YASM User Manual

Yasm is a BSD-licensed assembler that is designed from the ground up to allow for multiple assembler syntaxes to be supported (e.g. NASM, GNU AS, etc.) in addition to multiple output object formats and multiple instruction sets. Its modular architecture allows additional object formats, debug formats, and syntaxes to be added relatively easily.

Yasm started life in 2001 as a rewrite of the NASM (Netwide) x86 assembler under the BSD license. Since then, it has matched and exceeded NASM‘s capabilities, incorporating features such as supporting the 64-bit AMD64 architecture, parsing GNU AS syntax, and generating STABS, DWARF2, and CodeView 8 debugging information.

Yasm is licensed under the 2-clause and 3-clause?"revised"?BSD licenses, with one exception: the Bit::Vector module used by the mainline version of Yasm to implement its large integer and machine-independent floating point support is triple-licensed under the Artistic license, GPL, and LGPL. The?"yasm-nextgen"?codebase uses a different BSD-licensed implementation and is thus entirely under BSD-equivalent licenses. The full text of the licenses are provided in the Yasm source distribution.

This user manual is licensed under the 2-clause BSD license.

This book is intended to be a user‘s manual for Yasm, serving as both an introduction and a general-purpose reference. While mentions may be made in various sections of Yasm‘s implementation (usually to explain the reasons behind bugs or unusual aspects to various features), this book will not go into depth explaining how Yasm does its job; for an in-depth discussion of Yasm‘s internals, see?The Design and Implementation of the Yasm Assembler.

yasm?[?-f?format?] [?-o?outfile?] [?other options?...] {infile}

The?yasm?command assembles the file?infile?and directs output to the file?outfile?if specified. If?outfile?is not specified,?yasm?will derive a default output file name from the name of its input file, usually by appending?.o?or?.obj, or by removing all extensions for a raw binary file. Failing that, the output file name will be?yasm.out.

If called with an?infile?of?"-",?yasm?assembles the standard input and directs output to the file?outfile, or?yasm.out?if no?outfile?is specified.

If errors or warnings are discovered during execution, Yasm outputs the error message to?stderr?(usually the terminal). If no errors or warnings are encountered, Yasm does not output any messages.

Many options may be given in one of two forms: either a dash followed by a single letter, or two dashes followed by a long option name. Options are listed in alphabetical order.

Prints a summary of invocation options. All other options are ignored, and no output file is generated.

Selects the format/style of the output list file. List files typically intermix the original source with the machine code generated by the assembler. The default list format is?"nasm", which mimics the NASM list file format. To print a list of available list file formats to standard output, use?"help"?as?list.

Specifies the name of the output list file. If this option is not used, no list file is generated.

Specifies the name of the output file, overriding any default name generated by Yasm.

Selects the preprocessor to use on the input file before passing it to the parser. Preprocessors often provide macro functionality that is not included in the main parser. The default preprocessor is?"nasm", which is an imported version of the actual NASM preprocessor. A?"raw"?preprocessor is also available, which simply skips the preprocessing step, passing the input file directly to the parser. To print a list of available preprocessors to standard output, use?"help"?as?preproc.

This option causes Yasm to prints the version number of Yasm as well as a license summary to standard output. All other options are ignored, and no output file is generated.

-W?options have two contrary forms:?-W?name??and?-Wno-name. Only the non-default forms are shown here.

The warning options are handled in the order given on the command line, so if?-w?is followed by?-Worphan-labels, all warnings are turned off?except?for orphan-labels.

This option causes Yasm to inhibit all warning messages. As discussed above, this option may be followed by other options to re-enable specified warnings.

This option causes Yasm to treat all warnings as errors. Normally warnings do not prevent an object file from being generated and do not result in a failure exit status from?yasm, whereas errors do. This option makes warnings equivalent to errors in terms of this behavior.

Causes Yasm to not warn on unrecognized characters found in the input. Normally Yasm will generate a warning for any non-ASCII character found in the input file.

When using the NASM-compatible parser, causes Yasm to warn about labels found alone on a line without a trailing colon. While these are legal labels in NASM syntax, they may be unintentional, due to typos or macro definition ordering.

Selects a specific output style for error and warning messages. The default is?"gnu"?style, which mimics the output of?gcc. The?"vc"?style is also available, which mimics the output of Microsoft‘s Visual Studio compiler.

This option is available so that Yasm integrates more naturally into IDE environments such as?Visual Studio?or?Emacs, allowing the IDE to correctly recognize the error/warning message as such and link back to the offending line of source code.

While these preprocessor options theoretically will affect any preprocessor, the only preprocessor currently in Yasm is the?"nasm"?preprocessor.

Pre-defines a single-line macro. The value is optional (if no value is given, the macro is still defined, but to an empty value).

Stops assembly after the preprocessing stage; preprocessed output is sent to the specified output name or, if no output name is specified, the standard output. No object file is produced.

Adds directory?path?to the search path for include files. The search path defaults to only including the directory in which the source file resides.

Pre-includes file?filename, making it look as though?filename?was prepended to the input. Can be useful for prepending multi-line macros that the?-D?can‘t support.

Yasm parses the following assembler syntaxes:

nasm

Table of Contents

When assembling a single file VSYASM behaves in the same way as the normal?yasm?tool. The only change in this case is that VSYASM doesn‘t offer the pre-process only mode.

If however the VSYASM command line includes multiple source files, any output, list and map paths given on the command line are resolved to their directory components alone and each source code file is then assembled using these directories for the relevant outputs. Before assembly starts, any non-existent directories needed for VSYASM outputs are recursively created. The assembly process itself stops if any file being assembled generates errors.

The?-E?file?command line switch can be used to send error reports to a file, in which case this file will also include the command line used to invoke VSYASM. This provides a way to check that VSYASM is being called correctly from the controlling Visual Studio build process.

Firstly, the VSYASM executable file (vsyasm.exe) should be added to the Visual Studio directory holding the C tools. This is typically at:

C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\bin

Secondly, the three files--vsyasm.xml,?vsyasm.props?and?vsyasm.targets--should be added into the project directory of the project in which VSYASM is being used (an alternative will be explained later).

Thirdly, to add Yasm support to a project after the project has been opened in the IDE, right click on the project in the solution explorer and select?"Build Customisations…". If vsyasm is offered as an option in the resulting list you can then select it; if not, use the?"Find Existing…"?button and the resulting file dialogue to navigate to the?vsyasm.targets?that you put in the project directory, select it to add it to the list and then select it from the list.

Once you have done this, right clicking on the project in the solution explorer and selecting?"Properties"?will bring up a dialogue with a new item?"Yasm Assembler"?that will allow you to configure Yasm for building any assembler files added to the project.

If you have many projects that use VSYASM, you can put the three files mentioned above into MSBUILD‘s build customisation directory which is typically at:

C:\Program Files (x86)\MSBuild\Microsoft.Cpp\v4.0\BuildCustomizations

VSYASM will then always be available in the Build Customisations dialogue. An alternative way of doing this is to put these files in a convenient location and then add the path to this location to the?"Build Customisations Search Path"?item under?"VC++ Project Settings"?in the Visual Studio 2010 Options dialogue.

In a Visual Studio project with assembler source code files, Yasm settings are entered in the?"Yasm Assembler"?item in the projects Property Dialogue. The items available correspond with those available on Yasm‘s command line and are mostly self explanatory but one item--"Object Filename"--does need further explanation.

If the?"Object Filename"?item refers to a directory (the default), MSBUILD will collect all the assembler files in the project together as a batch and invoke VSYASM in multiple file mode. In order to assemble files one at a time it is necessary to change this to the name of an output?file?such as, for example,?"$(IntDir)%(Filename).obj".

The chapters in this part of the book document the NASM-compatible syntax accepted by the Yasm?"nasm"?parser and preprocessor.

