x86 Addressing Modes

1
x86 Addressing Modes

• LCDR Eagle

2
What is an Addressing Mode?

• Instructions require data
• Addressing modes describe the manner in which you
  access that data
• Exist on all CPUs
• Mode names vary from one CPU to another
• But we can identify some common features among
  them

3
Available x86 Modes

• 12 Addressing Modes
• Immediate
• Register operand
• Displacement (Direct)
• Base (Register Indirect)
• Base with displacement
• Scaled index with displacement
• Base with index and displacement
• Base scaled index with displacement
• Relative

4
Immediate

• Data is contained within the instruction itself
• Assembly
• mov eax, 1
• In this case
• the number 1 is the source operand
• eax is the destination operand
• Immediate addressing is used for the source
  operand
• Machine
• B8 01 00 00 00

5
Byte Ordering

• The x86 is a little endian architecture
• For multi-byte data, the least significant byte
  is stored at the lowest memory address
• Example 0x11223344 stored at address 1000

1000
1001
1002
1003
6
Register Addressing

• The data required by the instruction resides in a
  register
• In the example
• mov eax, 1
• Register addressing is used for the destination
  operand
• Fastest addressing mode available

7
Displacement (Direct)

• The memory address of the data is contained in
  the instruction
• Example
• Load eax with the 4 byte value located at 0x1000
• mov eax, 0x1000 nasm syntax
• Machine
• 8B 05 00 10 00 00

8
Displacement (cont)
0x0FF8
mov eax, 0x1000
0x0FFC
0x1000
0x1004
0x1008
0x100C
0x11223344
eax
9
Base Addressing

• Also called register indirect
• Address of the memory operand is contained in a
  base register
• Example
• mov eax, ebx
• Machine
• 8B 04 23

10
Base Addressing (cont)
mov eax, ebx
0x0FF8
0x00001000
ebx
0x0FFC
0x1000
0x1004
0x1008
0x100C
0x11223344
eax
11
Base w/ Displacement

• Address of the memory operand is obtained by
  adding a signed displacement to the contents of a
  base register
• Example
• mov eax, ebx0x0C nasm
• Displacement can be 8 or 32 bit signed value
• Machine (8 bit displacement)
• 8B 44 23 0C

12
Base w/ Displacement (cont)
mov eax, ebx 0x0C
0x0FF8
0x00001000
ebx
0x0FFC
0x1000
0x0C
0x1004
0x1008
0x100C
0x44332211
eax
13
Scaled Index w/ Displacement

• An index register is multiplied by a scale
  factor and added to a signed displacement to
  obtain the memory address of the operand
• Allowable scale factors are 2, 4, and 8
• Useful for indexing into an array
• Displacement represents the start of the array
• Index register hold the array index
• Scale factor represents sizeof a single data
  element

14
Scaled Index w/ Displacement (II)

• Example access item at index 2 in an array of
  int staring at 0x1000
• mov ebx, 2
• mov eax, ebx 4 0x1000
• Machine
• 8B 04 9D 00 10 00 00

15
Scaled Index w/ Displacement (III)
mov eax, ebx 4 0x1000
0x0FF8
0x00001000
2
ebx
0x0FFC
4
0x1000
0x1004
0x1008
0x100C
0x22441133
eax
16
Base w/ Index and Displacement

• Add an index register to a base register plus a
  signed 8/32 bit displacement
• Example
• mov eax, ebx ebp 0x0C
• Machine
• 8B 44 2B 0C

17
Base w/ Index and Displacement (II)
mov eax, ebx ebp 0x0C
0x0FF8
0x00000FF8
8
ebx
ebp
0x0FFC
0x1000
0x0C
0x1004
0x1008
0x100C
0x44332211
eax
18
Base Scaled Index w/ Disp

• Add an index register to a scaled base register
  plus a signed 8/32 bit displacement
• Legal scale values 2, 4, 8
• Example
• mov eax, ebp ebx 4 0x0C
• Machine
• 8B 44 9D 0C

19
Base Scaled Index w/ Disp (II)
mov eax, ebp ebx 4 0x0C
0x0FF8
0x00000FF8
ebx
ebp
ebx
2
0x0FFC
4
0x1000
0x1004
0x0C
0x1008
0x100C
0x44332211
eax
20
Relative Addressing

• Almost always relative to the program counter
  (eip)
• Operand is a signed displacement to add to eip
• Almost always used to compute a branch or jump
  target address
• I dont really know (or care) what the current
  value of eip is, but I would like to jump forward
  (or backward) X bytes

21
Relative Addressing

• Example
• cmp eax, ebx
• jz equal
• xor eax, eax
• equal mov ecx, 1
• Machine
• 0x1000 39 D8
• 0x1002 74 02
• 0x1004 31 C0
• 0x1006 B9 01 00 00 00

Relative offset to add to eip IF the condition is
true. eip is already 0x1004 by the time we decide
to add