Skip to content

Instantly share code, notes, and snippets.

@0x61nas
Last active February 6, 2024 16:52
Show Gist options
  • Save 0x61nas/a5945c420fd8c7a0bd5d5bc4fe8d9c37 to your computer and use it in GitHub Desktop.
Save 0x61nas/a5945c420fd8c7a0bd5d5bc4fe8d9c37 to your computer and use it in GitHub Desktop.

RFlags is like a veritable junk drawer of disjointed little bits of information. RFlags as a whole is a single 64-bit register buried inside he CPU. It's the 64-bit extension of the 32-bit EFlags register, which in turn is the 32-bit extension of the 16-bit Flags register. There's only 18 bits of the RFlags register are actually flags. The reset is reserved for later use in future generations of Intel CPUs. A flag is a single bit of information, whose meaning is independent from any other bits. A bit can be set to 1 or clered to 0 by the CPU as its needs require.

I Shorthand Name Description
0 CF Carry Flag Used in assigned arithmetic operations. If the result of arithmetic or shift operation carries out a bit from the operand.
1 - Undefind -
2 PF Parity Flag Indecates whether the number of set (1) bits in the low-order byte of a result is even(set), or odd(cleard).
3 - Undefind -
4 AF Auxiliarty Carry Flag Used only for BCD arithmetic. BCD arithmetic treats each operand byte as a pair of 4-bit "nybbles" and allows something approximating disemal(base 10) arithmatec to be done directly on the CPU hardware by one of the BCD instructions. These instructoins are obsolete and doesn't present in x64.
5 - Undefind -
6 ZF Zero Flag Set when the result of an operation become zero.
7 SF Sign Flag Set when the result of an operation forcess the operand to become nigative. By nigative here we mean that the highest-order bit in the operand(a.k.a sign bit) becomse 1 during signed arithmetic opeuadionoo
8 TF Trap Flag Allows debuggers to manage single-steping, by forcing the CPU to execute only one instruction before calling the interrupt routine
9 IF Interrupt Enable Flag This's two way flag, the CPU sets it under serten condetions, and you can set it yourself by STI and CLI instructions—though you probably wont; Because under Linux this flag is reserved for use of the operating system and sometimes its drivers. If you try to use SIT or CLT instructions withen your programs, Linux will hand you a general protection fault.
10 DF Direction Flag When DF is set, string instructotions proceed from the high memory toward the low memory. When DF is cleard, string instructions proceed from low memory toward high memory.
11 OF Overflow Flag Set when the result of arithmatec operation on signed quantity becomes too large to fit in the operand it originally occupied. OF is genraly used as the "carry flag" in signed arithmetic.
12 IOPL I/O Privilege Level 0 Reserved by operating system in protected mode
13 IOPL I/O Privilege Level 1 Reserved by operating system in protected mode
14 NT Nested Task Flag Reserved by operating system in protected mode
15 - Undefined -
16 RF Resume Flag Facilitates single-stepping
17 VM Virtual-86 Mode Flag Reserved by operating system in protected mode
18 AC Alignment Check Flag Reserved by operating system in protected mode
19 VIF Virtual Interrupt Flag Reserved by operating system in protected mode
20 VIP Virtual Interrupt Pending Reserved by operating system in protected mode
21 ID CPU ID If this bit can be change by userspace programs, CPUID is available

Note

You must remember that the descriptions of the flags on the previous table are generalizations only and are subject to specific restrictions and special cases imposed by individual instructions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment