80386 Opcode Map

# Codes for Addressing Method

A | Direct address; the instruction has no MODRM field; the address of the operand is encoded in the instruction; no base register, index register, or scaling factor can be applied; e.g., far JMP (EA).
C | The reg field of the MODRM field selects a control register; e.g., MOV (0F20, 0F22).
D | The reg field of the MODRM field selects a debug register; e.g., MOV (0F21, 0F23).
E | A MODRM field follows the opcode and specifies the operand. The operand is either a general register or a memory address. If it is a memory address, the address is computed from a segment register and any of the following values: a base register, an index register, a scaling factor, a displacement.
F | Flags register
G | The reg field of the MODRM field selects a general register; e.g,. ADD (00).
I | Immediate data. The value of the operand is encoded in subsequent bytes of the instruction.
J | The instruction contains a relative offset to be added to the instruction-pointer register; e.g., JMP short, LOOP.
M | The MODRM field may refer only to memory; e.g., BOUND, LES, LDS, LSS, LFS, LGS.
O | The instruction has no MODRM field; the offset of the operand is coded as a word or dword (depending on address sie attribute) in the instruction. No base register, index register, or scaling factor can be applied; e.g., MOV (A0–A3).
R | The mod field of the MODRM field may refer only to a general register; e.g., MOV(0F20–0F24, 0F26).
S | The reg field of the MODRM field selects a segment register; e.g., MOV (8C, 8E).
T | The reg field of the MODRM field selects a test register; e.g., MOV (0F24, 0F26).
X | Memory addressed by DS:SI; e.g., MOVS, COMPS, OUTS, LODS, SCAS.
Y | Memory addressed by ES:DI; e.g., MOVS, CMPS, INS, STOS.

# Codes for Operand Type

a | Two one-word operands in memory or two dword operands in memory, depending on operand size attribute (used only by BOUND).
b | Byte (regardless of operand size attribute).
c | Byte or word, depending on operand size attribute.
d | Dword (regardless of operand size attribute).
p | 32-bit or 48-bit pointer, depending on operand size attribute.
s | Six-byte pesudo-descriptor.
v | Word or dword, depending on operand size attribute.
w | Word (regardless of operand size attribute).

# Register Codes

When an operand is a specific register encoded in the opcode, the register is identifed by its name; e.g., AX, CL, or ESI. The name of the register indicates whether the register is 32, 16, or 8 bits wide. A register identifier of the form eXX is used when the width of the register depends on the operand size attribute. For example, eAX indicates that the AX register is used when the operand size attribute is 16, and the EAX register is used when the operand size attribute is 32.

# One-byte 80386 Opcode Map

| x0 | x1 | x2 | x3 | x4 | x5 | x6 | x7 | x8 | x9 | xA | xB | xC | xD | xE | xF
--- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | ---
0x | ADD | PUSH ES | POP ES | OR | PUSH CS | 2-byte escape codes
Eb, Gb | Ev, Gv | Gb, Eb | Gv, Ev | AL, Ib | eAX, Iv | Eb, Gb | Ev, Gv | Gb, Eb | Gv, Ev | AL, Ib | eAX, Iv
1x | ADC | PUSH SS | POP SS | SBB | PUSH DS | POP DS
Eb, Gb | Ev, Gv | Gb, Eb | Gv, Ev | AL, Ib | eAX, Iv | Eb, Gb | Ev, Gv | Gb, Eb | Gv, Ev | AL, Ib | eAX, Iv
2x | AND | SEG =ES | POP ES | SUB | SEG =CS | DAS
Eb, Gb | Ev, Gv | Gb, Eb | Gv, Ev | AL, Ib | eAX, Iv | Eb, Gb | Ev, Gv | Gb, Eb | Gv, Ev | AL, Ib | eAX, Iv
3x | XOR | SEG =SS | AAA | CMP | SEG =DS | AAS
Eb, Gb | Ev, Gv | Gb, Eb | Gv, Ev | AL, Ib | eAX, Iv | Eb, Gb | Ev, Gv | Gb, Eb | Gv, Ev | AL, Ib | eAX, Iv
4x | INC general register | DEC general register
eAX | eCX | eDX | eBX | eSP | eBP | eSI | eDI | eAX | eCX | eDX | eBX | eSP | eBP | eSI | eDI
5x | PUSH general register | POP general register
eAX | eCX | eDX | eBX | eSP | eBP | eSI | eDI | eAX | eCX | eDX | eBX | eSP | eBP | eSI | eDI
6x | PUSHA | POPA | BOUND Gv, Ma | ARPL Gv, Ma | SEG =FS | SEG =GS | Operand Size | Address Size | PUSH Iv | IMUL GvEvIv | PUSH Ib | IMUL GvEvIb | INSB Yb, Dx | INSW/D Yv, Dx | OUTSB Dx, Xb | OUTSW/D Dx, Xb
7x | Short-displacement jump on condition (Jb)
JO | JNO | JB | JNB | JZ | JNZ | JBE | JNBE | JS | JNS | JP | JNP | JL | JNL | JLE | JNLE
8x | Immediate Grp1 |  | Grp1 Ev, Ib | TEST | XCHG | MOV | MOV Ew, Sw | LEA Gv, M | MOV Sw, Ew | POP Ev
Eb, Ib | Ev, Iv | Eb, Gb | Ev, Gv | Eb, Gb | Ev, Gv | Eb, Gb | Ev, Gv | Gb, Eb | Gv, Ev
9x | NOP | XCHG word or double-word register with eAX | CBW | CWD | CALL Ap | WAIT | PUSHF Fv | POPF Fv | SAHF | LAHF
eCX | eDX | eBX | eSP | eBP | eSI | eDI
Ax | MOV | MOVSB Xb, Yv | MOVSW/D Xv, Yv | CMPSB Xb, Yb | CMPSW/D Xv, Yv | TEST | STOSB Yb, AL | STOSW/D Yv, eAX | LDSB AL, Xb | LDSW/D eAX, Yv | SCASB AL, Xb | SCASW/D eAX, Xv
AL, Ob | eAX, Ov | Ob, AL | Ov, eAX | AL, Ib | eAX, Iv
Bx | MOV immediate byte into byte register | MOV immediate word or double into word or double register
AL | CL | DL | BL | AH | CH | DH | BH | eAX | eCX | eDX | eBX | eSP | eBP | eSI | eDI
Cx | Shift Grp2 | RET near | LES Gv, Mp | LDS Gv, Mp | MOV | ENTER | LEAVE | RET far | INT 3 | INT Ib | INTO | IRET
Eb, Ib | Ev, Iv | Iw |  | Eb, Ib | Ev, Iv | Iw |
Dx | Shift Grp2 | AAM | AAD |  | XLAT | ESC (Escape to coprocessor instruction set)
Eb, 1 | Ev, 1 | Eb, CL | Ev, CL
Ex | LOOPNE Jb | LOOPE Jb | LOOP Jb | JCXZ Jb | IN | OUT | CALL Jv | JMP | IN | OUT
AL, Ib | eAX, Ib | Ib, AL | Ib, eAX | Jv | Ap | Jb | AL, DX | eAX, DX | DX, AL | DX, eAX
Fx | LOCK |  | REPNE | REP / REPE | HLT | CMC | Unary Grp3 | CLC | STC | CLI | STI | CLD | STD | INC/DEC Grp4 | Indirect Grp5
Eb | Ev

