Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <blockquote> <p><strong>Questions is</strong>, what’s the longest possible instruction in the x86 instruction set?</p> <p><strong>Answer:</strong> you can form a valid x86 instruction with an <strong>infinite number of bytes!</strong></p> <p>That’s right, <em>you could fill up an entire 64K ROM image with a single valid instruction</em>. To be more specific, there is no limit to the length of 8086 instructions. Cool! Unfortunately, modern day i386 variants throw a general protection fault when attempting to decode instructions longer than 15 bytes.</p> <p>So what does an infinitely-long-but-valid 8086 instruction look like? Kinda boring, actually. You could only form an infinitely long instruction by using redundant prefixes in front on the opcodes. Instruction prefixes are bytes pre-pended to the beginning of an instruction that can modify the default address size, data size, or segment registers used by an instruction.</p> <p>For example, you can take the innocuous looking instruction:</p> <pre><code>89 E5 mov %sp,%bp </code></pre> <p>And turn it into a really long instruction:</p> <pre><code>66 66 66 66 … 66 66 89 E5 mov %sp,%bp </code></pre> <p>Now that’s just evil.</p> </blockquote> <p><a href="https://web.archive.org/web/20131109063453/https://www.onlinedisassembler.com/blog/?p=23" rel="noreferrer">https://web.archive.org/web/20131109063453/https://www.onlinedisassembler.com/blog/?p=23</a></p> <hr> <h1>Another long instruction without repeating prefixes</h1> <blockquote> <p>In some cases it is possible to encode valid instructions that exceed the traditional 15-byte length limit. For example:</p> <pre><code> ; 16-bit mode F2 F0 36 66 67 81 84 24 disp32 imm32 = xaquire lock add [ss:esp*1+disp32],imm32 F3 F0 36 66 67 81 84 24 disp32 imm32 = xrelease lock add [ss:esp*1+disp32],imm32 ; 16-bit mode 36 67 8F EA 78 12 84 24 disp32 imm32 = lwpins eax,[ss:esp*1+disp32],imm32 36 67 8F EA 78 12 8C 24 disp32 imm32 = lwpval eax,[ss:esp*1+disp32],imm32 36 67 8F EA 78 10 84 24 disp32 imm32 = bextr eax,[ss:esp*1+disp32],imm32 ; 64-bit mode 64 67 8F EA F8 12 84 18 disp32 imm32 = lwpins rax,[fs:eax+ebx+disp32],imm32 64 67 8F EA F8 12 8C 18 disp32 imm32 = lwpval rax,[fs:eax+ebx+disp32],imm32 64 67 8F EA F8 10 84 18 disp32 imm32 = bextr rax,[fs:eax+ebx+disp32],imm32 </code></pre> </blockquote> <p><a href="http://www.sandpile.org/x86/opc_enc.htm" rel="noreferrer">http://www.sandpile.org/x86/opc_enc.htm</a></p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload