Skip to content
Reverse Engineering

Instructions

x86-64

AND / OR / NOT

Bitwise logical instructions used for masking, flag testing, and bit manipulation; AND and OR set flags while NOT does not.

AND, OR, and NOT implement the three fundamental bitwise operations. AND and OR update ZF, SF, PF and always clear CF and OF; NOT does not modify any flags at all.

Syntax

asm
and rax, 0xFF       ; keep only low 8 bits of rax (mask)
and rax, rbx        ; rax &= rbx

or  rax, 0x1        ; set LSB of rax
or  rax, rbx        ; rax |= rbx

not rax             ; rax = ~rax  (one's complement / bitwise NOT)

Common patterns

PatternMeaning
and rax, ~0xFAlign down to 16-byte boundary
and rsp, ~0xF16-byte-align the stack before a call
and eax, 0xFFZero-extend byte to 32 bits (cheaper: movzx eax, al)
or eax, eaxSet ZF/SF for null check (same as test eax,eax)
or al, 0x20Set bit 5 — convert uppercase ASCII to lowercase
not rax; add rax, 1Two's complement negation (neg rax is equivalent)

Reverse-engineering notes

  • and rsp, -16 (or and rsp, 0xFFFFFFFFFFFFFFF0) in a prologue aligns the stack to 16 bytes for SSE/AVX calls — do not confuse it with a bounds check.
  • Bit-field extraction is usually shr rax, N; and rax, mask — the shift positions the field at bit 0 and the and isolates it.
  • and followed immediately by je/jne is functionally equivalent to test but stores the result — the compiler may prefer it if the masked value is also needed later.
  • not without a following add is rare; when present it usually implements a one's-complement checksum or a bitwise complement in crypto code.