SAR command in X86 assembly with one parameter

Kevin picture Kevin · Oct 10, 2012 · Viewed 21.7k times · Source

In a disassembled program I'm analyzing, I found the command

sar %eax

What does this do? I know that sar with two arguments performs a right shift, but I can't find what it means with only one parameter.

This program was compiled for an Intel x86 processor.

Answer

Necrolis picture Necrolis · Oct 10, 2012

Looks like the dissembler used short-hand for SAR EAX,1 which has an opcode of 0xD1F8. when the immediate is not 1, aka SAR EAX,xx, the opcode is 0xC1F8 xx, see the Intel Instruction reference, Vol. 2B, 4-353.