An instruction is not required to use a prefix: prefixes such as?CS,?A32,?LOCK?or?REPE?can appear on a line by themselves, and NASM will just generate the prefix bytes.

fadd st1 ; this sets st0 := st0 + st1

fadd st0, st1 ; so does this

?

fadd st1, st0 ; this sets st1 := st1 + st0

fadd to st1 ; so does this

db 0x55 ; just the byte 0x55

db 0x55,0x56,0x57 ; three bytes in succession

db ‘a‘,0x55 ; character constants are OK

db ‘hello‘,13,10,‘$‘ ; so are string constants

dw 0x1234 ; 0x34 0x12

dw ‘a‘ ; 0x41 0x00 (it‘s just a number)

dw ‘ab‘ ; 0x41 0x42 (character constant)

dw ‘abc‘ ; 0x41 0x42 0x43 0x00 (string)

dd 0x12345678 ; 0x78 0x56 0x34 0x12

dq 0x1122334455667788 ; 0x88 0x77 0x66 0x55 0x44 0x33 0x22 0x11

ddq 0x112233445566778899aabbccddeeff00

; 0x00 0xff 0xee 0xdd 0xcc 0xbb 0xaa 0x99

; 0x88 0x77 0x66 0x55 0x44 0x33 0x22 0x11

do 0x112233445566778899aabbccddeeff00 ; same as previous

dd 1.234567e20 ; floating-point constant

dq 1.234567e20 ; double-precision float

dt 1.234567e20 ; extended-precision float

incbin "file.dat" ; include the whole file

incbin "file.dat",1024 ; skip the first 1024 bytes

incbin "file.dat",1024,512 ; skip the first 1024, and

; actually include at most 512

message db ‘hello, world‘

msglen equ $-message

zerobuf: times 64 db 0

or similar things; but?TIMES?is more versatile than that. The argument to?TIMES?is not just a numeric constant, but a numeric?expression, so you can do things like

buffer: db ‘hello, world‘

times 64-$+buffer db ‘ ‘

times 100 movsb

Note that there is no effective difference between?times 100 resb 1?and?resb 100, except that the latter will be assembled about 100 times faster due to the internal structure of the assembler.

wordvar dw 123

mov ax,[wordvar]

mov ax,[wordvar+1]

mov ax,[es:wordvar+bx]

Anything not conforming to this simple system is not a valid memory reference in NASM, for example?es:wordvar[bx].

More complicated effective addresses, such as those involving more than one register, work in exactly the same way:

mov eax,[ebx*2+ecx+offset]

mov ax,[bp+di+8]

mov eax,[ebx*5] ; assembles as [ebx*4+ebx]

mov eax,[label1*2-label2] ; ie [label1+(label1-label2)]

Some forms of effective address have more than one assembled form; in most such cases NASM will generate the smallest form it can. For example, there are distinct assembled forms for the 32-bit effective addresses?[eax*2+0]?and?[eax+eax], and NASM will generally generate the latter on the grounds that the former requires four bytes to store a zero offset.

NASM has a hinting mechanism which will cause?[eax+ebx]?and?[ebx+eax]?to generate different opcodes; this is occasionally useful because?[esi+ebp]?and?[ebp+esi]?have different default segment registers.

In?BITS 64?mode, displacements, for the most part, remain 32 bits and are sign extended prior to use. The exception is one restricted form of the mov instruction: between an?AL,?AX,?EAX, or?RAX?register and a 64-bit absolute address (no registers are allowed in the effective address, and the address cannot be RIP-relative). In NASM syntax, use of the 64-bit absolute form requires?QWORD. Examples in NASM syntax:

mov eax, [1] ; 32 bit, with sign extension

mov al, [rax-1] ; 32 bit, with sign extension

mov al, [qword 0x1122334455667788] ; 64-bit absolute

mov al, [0x1122334455667788] ; truncated to 32-bit (warning)

In NASM syntax, there are two ways to specify RIP-relative addressing:

mov dword [rip+10], 1

stores the value 1 ten bytes after the end of the instruction.?10?can also be a symbolic constant, and will be treated the same way. On the other hand,

mov dword [symb wrt rip], 1

stores the value 1 into the address of symbol?symb. This is distinctly different than the behavior of:

mov dword [symb+rip], 1

which takes the address of the end of the instruction, adds the address of?symb?to it, then stores the value 1 there. If?symb?is a variable, this will?not?store the value 1 into the?symb?variable!

mov [rel sym], rax ; RIP-relative

mov [abs sym], rax ; not RIP-relative

64 bit immediate operands are limited to direct 64-bit register move instructions in?BITS 64?mode. For all other instructions in 64-bit mode, immediate values remain 32 bits; their value is sign-extended into the upper 32 bits of the target register prior to being used. The exception is the mov instruction, which can take a 64-bit immediate when the destination is a 64-bit register.

All unsized immediate values in?BITS 64?in Yasm default to 32-bit size for consistency. In order to get a 64-bit immediate with a label, specify the size explicitly with the?QWORD?keyword. For ease of use, Yasm will also try to recognize 64-bit values and change the size to 64 bits automatically for these cases.

Examples in NASM syntax:

add rax, 1 ; optimized down to signed 8-bit

add rax, dword 1 ; force size to 32-bit

add rax, 0xffffffff ; sign-extended 32-bit

add rax, -1 ; same as above

add rax, 0xffffffffffffffff ; truncated to 32-bit (warning)

mov eax, 1 ; 5 byte

mov rax, 1 ; 5 byte (optimized to signed 32-bit)

mov rax, qword 1 ; 10 byte (forced 64-bit)

mov rbx, 0x1234567890abcdef ; 10 byte

mov rcx, 0xffffffff ; 10 byte (does not fit in signed 32-bit)

mov ecx, -1 ; 5 byte, equivalent to above

mov rcx, sym ; 5 byte, 32-bit size default for symbols

mov rcx, qword sym ; 10 byte, override default size

A caution for users using both Yasm and NASM 2.x: the handling of mov reg64, unsized immediate is different between Yasm and NASM 2.x; YASM follows the above behavior, while NASM 2.x does the following:

add rax, 0xffffffff ; sign-extended 32-bit immediate

add rax, -1 ; same as above

add rax, 0xffffffffffffffff ; truncated 32-bit (warning)

add rax, sym ; sign-extended 32-bit immediate

mov eax, 1 ; 5 byte (32-bit immediate)

mov rax, 1 ; 10 byte (64-bit immediate)

mov rbx, 0x1234567890abcdef ; 10 byte instruction

mov rcx, 0xffffffff ; 10 byte instruction

mov ecx, -1 ; 5 byte, equivalent to above

mov ecx, sym ; 5 byte (32-bit immediate)

mov rcx, sym ; 10 byte (64-bit immediate)

mov rcx, qword sym ; 10 byte, same as above

mov eax,‘abcd‘

A string constant looks like a character constant, only longer. It is treated as a concatenation of maximum-size character constants for the conditions. So the following are equivalent:

db ‘hello‘ ; string constant

db ‘h‘,‘e‘,‘l‘,‘l‘,‘o‘ ; equivalent character constants

And the following are also equivalent:

dd ‘ninechars‘ ; doubleword string constant

dd ‘nine‘,‘char‘,‘s‘ ; becomes three doublewords

db ‘ninechars‘,0,0,0 ; and really looks like this

Note that when used as an operand to?db, a constant like?‘ab‘?is treated as a string constant despite being short enough to be a character constant, because otherwise?db ‘ab‘?would have the same effect as?db ‘a‘, which would be silly. Similarly, three-character or four-character constants are treated as strings when they are operands to?dw.

Some examples:

dw -0.5 ; IEEE half precision

dd 1.2 ; an easy one

dq 1.e10 ; 10,000,000,000

dq 1.e+10 ; synonymous with 1.e10

dq 1.e-10 ; 0.000 000 000 1

dt 3.141592653589793238462 ; pi

NASM does not guarantee the size of the integers used to evaluate expressions at compile time: since NASM can compile and run on 64-bit systems quite happily, don‘t assume that expressions are evaluated in 32-bit registers and so try to make deliberate use of ((integer overflow)). It might not always work. The only thing NASM will guarantee is what‘s guaranteed by ANSI C: you always have?at least?32 bits to work in.

NASM, like ANSI C, provides no guarantees about the sensible operation of the signed modulo operator.

Since the?%?character is used extensively by the macro preprocessor, you should ensure that both the signed and unsigned modulo operators are followed by white space wherever they appear.

mov ax, seg symbol

mov es, ax

mov bx, symbol

will load?es:bx?with a valid pointer to the symbol?symbol.

mov ax, weird_seg ; weird_seg is a segment base

mov es, ax

mov bx, symbol wrt weird_seg

to load?es:bx?with a different, but functionally equivalent, pointer to the symbol?symbol.

NASM supports far (inter-segment) calls and jumps by means of the syntax?call segment:offset, where?segment?and?offset?both represent immediate values. So to call a far procedure, you could code either of

call (seg procedure):procedure

call weird_seg:(procedure wrt weird_seg)

(The parentheses are included for clarity, to show the intended parsing of the above instructions. They are not necessary in practice.)

dw symbol, seg symbol

NASM supports no convenient synonym for this, though you can always invent one using the macro processor.

push dword 33

is encoded in three bytes?66 6A 21, whereas

push strict dword 33

is encoded in six bytes, with a full dword immediate operand?66 68 21 00 00 00.

