Computer Organization &

Assembly Languages

Conditional Processing

Adapted from the slides prepared by Kip Irvine for the book,
Assembly Language for Intel-Based Computers, 5th Ed.
 Chapter Overview
 Boolean and Comparison
Instructions
 Conditional Jumps
 Conditional Loop
Instructions
 Conditional Structures
 Application: Finite-State
Machines
 Decision Directives

2
 Boolean and Comparison Instructions
 CPU Status Flags
 AND Instruction
 OR Instruction
 XOR Instruction
 NOT Instruction
 Applications
 TEST Instruction
 CMP Instruction

3
 Status Flags - Review
 The Zero flag is set when the result of an operation equals zero.
 The Carry flag is set when an instruction generates a result that is too
large (or too small) for the destination operand.
 The Sign flag is set if the destination operand is negative, and it is clear
if the destination operand is positive.
 The Overflow flag is set when an instruction generates an invalid signed
result.
 The Parity flag is set when an instruction generates an even number of 1
bits in the low byte of the destination operand.
 The Auxiliary Carry flag is set when an operation produces a carry out
from bit 3 to bit 4

4
 AND Instruction
 Performs a Boolean AND operation between each
pair of matching bits in two operands
 Syntax: (OF=0,CF=0,SF,ZF,PF)
AND
AND destination, source
(same operand types as MOV)

0011101
AND 1
0000111
cleared 00001011 unchanged
1

AND instruction is often used to clear selected bits

5
 OR Instruction
 Performs a Boolean OR operation between each
pair of matching bits in two operands
 Syntax: (OF=0,CF=0,SF,ZF,PF)
OR
OR destination, source

00111011
OR 00001111
unchanged 00111111 set

OR instruction is often used to set selected bits

6
 XOR Instruction
 Performs a Boolean exclusive-OR operation
between each pair of matching bits in two
operands XOR
 Syntax: (OF=0,CF=0,SF,ZF,PF)
XOR destination, source

0011101
XOR 1
0000111
unchanged 00110100 inverted
1

XOR is a useful way to invert the bits in an operand.

7
 NOT Instruction
 Performs a Boolean NOT operation on a single
destination operand
NOT
 Syntax: (no flag affected)
NOT destination

NOT 00111011
11000100 inverted

8
 Applications (1 of 5)

• Task: Convert the character in AL to upper case.

• Solution: Use the AND instruction to clear bit 5.

mov al,'a' ; AL = 01100001b

and al,11011111b ; AL = 01000001b

9
 Applications (2 of 5)

• Task: Convert a binary decimal byte into its

equivalent ASCII decimal digit.
• Solution: Use the OR instruction to set bits
4 mov
and al,6
5. ; AL = 00000110b
or al,00110000b ; AL = 00110110b

The ASCII digit '6' = 00110110b

10
 Applications (3 of 5)

• Task: Turn on the keyboard CapsLock key

• Solution: Use the OR instruction to set bit 6 in the
keyboard flag byte at 0040:0017h in the BIOS data
area.

mov ax,40h ; BIOS segment

mov ds,ax
mov bx,17h ; keyboard flag byte
or BYTE PTR [bx],01000000b ; CapsLock on

This code only runs in Real-address mode, and it

does not work under Windows NT, 2000, or XP.

11
 Applications (4 of 5)

• Task: Jump to a label if an integer is even.

• Solution: AND the lowest bit with a 1. If the result is
Zero, the number was even.
mov ax,wordVal
and ax,1 ; low bit set?
jz EvenValue ; jump if Zero flag set

12
 Applications (5 of 5)

• Task: Jump to a label if the value in AL is not zero.

• Solution: OR the byte with itself, then use the JNZ
(jump if not zero) instruction.

or al,al
jnz IsNotZero ; jump if not zero

ORing any number with itself does not change its value.

13
 TEST Instruction
 Performs a nondestructive AND operation between each
pair of matching bits in two operands
 No operands are modified, but the flags is affected.
 Example: jump to a label if either bit 0 or bit 1 in AL is
set.

test al,00000011b
jnz

ValueFound

• Example: jump to a label if neither bit 0 nor bit 1 in AL

is set.
test al,00000011b
14
jz
 CMP Instruction (1 of 3)

 Compares the destination operand to the source operand

 Nondestructive subtraction of source from destination (destination operand
is not changed)
 Syntax: CMP destination, source (OF,SF,ZF,CF,AF,PF)
 Example: destination == source (unsigned)

mov al,5
cmp al,5 ; Zero flag set

• Example: destination < source (unsigned)

mov al,4
cmp al,5 ; Carry flag set

15
 CMP Instruction (2 of 3)

 Example: destination > source (unsigned)

mov al,6
cmp al,5 ; ZF = 0,
CF = 0

(both the Zero and Carry flags are clear)

