Possible Duplicate:
x86 Assembly - ‘testl’ eax against eax?
I'm very very new to assembly language programming, and I'm currently trying to read the assembly language generated from a binary. I've run across
test %eax,%eax
or test %rdi, %rdi, etc. etc. I'm very confused as to what this does. Isn't the values in %eax, %eax the same? What is it testing? I read somewhere that it is doing the AND operation.....but since they are the same value, wouldn't it just return %eax?
The following is just one instance where I found this usage:
400e6e: 85 c0 test %eax,%eax
400e70: 74 05 je 400e77 <phase_1+0x23>
I thought je jumps if the two values being compared are equal......well, because %eax is well, itself, in what situation would we NOT jump?
I'm a beginner to programming in general, so I'd appreciate it very much if someone could explain this to me. Thanks!
CMP subtracts the operands and sets the flags. Namely, it sets the zero flag if the difference is zero (operands are equal).
TEST sets the zero flag, ZF, when the result of the AND operation is zero. If two operands are equal, their bitwise AND is zero when both are zero. TEST also sets the sign flag, SF, when the most significant bit is set in the result, and the parity flag, PF, when the number of set bits is even.
JE [Jump if Equals] tests the zero flag and jumps if the flag is set. JE is an alias of JZ [Jump if Zero] so the disassembler cannot select one based on the opcode. JE is named such because the zero flag is set if the arguments to CMP are equal.
So,
TEST %eax, %eax
JE 400e77 <phase_1+0x23>
jumps if the %eax is zero.
Some x86 instructions are designed to leave the content of the operands (registers) as they are and just set/unset specific internal CPU flags like the zero-flag (ZF). You can think at the ZF as a true/false boolean flag that resides inside the CPU.
in this particular case, TEST instruction performs a bitwise logical AND, discards the actual result and sets/unsets the ZF according to the result of the logical and: if the result is zero it sets ZF = 1, otherwise it sets ZF = 0.
Conditional jump instructions like JE are designed to look at the ZF for jumping/notjumping so using TEST and JE together is equivalent to perform a conditional jump based on the value of a specific register:
example:
TEST EAX,EAX
JE some_address
the CPU will jump to "some_address" if and only if ZF = 1, in other words if and only if AND(EAX,EAX) = 0 which in turn it can occur if and only if EAX == 0
the equivalent C code is:
if(eax == 0)
{
goto some_address
}
This checks if EAX is zero. The instruction test does bitwise AND between the arguments, and if EAX contains zero, the result sets the ZF, or ZeroFlag.
You are right, that test "and"s the two operands. But the result is discarded, the only thing that stays, and thats the important part, are the flags. They are set and thats the reason why the test instruction is used (and exist).
JE jumps not when equal (it has the meaning when the instruction before was a comparison), what it really does, it jumps when the ZF flag is set. And as it is one of the flags that is set by test, this instruction sequence (test x,x; je...) has the meaning that it is jumped when x is 0.
For questions like this (and for more details) I can just recommend a book about x86 instruction, e.g. even when it is really big, the Intel documentation is very good and precise.
test is a non-destructive and, it doesn't return the result of the operation but it sets the flags register accordingly. To know what it really tests for you need to check the following instruction(s). Often out is used to check a register against 0, possibly coupled with a jz conditional jump.
来源：https://stackoverflow.com/questions/13064809/the-point-of-test-eax-eax