The first pass is used to determine the size of all the assembled code and data, so that the second pass, when generating all the code, knows all the symbol addresses the code refers to. So one thing NASM can‘t handle is code whose size depends on the value of a symbol declared after the code in question. For example,

times (label-$) db 0

label: db ‘Where am I?‘

times (label-$+1) db 0

label: db ‘NOW where am I?‘

in which?any?value for the?TIMES?argument is by definition wrong!

Critical expressions can crop up in other contexts as well: consider the following code.

mov ax, symbol1

symbol1 equ symbol2

symbol2:

NASM avoids this problem by defining the right-hand side of an?EQU?statement to be a critical expression, so the definition of?symbol1?would be rejected in the first pass.

mov eax, [ebx+offset]

offset equ 10

label1 ; some code

.loop ; some more code

jne .loop

ret

label2 ; some code

.loop ; some more code

jne .loop

ret

In the above code fragment, each?JNE?instruction jumps to the line immediately before it, because the two definitions of?.loop?are kept separate by virtue of each being associated with the previous non-local label.

NASM goes one step further, in allowing access to local labels from other parts of the code. This is achieved by means of?defining?a local label in terms of the previous non-local label: the first definition of?.loop?above is really defining a symbol called?label1.loop, and the second defines a symbol called?label2.loop. So, if you really needed to, you could write

label3 ; some more code

; and some more

jmp label1.loop

label1: ; a non-local label

.local: ; this is really label1.local

[email protected]: ; this is a special symbol

label2: ; another non-local label

.local: ; this is really label2.local

jmp [email protected] ; this will jump three lines up

NASM has the capacity to define other special symbols beginning with a double period: for example,?..start?is used to specify the entry point in the?obj?output format.

Table of Contents

The preprocessor collapses all lines which end with a backslash (\) character into a single line. Thus:

%define THIS_VERY_LONG_MACRO_NAME_IS_DEFINED_TO

THIS_VALUE

will work like a single-line macro without the backslash-newline sequence.

%define ctrl 0x1F &

%define param(a,b) ((a)+(a)*(b))

?

mov byte [param(2,ebx)], ctrl ‘D‘

which will expand to

mov byte [(2)+(2)*(ebx)], 0x1F & ‘D‘

When the expansion of a single-line macro contains tokens which invoke another macro, the expansion is performed at invocation time, not at definition time. Thus the code

%define a(x) 1+b(x)

%define b(x) 2*x

?

mov ax,a(8)

will evaluate in the expected way to?mov ax,1+2*8, even though the macro?b?wasn‘t defined at the time of definition of?a.

%define a(x) 1+a(x)

?

mov ax,a(3)

the macro?a(3)?will expand once, becoming?1+a(3), and will then expand no further. This behaviour can be useful.

%define foo(x) 1+x

%define foo(x,y) 1+x*y

the preprocessor will be able to handle both types of macro call, by counting the parameters you pass; so?foo(3)?will become?1+3?whereas?foo(ebx,2)?will become?1+ebx*2. However, if you define

%define foo bar

then no other definition of?foo?will be accepted: a macro with no parameters prohibits the definition of the same name as a macro?with?parameters, and vice versa.

This doesn‘t prevent single-line macros being?redefined: you can perfectly well define a macro with

%define foo bar

and then re-define it later in the same source file with

%define foo baz

Suppose you have the following code:

%define isTrue 1

%define isFalse isTrue

%define isTrue 0

?

val1: db isFalse

?

%define isTrue 1

?

val2: db isFalse

In this case,?val1?is equal to 0, and?val2?is equal to 1. This is because, when a single-line macro is defined using?%define, it is expanded only when it is called. As?isFalse?expands to?isTrue, the expansion will be the current value ofisTrue. The first time it is called that is 0, and the second time it is 1.

If you wanted?isFalse?to expand to the value assigned to the embedded macro?isTrue?at the time that?isFalse?was defined, you need to change the above code to use?%xdefine.

%xdefine isTrue 1

%xdefine isFalse isTrue

%xdefine isTrue 0

?

val1: db isFalse

?

%xdefine isTrue 1

?

val2: db isFalse

Now, each time that?isFalse?is called, it expands to 1, as that is what the embedded macro?isTrue?expanded to at the time that?isFalse?was defined.

As an example, consider the following:

%define BDASTART 400h ; Start of BIOS data area

?

struc tBIOSDA ; its structure

.COM1addr RESW 1

.COM2addr RESW 1

; ..and so on

endstruc

Now, if we need to access the elements of tBIOSDA in different places, we can end up with:

mov ax,BDASTART + tBIOSDA.COM1addr

mov bx,BDASTART + tBIOSDA.COM2addr

This will become pretty ugly (and tedious) if used in many places, and can be reduced in size significantly by using the following macro:

; Macro to access BIOS variables by their names (from tBDA):

?

%define BDA(x) BDASTART + tBIOSDA. %+ x

Now the above code can be written as:

mov ax,BDA(COM1addr)

mov bx,BDA(COM2addr)

Using this feature, we can simplify references to a lot of macros (and, in turn, reduce typing errors).

%define foo bar

%undef foo

?

mov eax, foo

will expand to the instruction?mov eax, foo, since after?%undef?the macro?foo?is no longer defined.

%assign?is used to define single-line macros which take no parameters and have a numeric value. This value can be specified in the form of an expression, and it will be evaluated once, when the?%assign?directive is processed.

Like?%define, macros defined using?%assign?can be re-defined later, so you can do things like

%assign i i+1

to increment the numeric value of a macro.

%strlen charcnt ‘my string‘

In this example,?charcnt?would receive the value 8, just as if an?%assign?had been used. In this example,?‘my string‘?was a literal string but it could also have been a single-line macro that expands to a string, as in the following example:

%define sometext ‘my string‘

%strlen charcnt sometext

As in the first case, this would result in?charcnt?being assigned the value of 8.

%substr mychar ‘xyz‘ 1 ; equivalent to %define mychar ‘x‘

%substr mychar ‘xyz‘ 2 ; equivalent to %define mychar ‘y‘

%substr mychar ‘xyz‘ 3 ; equivalent to %define mychar ‘z‘

%macro prologue 1

?

push ebp

mov ebp,esp

sub esp,%1

?

%endmacro

This defines a C-like function prologue as a macro: so you would invoke the macro with a call such as

myfunc: prologue 12

which would expand to the three lines of code

myfunc: push ebp

mov ebp,esp

sub esp,12

The number?1?after the macro name in the?%macro?line defines the number of parameters the macro?prologue?expects to receive. The use of?%1?inside the macro definition refers to the first parameter to the macro call. With a macro taking more than one parameter, subsequent parameters would be referred to as?%2,?%3?and so on.

%macro silly 2

?

%2: db %1

?

%endmacro

?

silly ‘a‘, letter_a ; letter_a: db ‘a‘

silly ‘ab‘, string_ab ; string_ab: db ‘ab‘

silly {13,10}, crlf ; crlf: db 13,10

%macro prologue 0

?

push ebp

mov ebp,esp

?

%endmacro

to define an alternative form of the function prologue which allocates no local stack space.

Sometimes, however, you might want to?"overload"?a machine instruction; for example, you might want to define

%macro push 2

?

push %1

push %2

?

%endmacro

so that you could code

push ebx ; this line is not a macro call

push eax,ecx ; but this one is

%macro retz 0

?

jnz %%skip

ret

%%skip:

?

%endmacro

writefile [filehandle],"hello, world",13,10

NASM allows you to define the last parameter of a macro to be?greedy, meaning that if you invoke the macro with more parameters than it expects, all the spare parameters get lumped into the last defined one along with the separating commas. So if you code:

%macro writefile 2+

?

jmp %%endstr

%%str: db %2

%%endstr:

mov dx,%%str

mov cx,%%endstr-%%str

mov bx,%1

mov ah,0x40

int 0x21

?

%endmacro

then the example call to?writefile?above will work as expected: the text before the first comma,?[filehandle], is used as the first macro parameter and expanded when?%1?is referred to, and all the subsequent text is lumped into?%2?and placed after the?db.

