Skip to content
Reverse Engineering

Instructions

x86-64

MOV (x86/x64)

The fundamental data-transfer instruction: copies a value between registers, memory and immediates without affecting flags.

MOV copies the source operand to the destination operand. It is the most common instruction in x86/x64 code and — importantly — does not modify the EFLAGS register.

Forms

Syntax (Intel)Meaning
mov eax, ebxregister ← register
mov eax, 0x10register ← immediate
mov eax, [rbx]register ← memory
mov [rbx], eaxmemory ← register
mov rax, [rbx+rcx*4]register ← scaled-index memory

Notes for reverse engineers

  • mov eax, eax zero-extends into rax in 64-bit mode — a common idiom.
  • mov cannot copy memory-to-memory directly; compilers stage through a register.
  • xor eax, eax is preferred over mov eax, 0 to zero a register (shorter, breaks dependency), so don't expect a literal mov for every zeroing.

See also: Calling Conventions.

Try it — Virtual CPU

open full playground →
program— ▸ is the next instruction
  1. mov eax, 5
  2. mov ebx, eax
  3. mov ecx, 0x10
  4. mov DWORD PTR [rbp-4], ecx
  5. mov edx, DWORD PTR [rbp-4]
step 0
Loading emulator…