Skip to content
Reverse Engineering

Instructions

x86-64

MOV (x86/x64)

The fundamental data-transfer instruction: copies a value between registers, memory and immediates without affecting flags.

MOV copies the source operand to the destination operand. It is the most common instruction in x86/x64 code and — importantly — does not modify the EFLAGS register.

Forms

Syntax (Intel)Meaning
mov eax, ebxregister ← register
mov eax, 0x10register ← immediate
mov eax, [rbx]register ← memory
mov [rbx], eaxmemory ← register
mov rax, [rbx+rcx*4]register ← scaled-index memory

Notes for reverse engineers

  • mov eax, eax zero-extends into rax in 64-bit mode — a common idiom.
  • mov cannot copy memory-to-memory directly; compilers stage through a register.
  • xor eax, eax is preferred over mov eax, 0 to zero a register (shorter, breaks dependency), so don't expect a literal mov for every zeroing.

See also: Calling Conventions.

Try it — Virtual CPU

open full playground →
  1. 1 mov eax, 5
  2. 2 mov ebx, eax
  3. 3 mov ecx, 0x10
  4. 4 mov DWORD PTR [rbp-4], ecx
  5. 5 mov edx, DWORD PTR [rbp-4]
  6. 6
step 0
▸ Loading emulator…