What does the `TEST` instruction do

Question

I'm having trouble understanding the TEST instruction and its use. I'm looking at the following code at the end of a loop

0040A3D1   A9 00010181           TEST EAX,81010100
0040A3D6   74 E8                 JE SHORT JinKu_ke.0040A3C0

I understand how it works TEST AL,AL or TEXT EAX,EAX,but I do not know how it works with numbers Because the JE instruction does not jump when I use 0x810100FE and also even when we use 0x81010102, but when I use 0x60E0FEFC and below JE instruction jump.

Answer 1

1. TEST

According to the x86 Instruction Set Reference entry for TEST found at http://x86.renejeschke.de/,

[TEST] computes the bit-wise logical AND of first operand (source 1 operand) and the second operand (source 2 operand) and sets the SF, ZF, and PF status flags according to the result. The result is then discarded.

More succinctly:

AND imm32 with EAX; set SF, ZF, PF according to result.

Even more succinctly:

the AND instruction without storing the result

So for

0040A3D1 A9 00010181 TEST EAX,81010100

the value in EAX and 81010100 are ANDed together.

If the value in EAX is 0x810100FE, the operation looks like this:

EAX:                    10000001000000010000000011111110
0x81010100:         AND 10000001000000010000000100000000
                    ------------------------------------
0x81010000:             10000001000000010000000000000000

The result, 81010000, is not 0, so the zero flag is not set.

If the value in EAX is 0x60E0FEFC the operation looks like this:

EAX:                    01100000111000001111111011111100
0x81010100:         AND 10000001000000010000000100000000
                    ------------------------------------
                        00000000000000000000000000000000

Here the result is 0, so the zero flag (ZF) is set to 1.

2. JE

According to the x86 Instruction Set Reference entry for JE found at http://x86.renejeschke.de/,

[JCC] checks the state of one or more of the status flags in the EFLAGS register (CF, OF, PF, SF, and ZF) and, if the flags are in the specified state (condition), performs a jump to the target instruction specified by the destination operand. A condition code (cc) is associated with each instruction to indicate the condition being tested for. If the condition is not satisfied, the jump is not performed and execution continues with the instruction following the Jcc instruction.

In the case of 'JE' specifically,

Jump short if equal (ZF=1).

For the operation

0040A3D1 A9 00010181 TEST EAX,81010100

• if the value in EAX is 0x81010102, the zero flag (ZF) does not get set (see above), so flow of control does not branch here.

• if the value in EAX is 0x60E0FEFC, the zero flag (ZF) is set to 1 (see above). As a result, flow of control branches at this point.

Summary

• TEST is like AND, but the results of the operation are not saved. Only the PF, SF and ZF flags are set.
• the zero flag (ZF) is set to 1 if the results of an arithmetic or logical operation (like TEST) are 0.
• JE causes EIP to be updated if ZF = 1.
• if the value in EAX is 0x81010102, the zero flag (ZF) does not get set, so flow of control does not branch here.
• if the value in EAX is 0x60E0FEFC, the zero flag (ZF) is set to 1. As a result, flow of control branches at this point.