16
 CMP Instruction (3 of 3)
 Example: destination > source (signed)

mov al,5
cmp al,-2 ; Sign flag == Overflow flag

• Example: destination < source (signed)

mov al,-1
cmp al,5 ; Sign flag != Overflow flag

17
 Setting and Clearing Flags
and al, 0 ; set Zero
or al, 1 ; clear Zero
or al, ; set Sign
80h and ; clear Sign
al, 7Fh ; set Carry
stc ; clear Carry
clc

mov al, 7Fh ; set Overflow

inc al
; clear Overflow
or eax, 0 18
Pentium Flags Register

19
 What's Next
 Boolean and Comparison Instructions
 Conditional Jumps
 Conditional Loop Instructions
 Conditional Structures
 Application: Finite-State Machines
 Decision Directives

20
 Conditional Structures
 There are no high-level logic structures such as if-
then-else, in the IA-32 instruction set. But, you can
use combinations of comparisons and jumps
to implement any logic structure.

 First, an operation such as CMP, AND or SUB is

executed to modify the CPU flags. Second, a
conditional jump instruction tests the flags and
change the execution flow accordingly.
CMP AL, 0
JZ

L1 21
 Jcond Instruction
 A conditional jump instruction branches to a label
when specific register or flag conditions are met

 Examples:
 JB, JC jump to a label if the Carry flag is set
 JE, JZ jump to a label if the Zero flag is set
 JS jumps to a label if the Sign flag is set
 JNE, JNZ jump to a label if the Zero flag is clear
 JECXZ jumps to a label if ECX equals 0

22
 Conditional Jumps
 Jumps Based On . . .
 Specific flags
 Equality
 Unsigned comparisons
 Signed Comparisons
 Applications
 Encrypting a String
 Bit Test (BT) Instruction

23
 Jcond Ranges
 Prior to the 386:
 jump must be within –128 to +127 bytes from current
location counter

 IA-32 processors:
 32-bit offset permits jump anywhere in memory

24
Jumps Based on Specific Flags

25
Jumps Based on Equality

26
Jumps Based on Unsigned Comparisons

27
Jumps Based on Signed Comparisons

28
 Applications (1 of 5)
• Task: Jump to a label if unsigned EAX is greater than EBX
• Solution: Use CMP, followed by JA

cmp eax,ebx
ja

Larger

• Task: Jump to a
label if signed EAX
is greater than
EBX
• Solution: Use
CMP, followed by
JG
29
cmp eax,ebx
 Applications (2 of 5)

• Jump to label L1 if unsigned EAX is less than or equal to Val1

cmp eax,Val1
jbe L1 ; below or equal

• Jump to label L1 if signed EAX is less than or equal to Val1

cmp eax,Val1
jle L1

30
 Applications (3 of 5)
• Compare unsigned AX to BX, and copy the larger of the two
into a variable named Large
mov Large,bx
cmp ax,bx
jna Next
mov Large,ax
Next:

• Compare signed AX to BX, and copy the smaller of the two

into a variable named Small
mov Small,ax
cmp bx,ax
jnl Next
mov Small,bx
Next:

31
 Applications (4 of 5)
• Jump to label L1 if the memory word pointed to by ESI equals
Zero
cmp WORD PTR [esi],0
je L1

• Jump to label L2 if the doubleword in memory pointed to by

EDI is even

test DWORD PTR [edi],1

jz L2

32
 Applications (5 of 5)
• Task: Jump to label L1 if bits 0, 1, and 3 in AL are all set.
• Solution: Clear all bits except bits 0, 1,and 3. Then
compare the result with 00001011 binary.
and al,00001011b ; clear unwanted bits
cmp ; check remaining bits
al,00001011b je ; all set? jump to L1
L1

33
 Example: Scanning a Array
• Find the first even number in an array of unsigned
integers
.date
intArray DWORD 7,9,3,4,6,1
.code
...
mov ebx, OFFSET intArray
mov ecx, LENGTHOF intArray
L1: test DWORD PTR [ebx], 1
jz found
add ebx, 4
loop L1
...

