3

I am reversing an ELF64 executable created on AMD X86-64. I encountered this line near the end of the file and am puzzled to its meaning:

nop    WORD PTR cs:[rax+rax*1+0x0]

In this case rax contains 0x2329. However, nop means 'do nothing', so I am puzzled as to why there are arguments included on the line. The code is loaded with libc function calls so I am assuming the source code is C/C++ and not GAS.

This post has good content but perror's explanation is more apropos and contains more "why" than a mere recital of the Intel docs.

Improve this question
2
  • 4
    Possible duplicate of nop with argument in x86_64
    – TkTech
    Sep 22, 2017 at 7:12
  • Thank you. I missed that posting somehow. It is similar however I believe the response "The one-byte NOP instruction is an alias mnemonic for the XCHG (E)AX, (E)AX instruction" is not valid on IA-32 and 64 processors. At least according to the Intel documents.
    – Not a machine
    Sep 22, 2017 at 14:07

1 Answer 1

Reset to default
3

There are mainly two usage of the nop instructions:

  1. They are quite often used as padding at the end of assembly procedures or in-between procedures. And, in this case one may want to pad with "more than one byte at the time", this is why they added extra arguments (that are just ignored most of the time).

    See: NOP instruction (Wikipedia) and NOP—No Operation (x86 Instruction Set Reference).

  2. They can also be used to delay a bit the ALU in between two memory fetches in order to give the pipeline a chance to get a correct prediction of the data values. And, this is probably your case because this instruction perform a small arithmetic computation when computing rax+rax*1+0x0, therefore the ALU has is really delayed because of this operation.

    See: Delay Slot (Wikipedia).

Improve this answer
1
  • Thank you. Looking at the surrounding code the delay slot answer makes complete sense. It very much resembles the NOP DWORD ptr [EAX + EAX *1 + 0x0 8 byte eample in the Intel docs.
    – Not a machine
    Sep 22, 2017 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.