# Two-Byte 80386 Opcode Map (First byte is 0FH)

| x0 | x1 | x2 | x3 | x4 | x5 | x6 | x7 | x8 | x9 | xA | xB | xC | xD | xE | xF
--- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | ---
0x | Grp6 | Grp7 | LAR Gv, Ew | LSL Gv, Ew |  |  | CLTS |  |  |  |  |  |  |  |  |
1x |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
2x | MOV Cd, Rd | MOV Dd, Rd | MOV Rd, Cd | MOV Rd, Dd | MOV Td, Rd |  | MOV Rd, Td |  |  |  |  |  |  |  |  |
≈
8x | Long-displacement jump on condition (Jv)
JO | JNO | JB | JNB | JZ | JNZ | JBE | JNBE | JS | JNS | JP | JNP | JL | JNL | JLE | JNLE
9x | Byte set on condition (Eb)
SETO | SETNO | SETB | SETNB | SETZ | SETNZ | SETBE | SETNBE | SETS | SETNS | SETP | SETNP | SETL | SETNL | SETLE | SETNLE
Ax | PUSH FS | POP FS |  | BT Ev, Gv | SHLD EvGvIb | SHLD EvGvCL |  |  | PUSH GS | POP GS |  | BTS Ev, Gv | SHRD EvGvIb | SHRD EvGvCL |  | IMUL Gv, Ev
Bx |  |  | LSS Mp | BTR Ev, Gv | LFS Mp | LGS Mp | MOVZX |  |  | Grp8 Ev, Ib | BTC Ev, Gv | BSF Gv, Ev | BSR Gv, Ev | MOVSX
Gv, Eb | Gv, Ew | Gv, Eb | Gv, Ew
≈
Fx |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |

# Opcodes Determined by Bits 5, 4, 3 of MODRM Field

mod | nnn | R/M

| 000 | 001 | 010 | 011 | 100 | 101 | 110 | 111
--- | --- | --- | --- | --- | --- | --- | --- | ---
Group 1 | ADD | OR | ADC | SBB | AND | SUB | XOR | CMP
Group 2 | ROL | ROR | RCL | RCR | SHL | SHR |  | SAR
Group 3 | TEST Ib/Iv |  | NOT | NEG | MUL AL/eAX | IMUL AL/EAX | DIV AL/eAX | IDIV AL/eAX
Group 4 | INC Eb | DEC Eb |  |  |  |  |  |
Group 5 | INC Ev | DEC Ev | CALL Ev | CALL Ep | JMP Ev | JMP Ep | PUSH Ev |
Group 6 | SLDT Ew | STR Ew | LLDT Ew | LTR Ew | VERR Ew | VERW Ew |  |
Group 7 | SGDT Ms | SIDT Ms | LGDT Ms | LIDT Ms | SMSW Ew |  | LMSW Ew |
Group 8 |  |  |  |  | BT | BTS | BTR | BTC