34
 Example: Encrypting a String
key

message encoder
(plain text)

unintelligible string
(cipher text)

message encoder
(plain text)

key
35
 Example: Encrypting a String
The following loop uses the XOR instruction to transform every
character in a string into a new value.
KEY = 239 ; can be any byte value
BUFMAX = 128
.data
buffer BYTE BUFMAX+1 DUP(0)
bufSize DWORD BUFMAX

.code
mov ecx,bufSize ; loop counter
mov esi,0 ; index 0 in buffer
L1:
xor buffer[esi],KEY ; translate a byte
inc esi ; point to next byte
loop L1

36
 String Encryption Program
 Tasks:
 Input a message (string) from the user
 Encrypt the message
 Display the encrypted message
 Decrypt the message
 Display the decrypted message

Enter the plain text: Attack at dawn.

Cipher text: «¢¢Äîä-Ä¢-ïÄÿü-Gs
Decrypted: Attack at dawn.

37
 What's Next
 Boolean and Comparison Instructions
 Conditional Jumps
 Conditional Loop Instructions
 Conditional Structures
 Application: Finite-State Machines
 Decision Directives

38
 Conditional Loop Instructions
 LOOPZ and LOOPE
 LOOPNZ and LOOPNE

39
 LOOPZ and LOOPE
 Syntax:
LOOPE destination
LOOPZ destination
 Logic:
 ECX  ECX – 1
 if ECX > 0 and ZF=1, jump to destination
 Loop While CX/ECX > 0 and ZF = 1

 Useful when scanning an array for the first

element that does not match a given value.
 http://www.c-jump.com/CIS77/reference/ISA/DDU0105.html
(reference)
40
 LOOPNZ and LOOPNE
 LOOPNZ (LOOPNE) is a conditional loop
instruction
 Syntax:
LOOPNZ destination
LOOPNE destination
 Logic:
 ECX  ECX – 1;
 if ECX > 0 and ZF=0, jump to destination
 Loop While CX/ECX > 0 and ZF = 0
 Useful when scanning an array for the first element that
matches a given value.
 http://www.c-jump.com/CIS77/reference/ISA/DDU0104.html
41
 LOOPNZ Example
The following code finds the first positive value in an array:
.data
array SWORD -3,-6,-1,-10,10,30,40,4
sentinel SWORD 0
.code
mov esi,OFFSET array
mov ecx,LENGTHOF array
next:
test WORD PTR [esi],8000h ; test sign bit
pushfd ; push flags on stack
add esi,TYPE array
popfd ; pop flags from stack
loopnz next ; continue loop
jnz quit ; none found
sub esi,TYPE array ; ESI points to value
quit:

42
 Your turn . . .
Locate the first nonzero value in the array. If none is found, let
ESI point to the sentinel value:
.data
array SWORD 50 DUP(?)
sentinel SWORD 0FFFFh
.code
mov esi,OFFSET array
mov ecx,LENGTHOF array
L1: cmp WORD PTR [esi],0

; check for zero

(fill in your code

here)
quit:

43
 . . . (solution)
.data
array SWORD 50 DUP(?)
sentinel SWORD 0FFFFh
.code
mov esi,OFFSET array
mov ecx,LENGTHOF array
L1: cmp WORD PTR ; check for zero
[esi],0 pushfd ; push flags on stack
add esi,TYPE array
popfd ; pop flags from stack
loope L1 ; continue loop
jz quit ; none found
sub esi,TYPE array ; ESI points to value
quit:

44
 What's Next
 Boolean and Comparison Instructions
 Conditional Jumps
 Conditional Loop Instructions
 Conditional Structures
 Application: Finite-State Machines
 Decision Directives

45
 Conditional Structures
• Block-Structured IF Statements
• Compound Expressions with
AND
• Compound Expressions with OR
• WHILE Loops
• Table-Driven Selection

46
 Block-Structured IF Statements
Assembly language programmers can easily translate logical
statements written in C++/Java into assembly language. For
example:

if( op1 == op2 ) mov eax,op1

X = 1; cmp
eax,op2
else
jne L1
X = 2; mov X,1
jmp L2
L1: mov
X,2 L2:

47
 Your turn . . .

Implement the following pseudocode in assembly

language. All values are unsigned:
if( ebx <= ecx ) cmp ebx,ecx
{ ja
next mov
eax = 5;
eax,5 mov
edx = 6; edx,6
} next:

(There are multiple correct solutions to this problem.)

48
 Your turn . . .

Implement the following pseudocode in assembly

language. All values are 32-bit signed integers:

if( var1 <= var2 ) mov eax,var1

var3 = 10; cmp
eax,var2
else
jle L1
{ mov var3,6
var3 = 6; mov
var4 = 7; var4,7
} jmp L2
L1: mov
var3,10 L2:
(There are multiple correct solutions to this problem.)

