Opcode Map

As with almost all processors, instructions can be laid out into a table. These tables can ease decoding unknown streams of instructions.

Using the Tables

This section is a work in progress. It is incomplete, and may not be completely accurate or up to date. The wording or grammar is also in the process of being improved.

The tables linked to further down are organized by their bits encoded in hex; The lowest four bits determine the column, and the upper four determine the row. For example, given the byte 0x90, find the row corresponding to the upper four bits (the 9x row), and move right to the column for the four three bits (the 0 column). The cell located will either give instructions on what to do next (for example, 0x0F/0o017 in the one byte table), or tell you the specific opcode encoded by that byte.

Any blanks in the tables are reserved encodings and should not be used. Similarly, any cells marked " Reserved NOP" are also reserved, but may behave as a NOP on certain processors.

Key to Abbreviations

Operands are identified by a two or more character long code in the form of all uppercase characters followed by all lowercase characters. The uppercase portion specifies an addressing method (i.e.where the operand is actually encoded). The lowercase portion specifies the operand size. For example, the code Rq would specify that that specific operand must be a 64 bit (q) general purpose register encoded in the r/m field of the ModR/M byte (R).

Operand Addressing Methods

The addressing method of an operand determines where in the instruction an operand is encoded.

A
A direct address is encoded in the bytes following the instruction. No ModR/M or SIB bytes are allowed.
B
The vvvv field of the VEX (or EVEX) prefix selects a general purpose register.
C
The reg field of the ModR/M byte selects a control register.
D
The reg field of the ModR/M byte selects a debug register.
E
The r/m field of the ModR/M byte selects either a general purpose register or memory (depending on the mod field).
F
An implicit encoding of the FLAGS register.
G
The reg field of the ModR/M byte selects a general purpose register.
H
The vvvv field of the VEX (or EVEX) prefix selects a vector register.
I
Immediate data encoded in the bytes following the instruction.
J
The bytes following the instruction encode a relative offset to be added to the instruction pointer. The computed address is the actual value used in the instruction.
L
The upper nibble (the four upper bits) of an eight bit immediate selects a vector register. In 32 bit mode, the most significant bit is ignored to enforce access only to the first eight registers.
M
The ModR/M byte must refer to memory (i.e. the mod field cannot be 0b11).
N
The r/m field of the ModR/M byte selects an MMX register. The mod field must not refer to memory (i.e. it has to be 0b11).
O
The bytes following an instruction encode a relative offset to be added to the instruction pointer. The computed address references data that will be used in the instruction.
P
The reg field of the ModR/M byte selects an MMX register.
Q
The r/m field of the ModR/M byte selects either an MMX register or memory (depending on the mod field).
R
The r/m field of the ModR/M byte selects a general purpose register. The mod field must not refer to memory (i.e. it has to be 0b11).
S
The reg field of the ModR/M byte selects a segment register.
U
The r/m field of the ModR/M byte selects a vector register. The mod field must not refer to memory (i.e. it has to be 0b11).
V
The reg field of the ModR/M byte selects a vector register.
W
The r/m field of the ModR/M byte selects either a vector register or memory (depending on the mod field).
X
An implicit encoding of the memory referenced by the DS:SI (DS:ESI in 32 bit mode, and DS:RSI in 64 bit mode).
Y
An implicit encoding of the memory referenced by the ES:DI (ES:EDI in 32 bit mode, and ES:RDI in 64 bit mode).
Z[custom]
The lowest three bits of the opcode select a general purpose register.
BE[custom]
The r/m field of the ModR/M byte selects either a bounds register or memory (depending on the mod field).
BG[custom]
The reg field of the ModR/M byte selects a bounds register.
KE[custom]
The r/m field of the ModR/M byte selects either a mask register or memory (depending on the mod field).
KG[custom]
The reg field of the ModR/M byte selects a mask register.
KR[custom]
The r/m field of the ModR/M byte selects a mask register. The mod field must not refer to memory (i.e. it has to be 0b11).
TG[custom]
The reg field of the ModR/M byte selects a tile register.
TH[custom]
The vvvv field of the VEX (or EVEX) prefix selects a tile register.
TR[custom]
The r/m field of the ModR/M byte selects a tile register. The mod field must not refer to memory (i.e. it has to be 0b11).

Operand Size

a
Two one-word or two doubleword operands (depending on the operand size attribute)
b
A byte (eight bits).
c
Either a byte or a word (depending on the operand size attribute).
d
A doubleword (32 bits).
dq
A doublequadword (128 bits).
dqq[custom]
A doublequadquadword (512 bits).
p
A 32, 48, or 80 bit pointer (depending on the operand size attribute). In other words, a 16 bit selector and a 16, 32, or 64 bit address.
pi
A quadword MMX register
pv[custom]
A packed 128, 256, or 512 bit vector register (depending on the operand size attribute).
q
A quadword (64 bits).
qq
A quadquadword (256 bits).
qqq[custom]
A quadquadquadword (512 bits).
s
A 32, 48, or 80 bit pseudo-descriptor (depending on the operand size attribute). In other words, a 16 bit selector and a 16, 32, or 64 bit address.
sv[custom]
A scalar element from a vector register. How many bits depends on the operand size.
v
In 16 and 32 bit operand size: A word or doubleword (depending on the operand size attribute). In 64 bit operand size: A quadword.
w
A word (16 bits).
x
A doublequadword or quadquadword (depending on the operand size attribute).
y
A doubleword or quadword (depending on the operand size attribute).
z
In 16 bit operand size: A word. In 32 or 64 bit operand size: A doubleword.

Specific Register Access

Sometimes, an opcode mandates a specific register as an operand. For example, some arithmetic instructions have shorter encodings if the accumulator (AX/EAX/RAX) is used. When this is the case, the table will call out the specific register by name.

Superscript Meaning

Sometimes, instructions have specific requirements for their encoding to be valid. For example, in 16 and 32 bit mode, opcodes in the 0x4x (0x40/0o100 through 0x4F/0o117) encode single byte INC and DEC (Decrement by One) instructions. In 64 bit mode, these bytes are repurposed for the REX prefix. To denote this discrepency, the superscript i64 is used. A full list of superscripts that are used is below.

i64
This instruction is not encodable in 64 bit mode.
o64
This instruction is only available in 64 bit mode.
d64
When in 64 bit mode, this instruction defaults to an unchangeable 64 bit operand size attribute.
f64
When in 64 bit mode, this instruction defaults to an unchangeable 64 bit operand size attribute. The operand size override prefix, if present, will be ignored.
v
No legacy SSE form of this instruction exists; It must be encoded using a VEX (or EVEX) prefix.
v128
Only legacy SSE and VEX.128 (or EVEX.128) forms of this instruction are valid. The VEX.256 (or EVEX.256 or EVEX.512) form is invalid.

Decoding an Instruction

This section is a work in progress. It is incomplete, and may not be completely accurate or up to date.

One Byte Instruction Example

This section is a work in progress. It is incomplete, and may not be completely accurate or up to date.

Two Byte Instruction Example

This section is a work in progress. It is incomplete, and may not be completely accurate or up to date.

Three Byte Instruction Example

This section is a work in progress. It is incomplete, and may not be completely accurate or up to date.

x87 FPU Instruction Example

This section is a work in progress. It is incomplete, and may not be completely accurate or up to date.

(E)VEX Prefixed Instruction Example

This section is a work in progress. It is incomplete, and may not be completely accurate or up to date.

Links to Tables