XlogicX Blog

Assembly_Is_Too_High-Level_-_Better_Call_SAL

 

When it comes down to it, this is logically true. But it seems like everything tries to sweep SAL under the rug, therefore: I WANT!

 

I get it, it's the same thing. And for the record, I verified that they operate exactly the same down to the eflags being set identically.

Lets try to use a SAL instruction:
sal4

Now we verify everything works identically by looking at this in a debugger:

Wait assembler, you motherfucker, I see what you did there. Notice even the machine code is the same for both of these instructions. So where is the machine code for SAL hiding. Is there really no actual SAL? like how jg (jump if greater) and jnle (jump if not less than or equal to) are both encoded as 7F becuase they really are the same? Well let's turn to the trusty Intel Manual (Vol 2), it always reliably has the machine encoding for each assembly mnemonic.

Wait, you too Intel? Earlier this year I tried to get Intel to 'correct' this 'incorrect' documentation. But I don't think this will happen, as I don't think they find this to be a mistake. It is instead a conspiracy to sweep SAL under the rug; giving it the same machine code as SHL. But nope, that's not good enough, you're still hiding it somewhere, I just know it. This doesn't feel like a redundant conditional jump.

So for OP r/m8, 1, SHL is D0 /4. I also notice from the same section in the manual that SAR is D0 /7, and SHR D0 /5. Under the D0 opcode, there should be a total of 8 of these (/0 - /7). So what instructions DOES Intel have for D0? In alphabetical order, we have RCL (D0 /2), RCR (D0 /3), ROL (D0 /0), ROR (D0 /1), SAR (D0 /7), SHL (D0 /4), SHR (D0 /5).

Our big clue is the empty cell in the 110 column in Table A-6 in Section A.4 of the Appendix A in Vol 2 of the Intel Manual.

Nowhere in the manual is there documentation for what D0 /6 (110) does, but by the process of elimination, we found this one missing. So because assembly is too high-level, lets use SAL with machine code instead.

The world feels right again. SAL works just fine too (just like SHL, go figure). Below is a screenshot of the forbidden SALs:

 

 

And just for fun, I shifted by 66 bit positions for each (at least less than 64 bit) register. Note Intel's description screenshotted above: "They shift the source operand left by from 1 to 31 bit positions." I actively don't listen...