49
 Compound Expression with AND
 When implementing the logical AND operator, consider
(1 of 3)
that HLLs use short-circuit evaluation
 In the following example, if the first expression is false,
the second expression is skipped:

if (al > bl) AND (bl > cl)

X = 1;

50
 Compound Expression with AND

(2 of 3) if (al > bl) AND (bl > cl)

X = 1;

This is one possible implementation . . .

cmp al,bl ; first expression... ja L1
jmp next
L1:
cmp bl,cl ; second expression... ja L2
jmp next

L2: ; both are true

mov X,1 ; set X to 1
next:

51
 Compound Expression with AND
if (al > bl) AND (bl > cl)
(3 of 3) X = 1;

But the following implementation uses 29% less code by

reversing the first relational operator. We allow the program to
"fall through" to the second expression:

cmp al,bl ; first expression...

jbe next ; quit if false
cmp bl,cl ; second expression...
jbe next ; quit if false
mov X,1 ; both are true
next:

52
 Your turn . . .

Implement the following pseudocode in assembly

language. All values are unsigned:
if( ebx <= ecx cmp ebx,ecx
&& ecx > edx ) ja
next cmp
{
ecx,edx
eax = 5; jbe next
edx = 6; mov eax,5
} mov edx,6
next:

(There are multiple correct solutions to this problem.)

53
 Compound Expression with OR (1 of 2)

 When implementing the logical OR operator, consider

that HLLs use short-circuit evaluation
 In the following example, if the first expression is true,
the second expression is skipped:

if (al > bl) OR (bl > cl)

X = 1;

54
 Compound Expression with OR (1 of 2)

if (al > bl) OR (bl > cl)

X = 1;

cmp al,bl ; is AL > BL?

ja L1 ; yes
cmp bl,cl ; no: is BL > CL?
jbe next ; no: skip next statement
L1: X,1 ; set X to 1
mov
next:

55
 WHILE Loops
A WHILE loop is really an IF statement followed by the
body of the loop, followed by an unconditional jump to the
top of the loop. Consider the following example:
while( eax < ebx)
eax = eax +
1;

This is a possible implementation:

top: eax,ebx ; check loop condition
cmp
jae next ; false? exit loop
inc eax ; body of loop
next:jmp top ; repeat the loop

56
 Your Turn . . .
Implement the following loop, using unsigned 32-bit integers:

while( ebx <= val1)

{
ebx = ebx + 5;
val1 = val1 - 1
}

top: ebx,val1 ; check loop condition

cmp
ja next ; false? exit loop
add ebx,5 ; body of loop
dec val1
next:jmp top ; repeat the loop

57
 Example: IF statement nested in a loop

while(eax < ebx) _while: cmp eax, ebx

{ jae _endwhile
eax++; inc eax
if (ebx==ecx) cmp ebx,
X=2; ecx jne
else _else mov
X=3; X, 2 jmp
} _else: _while mov
X, 3 jmp
_while
_endwhile:

58
 Table-Driven Selection (1 of 3)

 Table-driven selection uses a table lookup to

replace a multiway selection structure
 Create a table containing lookup values and
the offsets of labels or procedures
 Use a loop to search the table
 Suited to a large number of comparisons

59
 Table-Driven Selection (2 of 3)

Step 1: create a table containing lookup values and

procedure offsets:
.data
CaseTable BYTE 'A' ; lookup value
DWORD ; address of procedure
Process_A
EntrySize = ($ - CaseTable)
BYTE 'B'
DWORD Process_B
BYTE 'C'
DWORD Process_C
BYTE 'D'
DWORD Process_D

NumberOfEntries =
($ - CaseTable) /
EntrySize

60
 Table-Driven Selection (3 of 3)

Step 2: Use a loop to search the table. When a match is found,

we call the procedure offset stored in the current table entry:

mov ebx,OFFSET CaseTable ; point EBX to the table

mov ecx,NumberOfEntries ; loop counter

L1: cmp al, ; match found?

