Intel and AT&T syntax

September 12, 2023

This is a mirror because I don’t want to search for it. All credit goes to them.

---

Intel and AT&T syntax Assembly language are very different from each other in appearance, and this will lead to confusion when one first comes across AT&T syntax after having learnt Intel syntax first, or vice versa. So lets start with the basics. Prefixes.

In Intel syntax there are no register prefixes or immed prefixes. In AT&T however registers are prefixed with a ‘%’ and immed’s are prefixed with a ‘$’. Intel syntax hexadecimal or binary immed data are suffixed with ‘h’ and ‘b’ respectively. Also if the first hexadecimal digit is a letter then the value is prefixed by a ‘0’.

Example:

Intex Syntax

mov     eax,1

mov     ebx,0ffh

int     80h

AT&T Syntax

movl    $1,%eax

movl    $0xff,%ebx

int     $0x80

Direction of Operands.

The direction of the operands in Intel syntax is opposite from that of AT&T syntax. In Intel syntax the first operand is the destination, and the second operand is the source whereas in AT&T syntax the first operand is the source and the second operand is the destination. The advantage of AT&T syntax in this situation is obvious. We read from left to right, we write from left to right, so this way is only natural.

Example:

Intel Syntax

instr   dest,source

mov     eax,[ecx]

AT&T Syntax

instr   source,dest

movl    (%ecx),%eax

Memory Operands.

Memory operands as seen above are different also. In Intel syntax the base register is enclosed in ‘[’ and ‘]’ whereas in AT&T syntax it is enclosed in ‘(’ and ‘)’.

Example:

Intex Syntax

mov     eax,[ebx]

mov     eax,[ebx+3]

AT&T Syntax

movl    (%ebx),%eax

movl    3(%ebx),%eax 

The AT&T form for instructions involving complex operations is very obscure compared to Intel syntax. The Intel syntax form of these is segreg:[base+index*scale+disp]. The AT&T syntax form is %segreg:disp(base,index,scale).

Index/scale/disp/segreg are all optional and can simply be left out. Scale, if not specified and index is specified, defaults to 1. Segreg depends on the instruction and whether the app is being run in real mode or pmode. In real mode it depends on the instruction whereas in pmode its unnecessary. Immediate data used should not ‘$’ prefixed in AT&T when used for scale/disp.

Example:

Intel Syntax

instr   foo,segreg:[base+index*scale+disp]

mov     eax,[ebx+20h]

add     eax,[ebx+ecx*2h

lea     eax,[ebx+ecx]

sub     eax,[ebx+ecx*4h-20h]

AT&T Syntax

instr   %segreg:disp(base,index,scale),foo

movl    0x20(%ebx),%eax

addl    (%ebx,%ecx,0x2),%eax

leal    (%ebx,%ecx),%eax

subl    -0x20(%ebx,%ecx,0x4),%eax

As you can see, AT&T is very obscure. [base+index*scale+disp] makes more sense at a glance than disp(base,index,scale). Suffixes.

As you may have noticed, the AT&T syntax mnemonics have a suffix. The significance of this suffix is that of operand size. ‘l’ is for long, ‘w’ is for word, and ‘b’ is for byte. Intel syntax has similar directives for use with memory operands, i.e. byte ptr, word ptr, dword ptr. “dword” of course corresponding to “long”. This is similar to type casting in C but it doesnt seem to be necessary since the size of registers used is the assumed datatype.

Example:

Intel Syntax

mov     al,bl

mov     ax,bx

mov     eax,ebx

mov     eax, dword ptr [ebx]

AT&T Syntax

movb    %bl,%al

movw    %bx,%ax

movl    %ebx,%eax

movl    (%ebx),%eax