On x86 (32-bit), a no-operation (nop) can be encoded as a CPU instruction 0x90 (among other choices). 0x90 can also be interpreted as xchg eax,eax.

On x86-64, xchg eax, eax is not a nop, as it clear the upper-half of the rax register; hence, it must be encoded as 0x87 0xc0. xchg rax, rax could be translated into a nop.

radare's rasm2 allows to easily experiment with different assembler engines for x86 (.nz is default):

rasm2 -a x86.nz -b 64 "xchg eax,eax" // .nz .. handmade assembler
87c0
rasm2 -a x86.nz -b 32 "xchg eax,eax"
90
rasm2 -a x86.nasm -b 64 "xchg rax,rax" // using NASM, notice the extra override byte 0x48
4890
rasm2 -a x86.as -b 64 "xchg rax,rax" // using GNU assembler
90

At least the following libraries/tools get this wrong:

• radare2 (PR)
• x64dbg (PR, actually it's using an old asmjit), also XED in x64dbg has the same issue

As you might have guessed, these are my Hacktoberfest 2022 contributions.

posted at: 12:54 | path: /programming | permanent link