[ebx] jne ; no: continue
L2 ; yes: call the procedure
call NEAR PTR [ebx + 1] ; and exit the loop
jmp L3 ; point to next entry
L2: add ; repeat until ECX = 0
ebx,EntrySize
L3: loop L1

required for
procedure
pointers

61
 What's Next
 Boolean and Comparison Instructions
 Conditional Jumps
 Conditional Loop Instructions
 Conditional Structures
 Application: Finite-State Machines
 Decision Directives

62
 Application: Finite-State Machines
 A finite-state machine (FSM) is a graph structure that
changes state based on some input. Also called a state-
transition diagram.
 We use a graph to represent an FSM, with squares or
circles called nodes, and lines with arrows between the
circles called edges (or arcs).
 A FSM is a specific instance of a more general structure
called a directed graph (or digraph).
 Three basic states, represented by nodes:
 Start/initial state
 Terminal state(s)
 Nonterminal state(s)
63
 Finite-State Machine
 Accepts any sequence of symbols that puts it into an
accepting (final) state
 Can be used to recognize, or validate a sequence of
characters that is governed by language rules (called a
regular expression)
 Advantages:
 Provides visual tracking of program's flow of
control
 Easy to modify
 Easily implemented in assembly language

64
 FSM Examples
 FSM that recognizes strings beginning with 'x', followed by
letters 'a'..'y', ending with 'z':
'a'..'y'

start 'x'
A B
'z
'
C

• FSM that recognizes signed integers:

digit

digit
digit

start +,-
A B

65
 Your Turn . . .
 Explain why the following FSM does not work as
well for signed integers as the one shown on
the previous slide:
digit
digit
start +,-
A B

66
 Implementing an FSM
The following is code from State A in the Integer FSM:
StateA:
call Getnext ; read next char into AL
cmp al,'+' ; leading + sign?
je StateB ; go to State B
cmp al,'-' ; leading - sign?
je StateB ; go to State B
call IsDigit ; ZF = 1 if AL = digit
jz StateC ; go to State C
call DisplayErrorMsg ; invalid input found
jmp Quit

digit

digit
digit

start +,-
A B

67
 IsDigit Procedure
Receives a character in AL. Sets the Zero flag if the
character is a decimal digit.
IsDigit PROC
cmp al,'0' ; ZF = 0
jb ID1
cmp al,'9' ; ZF = 0
ja ID1
test ax,0 ; ZF = 1
ID1: ret
IsDigit ENDP

68
 What's Next
 Boolean and Comparison Instructions
 Conditional Jumps
 Conditional Loop Instructions
 Conditional Structures
 Application: Finite-State Machines
 Decision Directives

69
 Runtime Expressions
• .IF, .ELSE, .ELSEIF, and .ENDIF can be used to create block-
structured IF statements.
• Examples:

.IF eax > ebx .IF eax > ebx && eax > ecx
mov mov edx,1
edx,1 .ELSE
.ELSE mov edx,2
mov edx,2 .ENDIF
.ENDIF

• MASM generates "hidden" code for you, consisting of code

labels, CMP and conditional jump instructions.

70
Relational and Logical Operators

71
 MASM-Generated Code
.data
val1 DWORD 5
result Generated code:
DWORD ?
mov eax,6
.code cmp eax,val1
mov eax,6 jbe @C0001
mov
.IF result,1
eax > val1 mov result,1
.ENDIF
@C0001:

MASM automatically generates an unsigned jump (JBE)

because val1 is unsigned.

72
 MASM-Generated Code
.data
val1 SDWORD 5
result SDWORD ? Generated code:
.code
mov eax,6
mov eax,6 cmp eax,val1
.IF eax > val1 jle @C0001
mov result,1 mov result,1
.ENDIF
@C0001:

MASM automatically generates a signed jump (JLE)

because val1 is signed.

73
 MASM-Generated Code
.data
result DWORD ? Generated code:
.code
mov ebx,5
mov ebx,5 mov eax,6
mov cmp eax,ebx
eax,6 jbe @C0001
mov result,1
mov
.IF eaxresult,1
>
ebx @C0001:
.ENDIF

MASM automatically generates an unsigned jump (JBE)

when both operands are registers . . .

74
 MASM-Generated Code
.data
result SDWORD ? Generated code:
.code
mov ebx,5
mov ebx,5 mov eax,6
mov cmp eax,ebx
.IF SDWORD PTR eax > ebx
eax,6 jle @C0001
mov result,1
mov result,1
@C0001:
.ENDIF

. . . unless you prefix one of the register operands with the

SDWORD PTR operator. Then a signed jump is generated.

75
 .REPEAT Directive
Executes the loop body before testing the loop
condition associated with the .UNTIL
directive.
Example:
; Display integers 1 – 10:

mov eax,0
.REPEAT
inc eax
call WriteDec
call Crlf
.UNTIL eax == 10

76
 .WHILE Directive
Tests the loop condition before executing the loop body
The .ENDW directive marks the end of the loop.
Example:
; Display integers 1 – 10:

mov eax,0
.WHILE eax < 10
inc eax
call WriteDec
call Crlf
.ENDW

77