Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

SAR command in X86 assembly with one parameter

In a disassembled program I'm analyzing, I found the command

sar %eax

What does this do? I know that sar with two arguments performs a right shift, but I can't find what it means with only one parameter.

This program was compiled for an Intel x86 processor.

like image 270
Kevin Avatar asked Oct 10 '12 07:10

Kevin


2 Answers

Looks like the dissembler used short-hand for SAR EAX,1 which has an opcode of 0xD1F8. when the immediate is not 1, aka SAR EAX,xx, the opcode is 0xC1F8 xx, see the Intel Instruction reference, Vol. 2B, 4-353.

like image 80
Necrolis Avatar answered Oct 09 '22 03:10

Necrolis


When there is only one operand the implied shift is 1.

So....

SAR %EAX implies signed %EAX >> 1

therefor,

SAR %eax = SAR $1, %eax

I have successfully proven this analyzing some code in GDB.

like image 7
Siri Avatar answered Oct 09 '22 01:10

Siri