If you define a greedy macro, you are effectively telling NASM how it should expand the macro given?any?number of parameters from the actual number specified up to infinity; in this case, for example, NASM now knows what to do when it sees a call to?writefile?with 2, 3, 4 or more parameters. NASM will take this into account when overloading macros, and will not allow you to define another form of?writefile?taking 4 parameters (for example).

Of course, the above macro could have been implemented as a non-greedy macro, in which case the call to it would have had to look like

writefile [filehandle], {"hello, world",13,10}

NASM provides both mechanisms for putting ((commas in macro parameters)), and you choose which one you prefer for each macro definition.

%macro die 0-1 "Painful program death has occurred."

?

writefile 2,%1

mov ax,0x4c01

int 0x21

?

%endmacro

%rotate?is invoked with a single numeric argument (which may be an expression). The macro parameters are rotated to the left by that many places. If the argument to?%rotate?is negative, the macro parameters are rotated to the right.

%macro multipush 1-*

?

%rep %0

push %1

%rotate 1

%endrep

?

%endmacro

This macro invokes the?PUSH?instruction on each of its arguments in turn, from left to right. It begins by pushing its first argument,?%1, then invokes?%rotate?to move all the arguments one place to the left, so that the original second argument is now available as?%1. Repeating this procedure as many times as there were arguments (achieved by supplying?%0?as the argument to?%rep) causes each argument in turn to be pushed.

It would be convenient, when using this macro, to have a?POP?equivalent, which?didn‘t?require the arguments to be given in reverse order. Ideally, you would write the?multipush?macro call, then cut-and-paste the line to where the pop needed to be done, and change the name of the called macro to?multipop, and the macro would take care of popping the registers in the opposite order from the one in which they were pushed.

This can be done by the following definition:

%macro multipop 1-*

?

%rep %0

%rotate -1

pop %1

%endrep

?

%endmacro

This macro begins by rotating its arguments one place to the?right, so that the original?last?argument appears as?%1. This is then popped, and the arguments are rotated right again, so the second-to-last argument becomes?%1. Thus the arguments are iterated through in reverse order.

%macro keytab_entry 2

?

keypos%1 equ $-keytab

db %2

?

%endmacro

?

keytab:

keytab_entry F1,128+1

keytab_entry F2,128+2

keytab_entry Return,13

which would expand to

keytab:

keyposF1 equ $-keytab

db 128+1

keyposF2 equ $-keytab

db 128+2

keyposReturn equ $-keytab

db 13

You can just as easily concatenate text on to the other end of a macro parameter, by writing?%1foo.

%macro retc 1

?

j%-1 %%skip

ret

%%skip:

?

%endmacro

This macro can now be invoked using calls like?retc ne, which will cause the conditional-jump instruction in the macro expansion to come out as?JE, or?retc po?which will make the jump a?JPE.

The?%+1?macro-parameter reference is quite happy to interpret the arguments?CXZ?and?ECXZ?as valid condition codes; however,?%-1?will report an error if passed either of these, because no inverse condition code exists.

%macro foo 1.nolist

Or like this:

%macro bar 1-5+.nolist a,b,c,d,e,f,g,h

%if<condition>

; some code which only appears if <condition> is met

%elif<condition2>

; only appears if <condition> is not met but <condition2> is

%else

; this appears if neither <condition> nor <condition2> was met

%endif

For example, when debugging a program, you might want to write code such as

; perform some function

%ifdef DEBUG

writefile 2,"Function performed successfully",13,10

%endif

; go and do something else

Then you could use the command-line option?-D DEBUG?to create a version of the program which produced debugging messages, and remove the option to generate the final release version of the program.

For example, you may be working with a large project and not have control over the macros in a library. You may want to create a macro with one name if it doesn‘t already exist, and another name if one with that name does exist.

The?%ifmacro?is considered true if defining a macro with the given name and number of arguments would cause a definitions conflict. For example:

%ifmacro MyMacro 1-3

?

%error "MyMacro 1-3" causes a conflict with an existing macro.

?

%else

?

%macro MyMacro 1-3

?

; insert code to define the macro

?

%endmacro

?

%endif

This will create the macro?MyMacro 1-3?if no macro already exists which would conflict with it, and emits a warning if there would be a definition conflict.

For example, the following macro pushes a register or number on the stack, and allows you to treat?IP?as a real register:

%macro pushparam 1

?

%ifidni %1,ip

call %%label

%%label:

%else

push %1

%endif

?

%endmacro

%ifdef SOME_MACRO

; do some setup

%elifdef SOME_OTHER_MACRO

; do some different setup

%else

%error Neither SOME_MACRO nor SOME_OTHER_MACRO was defined.

%endif

Then any user who fails to understand the way your code is supposed to be assembled will be quickly warned of their mistake, rather than having to wait until the program crashes on being run and then not knowing what went wrong.

%assign i 0

%rep 64

inc word [table+2*i]

%assign i i+1

%endrep

This will generate a sequence of 64?INC?instructions, incrementing every word of memory from?[table]?to?[table+126].

fibonacci:

%assign i 0

%assign j 1

%rep 100

%if j > 65535

%exitrep

%endif

dw j

%assign k j+i

%assign i j

%assign j k

%endrep

?

fib_number equ ($-fibonacci)/2

This produces a list of all the Fibonacci numbers that will fit in 16 bits. Note that a maximum repeat count must still be given to?%rep. This is to prevent the possibility of NASM getting into an infinite loop in the preprocessor, which (on multitasking or multi-user systems) would typically cause all the system memory to be gradually used up and other applications to start crashing.

%include "macros.mac"

will include the contents of the file?macros.mac?into the source file containing the?%include?directive.

%push foobar

This pushes a new context called?foobar?on the stack. You can have several contexts on the stack with the same name: they can still be distinguished.

%macro repeat 0

?

%push repeat

%$begin:

?

%endmacro

?

%macro until 1

?

j%-1 %$begin

%pop

?

%endmacro

and invoked by means of, for example,

mov cx,string

repeat

add cx,3

scasb

until e

which would scan every fourth byte of a string in search of the byte in?AL.

%define %$localmac 3

will define the single-line macro?%$localmac?to be local to the top context on the stack. Of course, after a subsequent?%push, it can then still be accessed by the name?%$$localmac.

%pop

%push newname

with the non-destructive version?%repl newname.

%macro if 1

?

%push if

j%-1 %$ifnot

?

%endmacro

?

%macro else 0

?

%ifctx if

%repl else

jmp %$ifend

%$ifnot:

%else

%error "expected `if‘ before `else‘"

%endif

?

%endmacro

?

%macro endif 0

?

%ifctx if

%$ifnot:

%pop

%elifctx else

%$ifend:

%pop

%else

%error "expected `if‘ or `else‘ before `endif‘"

%endif

?

%endmacro

These macros could be used, for example, to communicate debugging information to a macro, since invoking?__LINE__?inside a macro definition (either single-line or multi-line) will return the line number of the macro?call, rather thandefinition. So to determine where in a piece of code a crash is occurring, for example, one could write a routine?stillhere, which is passed a line number in?EAX?and outputs something like?"line 155: still here". You could then write a macro

%macro notdeadyet 0

push eax

mov eax, __LINE__

call stillhere

pop eax

%endmacro

and then pepper your code with calls to?notdeadyet?until you find the crash point.

STRUC?takes one parameter, which is the name of the data type. This name is defined as a symbol with the value zero, and also has the suffix?_size?appended to it and is then defined as an?EQU?giving the size of the structure. Once?STRUChas been issued, you are defining the structure, and should define fields using the?RESB?family of pseudo-instructions, and then invoke?ENDSTRUC?to finish the definition.

For example, to define a structure called?mytype?containing a longword, a word, a byte and a string of bytes, you might code

struc mytype

mt_long: resd 1

mt_word: resw 1

mt_byte: resb 1

mt_str: resb 32

endstruc

The above code defines six symbols:?mt_long?as 0 (the offset from the beginning of a?mytype?structure to the longword field),?mt_word?as 4,?mt_byte?as 6,?mt_str?as 7,?mytype_size?as 39, and?mytype?itself as zero.

The reason why the structure type name is defined at zero is a side effect of allowing structures to work with the local label mechanism: if your structure members tend to have the same names in more than one structure, you can define the above structure like this:

struc mytype

.long: resd 1

.word: resw 1

.byte: resb 1

.str: resb 32

endstruc

This defines the offsets to the structure fields as?mytype.long,?mytype.word,?mytype.byte?and?mytype.str.

