resume and Virtual 8086 mode flags, as well as a number of reserved flags. Each flag bit can be either on ("1") or off ("0"), indicating that the flag is set or is not set. If the result of a comparison returned 0, for example, the Zero flag would be set ("1"), and a subsequent JZ (Jump if Zero) instruction would be executed.

Note that these are the registers common to the i386 processor and above; every subsequent processor will have additional specialized registers that allow expanded processor functions. Additional information about regsiters, and about the PC in general, can be obtained from Addison Wesley's The Indispensable PC Hardware Book, just released in its 3rd edition in mid-1997 and worth every penny of its $42.95 US price..

Soft-Ice Interlude: When you break into Soft-Ice, the state of the registers for the current process (identified at the bottom-left of the screen) will be displayed at the top of the screen--if it is missing, you can toggle the register display on by typing "WR".

immediate value: an integer such a 09h (e.g. mov edx, 09h)
memory value: a value stored at a memory location, such as DS:Variable1 (e.g. mov edx, DS:Variable1)
register value: a value stored in a register, such as EAX (e.g. mov edx, eax)
relative offset: a value to be  calculated from the end of the current instruction, or a code label (e.g. jnz Exit or jmp 015h)

JA      short/near Jump if Above:             CF=0 and ZF=0
JAE     short/near Jump if Above/Equal:       CF=0
JB      short/near Jump if Below:             CF=1
JBE     short/near Jump if Below/Equal:       CF=1 or ZF=1
JC      short/near Jump if Carry:             CF=1
JCXZ    short      Jump if CX=0               CX=0
JE      short/near Jump if Equal:             ZF=1
JECXZ   short      Jump if ECX=0              ECX=0
JG      short/near Jump if Greater:           ZF=0 and SF=OF
JGE     short/near Jump if Greater/Equal:     SF=OF
JL      short/near Jump if Less:              SF <> OF
JLE     short/near Jump if Less/Equal:        ZF=1 and SF <> OF
JNA     short/near Jump if Not Above:         CF=1 or ZF=1
JNAE    short/near Jump if Not Above/Equal:   CF=1
JNB     short/near Jump if Not Below:         CF=0
JNBE    short/near Jump if Not Below/Equal:   CF=0 and ZF=0
JNC     short/near Jump if Not Carry:         CF=0
JNE     short/near Jump if Not Equal:         ZF=0
JNG     short/near Jump if Not Greater:       ZF=1 or SF <> OF
JNGE    short/near Jump if Not Greater/Equal: SF <> OF
JNL     short/near Jump if Not Less:          SF=OF
JNLE    short/near Jump if Not Less/Equal:    ZF=0 and SF=OF
JNO     short/near Jump if Not Overflow:      OF=0
JNP     short/near Jump if Not Parity:        PF=0
JNS     short/near Jump if Not Sign:          SF=0
JNZ     short/near Jump if Not Zero:          ZF=0
JO      short/near Jump if Overflow:          OF=1
JP      short/near Jump if Parity:            PF=1
JPE     short/near Jump if Parity Even:       PF=1
JPO     short/near Jump if Parity Odd:        PF=0
JS      short/near Jump if Sign:              SF=1
JZ      short/near Jump if Zero:              ZF=1

              Reference Table
operation        src     dest    result
   AND            1        1       1
                  1        0       0
                  0        1       0
                  0        0       0   
   OR             1        1       1
                  1        0       1
                  0        1       1
                  0        0       0   
   XOR            1        1       0
                  1        0       1
                  0        1       1
                  0        0       0  
   NOT            0       N/A      1
                  1       N/A      0