In a disassembled program I'm analyzing, I found the command
sar %eax
What does this do? I know that sar with two arguments performs a right shift, but I can't find what it means with only one parameter.
This program was compiled for an Intel x86 processor.
Looks like the dissembler used short-hand for SAR EAX,1 which has an opcode of 0xD1F8. when the immediate is not 1, aka SAR EAX,xx, the opcode is 0xC1F8 xx, see the Intel Instruction reference, Vol. 2B, 4-353.
When there is only one operand the implied shift is 1.
So....
SAR %EAX implies signed %EAX >> 1
therefor,
SAR %eax = SAR $1, %eax
I have successfully proven this analyzing some code in GDB.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With