Since NASM syntax has no?intrinsic?structure support, does not support any form of period notation to refer to the elements of a structure once you have one (except the above local-label notation), so code such as?mov ax,[mystruc.mt_word]is not valid.?mt_word?is a constant just like any other constant, so the correct syntax is?mov ax,[mystruc+mt_word]?or?mov ax,[mystruc+mytype.word].

mystruc: istruc mytype

at mt_long, dd 123456

at mt_word, dw 1024

at mt_byte, db ‘x‘

at mt_str, db ‘hello, world‘, 13, 10, 0

iend

If the data to go in a structure field requires more than one source line to specify, the remaining source lines can easily come after the?AT?line. For example:

at mt_str, db 123,134,145,156,167,178,189

db 190,100,0

Depending on personal taste, you can also omit the code part of the?AT?line completely, and start the structure field on the next line:

at mt_str

db ‘hello, world‘

db 13,10,0

align 4 ; align on 4-byte boundary

align 16 ; align on 16-byte boundary

align 16,nop ; equivalent to previous line

align 8,db 0 ; pad with 0s rather than NOPs

align 4,resb 1 ; align to 4 in the BSS

alignb 4 ; equivalent to previous line

Both macros require their first argument to be a power of two; they both compute the number of additional bytes required to bring the length of the current section up to a multiple of that power of two, and output either NOP fill or apply the?TIMES?prefix to their second argument to perform the alignment.

If the second argument is not specified, the default for?ALIGN?is?NOP, and the default for?ALIGNB?is?RESB 1.?ALIGN?treats a?NOP?argument specially by generating maximal NOP fill instructions (not necessarily NOP opcodes) for the currentBITS?setting, whereas?ALIGNB?takes its second argument literally. Otherwise, the two macros are equivalent when a second argument is specified. Normally, you can just use?ALIGN?in code and data sections and?ALIGNB?in BSS sections, and never need the second argument except for special purposes.

ALIGN?and?ALIGNB, being simple macros, perform no error checking: they cannot warn you if their first argument fails to be a power of two, or if their second argument generates more than one byte of code. In each of these cases they will silently do the wrong thing.

ALIGNB?(or?ALIGN?with a second argument of?RESB 1) can be used within structure definitions:

struc mytype2

mt_byte: resb 1

alignb 2

mt_word: resw 1

alignb 4

mt_long: resd 1

mt_str: resb 32

endstruc

This will ensure that the structure members are sensibly aligned relative to the base of the structure.

A final caveat:?ALIGNB?works relative to the beginning of the?section, not the beginning of the address space in the final executable. Aligning to a 16-byte boundary when the section you‘re in is only guaranteed to be aligned to a 4-byte boundary, for example, is a waste of effort. Again, Yasm does not check that the section‘s alignment characteristics are sensible for the use of?ALIGNB.?ALIGN?is more intelligent and?does?adjust the section alignment to be the maximum specified alignment.

Table of Contents

Primitive directives are enclosed in square brackets; user-level directives are not.

In most cases, you should not need to use?BITS?explicitly. The?coff,?elf32,?macho32, and?win32?object formats, which are designed for use in 32-bit operating systems, all cause Yasm to select 32-bit mode by default. The?elf64,?macho64, andwin64?object formats, which are designed for use in 64-bit operating systems, both cause Yasm to select 64-bit mode by default. The?xdf?object format allows you to specify each segment you define as?USE16,?USE32, or?USE64, and Yasm will set its operating mode accordingly, so the use of the?BITS?directive is once again unnecessary.

The most likely reason for using the?BITS?directive is to write 32-bit or 64-bit code in a flat binary file; this is because the?bin?object format defaults to 16-bit mode in anticipation of it being used most frequently to write DOS?.COMprograms, DOS?.SYS?device drivers and boot loader software.

You do?not?need to specify?BITS 32?merely in order to use 32-bit instructions in a 16-bit DOS program; if you do, the assembler will generate incorrect code because it will be writing code targeted at a 32-bit platform, to be run on a 16-bit one. However, it?is?necessary to specify?BITS 64?to use 64-bit instructions and registers; this is done to allow use of those instruction and register names in 32-bit or 16-bit programs, although such use will generate a warning.

When Yasm is in?BITS 16?mode, instructions which use 32-bit data are prefixed with an 0x66 byte, and those referring to 32-bit addresses have an 0x67 prefix. In?BITS 32?mode, the reverse is true: 32-bit instructions require no prefixes, whereas instructions using 16-bit data need an 0x66 and those working in 16-bit addresses need an 0x67.

When Yasm is in?BITS 64?mode, 32-bit instructions usually require no prefixes, and most uses of 64-bit registers or data size requires a REX prefix. Yasm automatically inserts REX prefixes where necessary. There are also 8 more general and SSE registers, and 16-bit addressing is no longer supported. The default address size is 64 bits; 32-bit addressing can be selected with the 0x67 prefix. The default operand size is still 32 bits, however, and the 0x66 prefix selects 16-bit operand size. The REX prefix is used both to select 64-bit operand size, and to access the new registers. A few instructions have a default 64-bit operand size.

When the REX prefix is used, the processor does not know how to address the?AH,?BH,?CH?or?DH?(high 8-bit legacy) registers. Instead, it is possible to access the the low 8-bits of the?SP,?BP?SI, and?DI?registers as?SPL,?BPL,?SIL, and?DIL, respectively; but only when the REX prefix is used.

The?BITS?directive has an exactly equivalent primitive form,?[BITS 16],?[BITS 32], and?[BITS 64]. The user-level form is a macro which has no function other than to call the primitive form.

The special handling of?FS?and?GS?overrides are due to the fact that these segments are the only segments which can have non-0 base addresses in 64-bit mode, and thus are generally used as thread pointers or other special functions. With a non-zero base address, generating?RIP-relative addresses for these forms would be extremely confusing. Other segment registers such as?DS?always have a base address of 0, so RIP-relative access still makes sense.

DEFAULT REL?is disabled with?DEFAULT ABS. The default mode of the assembler at start-up is?DEFAULT ABS.

SECTION .text

expands to the two lines

%define __SECT__ [SECTION .text]

[SECTION .text]

Users may find it useful to make use of this in their own macros. For example, the?writefile?macro defined in the NASM Manual can be usefully rewritten in the following more sophisticated form:

%macro writefile 2+

[section .data]

%%str: db %2

%%endstr:

__SECT__

mov dx,%%str

mov cx,%%endstr-%%str

mov bx,%1

mov ah,0x40

int 0x21

%endmacro

This form of the macro, once passed a string to output, first switches temporarily to the data section of the file, using the primitive form of the?SECTION?directive so as not to modify?__SECT__. It then declares its string in the data section, and then invokes?__SECT__?to switch back to?whichever?section the user was previously working in. It thus avoids the need, in the previous version of the macro, to include a?JMP?instruction to jump over the data, and also does not fail if, in a complicated?OBJ?format module, the user could potentially be assembling the code in any of several separate code sections.

ABSOLUTE?is used as follows:

ABSOLUTE 0x1A

kbuf_chr resw 1

kbuf_free resw 1

kbuf resw 16

This example describes a section of the PC BIOS data area, at segment address 0x40: the above code defines?kbuf_chr?to be 0x1A,?kbuf_free?to be 0x1C, and?kbuf?to be 0x1E.

The?EXTERN?directive takes as many arguments as you like. Each argument is the name of a symbol:

extern _printf

extern _sscanf, _fscanf

Some object-file formats provide extra features to the?EXTERN?directive. In all cases, the extra features are used by suffixing a colon to the symbol name followed by object-format specific text. For example, the?obj?format allows you to declare that the default segment base of an external should be the group?dgroup?by means of the directive

extern _variable:wrt dgroup

The primitive form of?EXTERN?differs from the user-level form only in that it can take only one argument at a time: the support for multiple arguments is implemented at the preprocessor level.

You can declare the same variable as?EXTERN?more than once: NASM will quietly ignore the second and later redeclarations. You can‘t declare a variable as?EXTERN?as well as something else, though.

The?GLOBAL?directive applying to a symbol must appear?before?the definition of the symbol.

GLOBAL?uses the same syntax as?EXTERN, except that it must refer to symbols which?are?defined in the same module as the?GLOBAL?directive. For example:

global _main

_main: ; some code

GLOBAL, like?EXTERN, allows object formats to define private extensions by means of a colon. The?elf?object format, for example, lets you specify whether global data items are functions or data:

global hashlookup:function, hashtable:data

Like?EXTERN, the primitive form of?GLOBAL?differs from the user-level form only in that it can take only one argument at a time.

common intvar 4

is similar in function to

global intvar

section .bss

intvar resd 1

The difference is that if more than one module defines the same common variable, then at link time those variables will be?merged, and references to?intvar?in all modules will point at the same piece of memory.

Like?GLOBAL?and?EXTERN,?COMMON?supports object-format specific extensions. For example, the?obj?format allows common variables to be NEAR or FAR, and the?elf?format allows you to specify the alignment requirements of a common variable:

common commvar 4:near ; works in OBJ

common intarray 100:4 ; works in ELF: 4 byte aligned

Once again, like?EXTERN?and?GLOBAL, the primitive form of?COMMON?differs from the user-level form only in that it can take only one argument at a time.

The chapters in this part of the book document the GNU AS-compatible syntax accepted by the Yasm?"gas"?parser.

Table of Contents

The chapters in this part of the book document Yasm‘s support for various object file formats.

Often, VMA will be the same as LMA. However, they may be different if the program or another piece of code copies (relocates) a section prior to execution. A typical example of this in an embedded system would be a piece of code stored in ROM, but is copied to faster RAM prior to execution. Another example would be overlays: sections loaded on demand from different file locations to the same execution location.

?

Only one of?start?or?follows?may be specified for a section; the same restriction applies to?vstart?and?vfollows.

Unless otherwise specified via the use of?follows?or?start, Yasm by default assumes the implicit ordering given by the order of the sections in the input file. A section named?.text?is always the first section. Any code which comes before an explicit?SECTION?directive goes into the?.text?section. The?.text?section attributes may be overridden by giving an explicit?SECTION .text?directive with attributes.

Also, unless otherwise specified, Yasm defaults to setting VMA=LMA. If just?"valign` is specified, Yasm just takes the LMA and aligns it to the required alignment. This may have the effect of pushing following sections"?VMAs to non-LMA addresses as well, to avoid VMA overlap.

Yasm treats?nobits?sections in a special way in order to minimize the size of the output file. As?nobits?sections can be 0-sized in the LMA realm, but cannot be if located between two other sections (due to the VMA=LMA default), Yasm moves all?nobits?sections with unspecified LMA to the end of the output file, where they can savely have 0 LMA size and thus not take up any space in the output file. If this behavior is not desired, a?nobits?section LMA (just like aprogbits?section) may be specified using either the?follows?or?start?section attribute.

section.sectname.start

Set to the LMA address of the section named?sectname.

section.sectname.vstart

Set to the VMA address of the section named?sectname.

section.sectname.length

Set to the length of the section named?sectname. The length is considered the runtime length, so?"nobits` sections"?length is their runtime length, not 0.

If no?[MAP]?directive is given in the input file, no map output is generated. If?[MAP]?is given with no options, a brief map is generated. The?[MAP]?directive accepts the following options to control what is included in the map file. More than one option may be specified. Any option other than the ones below is interpreted as the output filename.

brief

Includes the input and output filenames, origin (ORG?value), and a brief section summary listing the VMA and LMA start and stop addresses and the section length of every section.

sections?,?segments

Includes a detailed list of sections, including the VMA and LMA alignment, any?"follows"?settings, as well as the VMA and LMA start addresses and the section length.

symbols

Includes a detailed list of all EQU values and VMA and LMA symbol locations, grouped by section.

all

All of the above.

Table of Contents

• Shared object files (.so)
• Relocatable object files (.o)
• Executable files (no convention)

Yasm only directly supports relocatable object files. Other tools, such as the GNU Linker?ld, help turn relocatable object files into the other formats. Yasm supports generation of both 32-bit and 64-bit ELF files, called?elf32?andelf64. An additional format, called?elfx32, is a 32-bit ELF file that supports 64-bit execution (instructions and registers) while limiting pointer sizes to 32-bit.

Yasm defaults to?BITS 32?mode when outputting to the?elf32?object format.

?

In NASM syntax, the attribute?nobits?is provided as an alias for?noprogbits.

?

In NASM syntax, no wrapper macro is provided for?IDENT, so it must be wrapped in square brackets. Example use in NASM syntax:

[ident "$Id$"]

The directive takes two parameters; the first parameter is the symbol name, and the second is the size. The size may be a constant or an expression. Example:

func:

ret

.end:

size func func.end-func

func:

ret

type func function

section .data

var dd 4

type var object

This functionality is primarily useful for libraries that want to provide common functions but not come into conflict with user programs. For example, libc has a syscall (function) called?"read". However, to implement a threaded process using POSIX threads in user-space, libpthread needs to supply a function also called?"read"?that provides a blocking interface to the programmer, but actually does non-blocking calls to the kernel. To allow an application to be linked to both libc and libpthread (to share common code), libc needs to have its version of the syscall with a non-weak name like?"_sys_read"?with a weak symbol called?"read". If an application is linked against libc only, the linker won‘t find a non-weak symbol for?"read", so it will use the weak one. If the same application is linked against libc?and?libpthread, then the linker will link?"read"?calls to the symbol in libpthread, ignoring the weak one in libc, regardless of library link order. If libc used a non-weak name, which?"read"?function the program ended up with might depend on a variety of factors; a weak symbol is a way to tell the linker that a symbol is less important resolution-wise.

The?WEAK?directive takes a single parameter, the symbol name to declare weak. Example:

weakfunc:

strongfunc:

ret

weak weakfunc

global strongfunc

global hashlookup:function, hashtable:data

exports the global symbol?hashlookup?as a function and?hashtable?as a data object.

global hashlookup:function hidden

You can also specify the size of the data associated with the symbol, as a numeric expression (which may involve labels, and even forward references) after the type specifier. Like this:

global hashtable:data (hashtable.end - hashtable)

?

hashtable:

db this,that,theother ; some data here

.end:

common dwordarray 128:4

This declares the total size of the array to be 128 bytes, and requires that it be aligned on a 4-byte boundary.

..gotpc

..gotoff

Referring to a location in one of your own sections using?wrt ..gotoff?will give the distance from the beginning of the GOT to the specified location, so that adding on the address of the GOT would give the real address of the location you wanted.

..got

Referring to an external or global symbol using?wrt ..got?causes the linker to build an entry?in?the GOT containing the address of the symbol, and the reference gives the distance from the beginning of the GOT to the entry; so you can add on the address of the GOT, load from the resulting address, and end up with the address of the symbol.

..plt

..sym

Referring to a symbol name using?wrt ..sym?causes Yasm to write an ordinary relocation, but instead of making the relocation relative to the start of the section and then adding on the offset to the symbol, it will write a relocation record aimed directly at the symbol in question. The distinction is a necessary one due to a peculiarity of the dynamic linker.

Table of Contents

..gotpcrel

..got

As in?elf32, referring to an external or global symbol using?wrt ..got?causes the linker to build an entry?in?the GOT containing the address of the symbol, and the reference gives the distance from the beginning of the GOT to the entry; so you can add on the address of the GOT, load from the resulting address, and end up with the address of the symbol.

..plt

..sym

As in?elf32, referring to a symbol name using?wrt ..sym?causes Yasm to write an ordinary relocation, but instead of making the relocation relative to the start of the section and then adding on the offset to the symbol, it will write a relocation record aimed directly at the symbol in question. The distinction is a necessary one due to a peculiarity of the dynamic linker.

Table of Contents

..gotpcrel

..got

As in?elf64, referring to an external or global symbol using?wrt ..got?causes the linker to build an entry?in?the GOT containing the address of the symbol, and the reference gives the distance from the beginning of the GOT to the entry; so you can add on the address of the GOT, load from the resulting address, and end up with the address of the symbol.

..plt

..sym

As in?elf64, referring to a symbol name using?wrt ..sym?causes Yasm to write an ordinary relocation, but instead of making the relocation relative to the start of the section and then adding on the offset to the symbol, it will write a relocation record aimed directly at the symbol in question. The distinction is a necessary one due to a peculiarity of the dynamic linker.

Table of Contents

Note that although Microsoft say that Win32 object files follow the?COFF?(Common Object File Format) standard, the object files produced by Microsoft Win32 compilers are not compatible with COFF linkers such as DJGPP‘s, and vice versa. This is due to a difference of opinion over the precise semantics of PC-relative relocations. To produce COFF files suitable for DJGPP, use the?coff?output format; conversely, the?coff?format does not produce object files that Win32 linkers can generate correct output from.

The available qualifiers are:

code?or?text

Defines the section to be a code section. This marks the section as readable and executable, but not writable, and also indicates to the linker that the type of the section is code.

data?or?bss

Defines the section to be a data section, analogously to?code. Data sections are marked as readable and writable, but not executable.?data?declares an initialized data section, whereas?bss?declares an uninitialized data section.

rdata

Declares an initialized data section that is readable but not writable. Microsoft compilers use this section to place constants in it.

info

align=n

Other qualifiers are supported which control specific section flags:?discard,?cache,?page,?share,?execute,?read,?write, and?base. Each of these sets the similarly-named section flag, while prefixing them with?no?clears the corresponding section flag; e.g.?nodiscard?clears the discard flag.

The defaults assumed by Yasm if you do not specify the above qualifiers are:

section .text code align=16

section .data data align=4

section .rdata rdata align=8

section .rodata rdata align=8

section .rdata$ rdata align=8

section .bss bss align=4

section .drectve info

section .comment info

Any other section name is treated by default like?.text.

Among other improvements in Windows XP SP2 and Windows Server 2003 Microsoft introduced the concept of "safe structured exception handling." The general idea is to collect handlers‘ entry points in a designated read-only table and have each entry point verified against this table for exceptions prior to control being passed to the handler. In order for an executable to be created with a safe exception handler table, each object file on the linker command line must contain a special symbol named?@feat.00. If any object file passed to the linker does not have this symbol, then the exception handler table is omitted from the executable and thus the run-time checks will not be performed for the application. By default, the table is omitted from the executable silently if this happens and therefore can be easily overlooked. A user can instruct the linker to refuse to produce an executable without this table by passing the/safeseh?command line option.

As of version 1.1.0, Yasm adds this special symbol to?win32?object files so its output does not fail to link with?/safeseh.

section .text

extern [email protected]

safeseh handler ; register handler as "safe handler"

handler:

push DWORD 1 ; MB_OKCANCEL

push DWORD caption

push DWORD text

push DWORD 0

call [email protected]

sub eax,1 ; incidentally suits as return value

; for exception handler

ret

global _main

_main:

push DWORD handler

push DWORD [fs:0]

mov DWORD [fs:0],esp ; engage exception handler

xor eax,eax

mov eax,DWORD[eax] ; cause exception

pop DWORD [fs:0] ; disengage exception handler

add esp,4

ret

text: db ‘OK to rethrow, CANCEL to generate core dump‘,0

caption:db ‘SEGV‘,0

?

section .drectve info

db ‘/defaultlib:user32.lib /defaultlib:msvcrt.lib ‘

?

If an application has a safe exception handler table, attempting to execute any unregistered exception handler will result in immediate program termination. Thus it is important to register each exception handler‘s entry point with the?safeseh?directive.

All mentions of linker in this section refer to the Microsoft linker version 7.x and later. The presence of the?@feat.00?symbol and the data for the safe exception handler table cause no backward incompatibilities and thus "safeseh" object files generated can still be linked by earlier linker versions or by non-Microsoft linkers.

Table of Contents

win64?provides a default output filename extension of?.obj.

Like the?win32?format,?win64?allows you to specify additional information on the?SECTION?directive line, to control the type and properties of sections you declare.

When an exception occurs the stack is?"unwound"?by working backwards through the chain of function calls prior to the exception event to determine whether functions have appropriate exception handlers or whether they have saved non-volatile registers whose value needs to be restored in order to reconstruct the execution context of the next higher function in the chain. This process depends on compilers and assemblers providing?"unwind data"?for functions.

The following sections give details of the mechanisms that are available in Yasm to meet these needs and thereby allow functions written in assembler to comply with the coding conventions used in 64-bit versions of Windows. These Yasm facilities follow those provided in MASM.

?

The first four integer function parameters are passed (in left to right order) in the registers RCX, RDX, R8 and R9. Further integer parameters are passed on the stack by pushing them in right to left order (parameters to the left at lower addresses). Stack space is allocated for the four register parameters ("shadow space") but their values are not stored by the calling function so the called function must do this if necessary. The called function effectively owns this space and can use it for any purpose, so the calling function cannot rely on its contents on return. Register parameters occupy the least significant ends of registers and shadow space must be allocated for four register parameters even if the called function doesn‘t have this many parameters.

The first four floating point parameters are passed in XMM0 to XMM3. When integer and floating point parameters are mixed, the correspondence between parameters and registers is not changed. Hence an integer parameter after two floating point ones will be in R8 with RCX and RDX unused.

When they are passed by value, structures and unions whose sizes are 8, 16, 32 or 64 bits are passed as if they are integers of the same size. Arrays and larger structures and unions are passed as pointers to memory allocated and assigned by the calling function.

The registers RAX, RCX, RDX, R8, R9, R10, R11 are volatile and can be freely used by a called function without preserving their values (note, however, that some may be used to pass parameters). In consequence functions cannot expect these registers to be preserved across calls to other functions.

The registers RBX, RBP, RSI, RDI, R12, R13, R14, R15, and XMM6 to XMM15 are non-volatile and must be saved and restored by functions that use them.

Except for floating point values, which are returned in XMM0, function return values that fit in 64 bits are returned in RAX. Some 128-bit values are also passed in XMM0 but larger values are returned in memory assigned by the calling program and pointed to by an additional?"hidden"?function parameter that becomes the first parameter and pushes other parameters to the right. This pointer value must also be passed back to the calling program in RAX when the called program returns.

Functions that allocate stack space, call other functions, save non-volatile registers or use exception handling are called?"frame functions"; other functions are called?"leaf functions".

Frame functions use an area on the stack called a?"stack frame"?and have a defined prologue in which this is set up. Typically they save register parameters in their shadow locations (if needed), save any non-volatile registers that they use, allocate stack space for local variables, and establish a register as a stack frame pointer. They must also have one or more defined epilogues that free any allocated stack space and restore non-volatile registers before returning to the calling function.

Unless stack space is allocated dynamically, a frame function must maintain the 16 byte alignment of the stack pointer whilst outside its prologue and epilogue code (except during calls to other functions). A frame function that dynamically allocates stack space must first allocate any fixed stack space that it needs and then allocate and set up a register for indexed access to this area. The lower base address of this area must be 16 byte aligned and the register must be provided irrespective of whether the function itself makes explicit use of it. The function is then free to leave the stack unaligned during execution although it must re-establish the 16 byte alignment if or when it calls other functions.

Leaf functions do not require defined prologues or epilogues but they must not call other functions; nor can they change any non-volatile register or the stack pointer (which means that they do not maintain 16 byte stack alignment during execution). They can, however, exit with a jump to the entry point of another frame or leaf function provided that the respective stacked parameters are compatible.

?

As already indicated, frame functions must have a well defined structure including a prologue and one or more epilogues, each of a specific form. The code in a function that is not part of its prologue or its one or more epilogues will be referred to here as the function‘s body.

A typical function prologue has the form:

mov [rsp+8],rcx ; store parameter in shadow space if necessary

push r14 ; save any non-volatile registers to be used

push r13 ;

sub rsp,size ; allocate stack for local variables if needed

lea r13,[bias+rsp] ; use r13 as a frame pointer with an offset

When a frame pointer is needed the programmer can choose which register is used ("bias"?will be explained later). Although it does not have to be used for access to the allocated space, it must be assigned in the prologue and remain unchanged during the execution of the body of the function.

If a large amount of stack space is used it is also necessary to call?__chkstk?with size in RAX prior to allocating this stack space in order to add memory pages to the stack if needed (see the Microsoft Visual Studio 2005 documentation for further details).

The matching form of the epilogue is:

lea rsp,[r13-bias] ; this is not part of the official epilogue

add rsp,size ; the official epilogue starts here

pop r13

pop r14

ret

The following can also be used provided that a frame pointer register has been established:

lea rsp,[r13+size-bias]

pop r13

pop r14

ret

These are the only two forms of epilogue allowed. It must start either with an?add rsp,const?instruction or with?lea rsp,[const+fp_register]; the first form can be used either with or without a frame pointer register but the second form requires one. These instructions are then followed by zero or more 8 byte register pops and a return instruction (which can be replaced with a limited set of jump instructions as described in Microsoft documentation). Epilogue forms are highly restricted because this allows the exception dispatch code to locate them without the need for unwind data in addition to that provided for the prologue.

The data on the location and length of each function prologue, on any fixed stack allocation and on any saved non-volatile registers is recorded in special sections in the object code. Yasm provides macros to create this data that will now be described (with examples of the way they are used).

There are two types of stack frame that need to be considered in creating unwind data.

?

Here are the low level facilities Yasm provides to create unwind data.

proc_frame?name

Generates a function table entry in?.pdata?and unwind information in?.xdata?for a function‘s structured exception handling data.

[pushreg?reg]

Generates unwind data for the specified non-volatile register. Use only for non-volatile integer registers; for volatile registers use an?[allocstack 8]?instead.

[setframe?reg,?offset]

Generates unwind data for a frame register and its stack offset. The offset must be a multiple of 16 and be less than or equal to 240.

[allocstack?size]

Generates unwind data for stack space. The size must be a multiple of 8.

[savereg?reg,?offset]

Generates unwind data for the specified register and offset; the offset must be positive multiple of 8 relative to the base of the procedure‘s frame.

[savexmm128?reg,?offset]

Generates unwind data for the specified XMM register and offset; the offset must be positive multiple of 16 relative to the base of the procedure‘s frame.

[pushframe?code]

Generates unwind data for a 40 or 48 byte (with an optional error code) frame used to store the result of a hardware exception or interrupt.

[endprolog]

Signals the end of the prologue; must be in the first 255 bytes of the function.

endproc_frame

Used at the end of functions started with?proc_frame.

PROC_FRAME sample

db 0x48 ; emit a REX prefix to enable hot-patching

push rbp ; save prospective frame pointer

[pushreg rbp] ; create unwind data for this rbp register push

sub rsp,0x40 ; allocate stack space

[allocstack 0x40] ; create unwind data for this stack allocation

lea rbp,[rsp+0x20] ; assign the frame pointer with a bias of 32

[setframe rbp,0x20] ; create unwind data for a frame register in rbp

movdqa [rbp],xmm7 ; save a non-volatile XMM register

[savexmm128 xmm7, 0x20] ; create unwind data for an XMM register save

mov [rbp+0x18],rsi ; save rsi

[savereg rsi,0x38] ; create unwind data for a save of rsi

mov [rsp+0x10],rdi ; save rdi

[savereg rdi, 0x10] ; create unwind data for a save of rdi

[endprolog]

?

; We can change the stack pointer outside of the prologue because we

; have a frame pointer. If we didn‘t have one this would be illegal.

; A frame pointer is needed because of this stack pointer modification.

?

sub rsp,0x60 ; we are free to modify the stack pointer

mov rax,0 ; we can unwind this access violation

mov rax,[rax]

?

movdqa xmm7,[rbp] ; restore the registers that weren‘t saved

mov rsi,[rbp+0x18] ; with a push; this is not part of the

mov rdi,[rbp-0x10] ; official epilog

?

lea rsp,[rbp+0x20] ; This is the official epilog

pop rbp

ret

ENDPROC_FRAME

?

From the descriptions of the YASM primitives given earlier it can be seen that there is a close relationship between each normal stack operation and the related primitive needed to generate its unwind data. In consequence it is sensible to provide a set of macros that perform both operations in a single macro call. Yasm provides the following macros that combine the two operations.

proc_frame?name

Generates a function table entry in?.pdata?and unwind information in?.xdata.

alloc_stack?n

Allocates a stack area of?n?bytes.

save_reg?reg,?loc

Saves a non-volatile register?reg?at offset?loc?on the stack.

push_reg?reg

Pushes a non-volatile register?reg?on the stack.

rex_push_reg?reg

Pushes a non-volatile register?reg?on the stack using a 2 byte push instruction.

save_xmm128?reg,?loc

Saves a non-volatile XMM register?reg?at offset?loc?on the stack.

set_frame?reg,?loc

Sets the frame register?reg?to offset?loc?on the stack.

push_eflags

Pushes the eflags register

push_rex_eflags

Pushes the eflags register using a 2 byte push instruction (allows hot patching).

push_frame?code

Pushes a 40 byte frame and an optional 8 byte error code onto the stack.

end_prologue?,?end_prolog

Ends the function prologue (this is an alternative to?[endprolog]).

endproc_frame

Used at the end of funtions started with?proc_frame.

PROC_FRAME sample ; start the prologue

rex_push_reg rbp ; push the prospective frame pointer

alloc_stack 0x40 ; allocate 64 bytes of local stack space

set_frame rbp, 0x20 ; set a frame register to [rsp+32]

save_xmm128 xmm7,0x20 ; save xmm7, rsi &amp; rdi to the local stack space

save_reg rsi, 0x38 ; unwind base address: [rsp_after_entry - 72]

save_reg rdi, 0x10 ; frame register value: [rsp_after_entry - 40]

END_PROLOGUE

sub rsp,0x60 ; we can now change the stack pointer

mov rax,0 ; and unwind this access violation

mov rax,[rax] ; because we have a frame pointer

?

movdqa xmm7,[rbp] ; restore the registers that weren‘t saved with

mov rsi,[rbp+0x18] ; a push (not a part of the official epilog)

mov rdi,[rbp-0x10]

?

lea rsp,[rbp+0x20] ; the official epilogue

pop rbp

ret

ENDPROC_FRAME

?

The chapters in this part of the book document Yasm‘s support for various debugging formats.

The chapters in this part of the book document Yasm‘s support for various instruction set architectures.

The x86 architecture has a variable instruction size that allows for moderate code compression while also allowing for very complex operand combinations as well as a very large instruction set size with many extensions. Instructions generally vary from zero to three operands with only a single memory operand allowed.

?

?

The x86 has been extended in many ways throughout its history, remaining mostly backwards compatible while adding execution modes and large extensions to the instruction set. A modern x86 processor can operate in one of four major modes: 16-bit real mode, 16-bit protected mode, 32-bit protected mode, and 64-bit long mode. The primary difference between real and protected mode is in the handling of segments: in real mode the segments directly address memory as 16-byte pages, whereas in protected mode the segments are instead indexes into a descriptor table that contains the physical base and size of the segment. 32-bit protected mode allows paging and virtual memory as well as a 32-bit rather than a 16-bit offset.

The 16-bit and 32-bit operating modes both allow for use of both 16-bit and 32-bit registers via instruction prefixes that set the operation and address size to either 16-bit or 32-bit, with the active operating mode setting the default operation size and the?"other"?size being flagged with a prefix. These operation and address sizes also affect the size of immediate operands: for example, an instruction with a 32-bit operation size with an immediate operand will have a 32-bit value in the encoded instruction, excepting optimizations such as sign-extended 8-bit values.

Unlike the 16-bit and 32-bit modes, 64-bit long mode is more of a break from the?"legacy"?modes. Long mode obsoletes several instructions. It is also the only mode in which 64-bit registers are available; 64-bit registers cannot be accessed from either 16-bit or 32-bit mode. Also, unlike the other modes, most encoded values in long mode are limited to 32 bits in size. A small subset of the?MOV?instructions allow 64 bit encoded values, but values greater than 32 bits in other instructions must come from a register. Partly due to this limitation, but also due to the wide use of relocatable shared libraries, long mode also adds a new addressing mode:?RIP-relative.

?

?

The 64-bit x86 register set consists of 16 general purpose registers, only 8 of which are available in 16-bit and 32-bit mode. The core eight 16-bit registers are?AX,?BX,?CX,?DX,?SI,?DI,?BP, and?SP. The least significant 8 bits of the first four of these registers are accessible via the?AL,?BL,?CL, and?DL?in all execution modes. In 64-bit mode, the least significant 8 bits of the other four of these registers are also accessible; these are named?SIL,?DIL,?SPL, and?BPL. The most significant 8 bits of the first four 16-bit registers are also available, although there are some restrictions on when they can be used in 64-bit mode; these are named?AH,?BH,?CH, and?DH.

The 80386 extended these registers to 32 bits while retaining all of the 16-bit and 8-bit names that were available in 16-bit mode. The new extended registers are denoted by adding a?E?prefix; thus the core eight 32-bit registers are named?EAX,?EBX,?ECX,?EDX,?ESI,?EDI,?EBP, and?ESP. The original 8-bit and 16-bit register names map into the least significant portion of the 32-bit registers.

64-bit long mode further extended these registers to 64 bits in size by adding a?R?prefix to the 16-bit name; thus the base eight 64-bit registers are named?RAX,?RBX, etc. Long mode also added eight extra registers named numerically?r8through?r15. The least significant 32 bits of these registers are available via a?d?suffix (r8d?through?r15d), the least significant 16 bits via a?w?suffix (r8w?through?r15w), and the least significant 8 bits via a?b?suffix (r8b?throughr15b).

?

Symbols