Table of contents:
- Printing "Hello World!" (asmh.s)⇒
- Setting the ERRORLEVEL (abc.s)⇒
- Adding 3+2 (abcs.s)⇒
- Basic loop examples
- Listing the first 10 natural numbers⇒
- Listing the first 10 even numbers⇒
- Listing the first 10 powers of 2⇒
- Listing the first 10 factorials⇒
Printing "Hello World!" (asmh.s)
Now let us create a simple program in Intel x86/x64 assembly language which displays the well-known 'Hello world!' message.
Open a new 'cmd' window in the c:\temp\gcc directory, run the
notepad asmh.s
command, and create a new file named 'asmh.s' with the following content:
.globl main
// definitions of constants and variables
.data
hello:
.ascii "Hello world!\12\0"
// program instructions (code)
.text
main:
pushq %rbp
movq %rsp, %rbp
subq $32, %rsp
leaq hello(%rip), %rax
/* setting the parameter for the function 'printf' */
movq %rax, %rcx # address of 'hello'
call printf
/* displayed 'Hello world!' */
movl $0, %eax # set ERRORLEVEL value
addq $32, %rsp
popq %rbp
ret
Compile, link and run the assembly program as follows:
Note that the size of the stack frame is 32 bytes, even though there are no local variables in the program. The four quadwords allocated at the top of the stack frame can be used for the (possible) parameters of the 'printf' function.
Setting the ERRORLEVEL (abc.s)
After we have successfully created and compiled the 'asmh.s' program, let us create another simple program in Intel x86/x64 assembly language which does nothing except returns the value 10 as an ERRORLEVEL value.
Open a new 'cmd' window in the c:\temp\gcc directory, run the
notepad abc.s
command, and create a new file named 'abc.s' with the following content:
.globl main
main:
enter $0, $0
movq $10, %rax
leave
ret
Note that the first two instructions of the 'main' function creates a stack frame which, among others, can contain the values of the local variables (if there are any such variables at all). The basic pointer register (%rbp) is used as a reference to point to the address of those local variables (i.e. the local variables can be addressed relatively to the value of the basic pointer).
The 'enter $0, $0' assembly instruction corresponds to the
pushq %rbp
movq %rsp, %rbp
instructions. It creates the stack frame of the function.
Note that e.g. the 'enter $24, $0 instruction would allocate in the stack a 24 byte long memory space by subtracting 24 from the actual value of the stack pointer. Because 6*4=24 holds, this would be enough for six doubleword (i.e. 4 byte=32 bit) length local variables (or for three quadword length local variables, respectively).
The 'leave' assembly instruction corresponds to the
movq %rbp, %rsp
popq %rbp
instructions. It frees (or destroys) the stack frame of the function.
Using the push / pop instructions instead of the enter / leave instructions, we can create another version of the program 'abc.s' as follows:
.globl main
main:
pushq %rbp
movq %rsp, %rbp
movq $10, %rax
movq %rbp, %rsp
popq %rbp
ret
Compile, link and run the assembly program:
Here, like in the case of the 'simple.exe' program⇒ or the 'simplex.exe' program,⇒ we can display the returned value of the 'abc.exe' program using the
echo %ERRORLEVEL%
command in the 'cmd' window (or we can enter the 'err' command⇒ if the 'err.bat' file exists).
Adding 3+2 (abcs.s)
Now let us create an equivalent of the 'simple.c' program in Intel x86/x64 assembly language which adds two numbers (3 and 2) together as long integer types, stores the sum in another longint variable, and returns the sum as an ERRORLEVEL value. Before that, the program will warn us to check the actual value of the ERRORLEVEL environment variable.
Open a new 'cmd' window in the c:\temp\gcc directory, run the
notepad abcs.s
command, and create a new file named 'abcs.s' with the following content:
.globl main
.data
hello:
.ascii "\12See the ERRORLEVEL value!\12\0"
.text
main:
pushq %rbp
movq %rsp, %rbp
subq $56, %rsp
/* stack frame created */
movq $3, -8(%rbp)
movq $2, -16(%rbp)
movq -8(%rbp), %rax
addq -16(%rbp), %rax
movq %rax, -24(%rbp)
leaq hello(%rip), %rcx
call printf
movq -24(%rbp), %rax # set ERRORLEVEL value
/* stack frame to be destroyed */
addq $56, %rsp
popq %rbp
ret
Compile, link and run the assembly program as follows:
Here, like in the case of the 'simple.exe' and 'abc.exe' programs, in the 'cmd' window we can display the returned value of the 'abcs.exe' program using the
echo %ERRORLEVEL%
or simply the
err
command. But in this case it returns the sum of the addition 3+2 (i.e. 5).
The size and content of the stack frame needs some explanation.
The size of the stack frame is 56 bytes which corresponds to 7 quadwords (i.e. 56=7*8).
The structure and content of the stack frame is as follows:
| address
| content
|
| 0(%rsp)
| -56(%rbp)
| parameters for the function 'printf'
|
| 8(%rsp)
| -48(%rbp)
|
| 16(%rsp)
| -40(%rbp)
|
| 24(%rsp)
| -32(%rbp)
|
|
| -24(%rbp)
| variable c
|
|
| -16(%rbp)
| variable b
|
|
| -8(%rbp)
| variable a
|
| 56(%rsp)
| 0(%rbp)
| previous value of %rbp (pushed by the first instruction of main)
|
|
| 8(%rbp)
| return address for the caller of 'main' (for 'ret' in main)
|
The basic pointer (%rbp) register has a special purpose: it points to the bottom of the stack frame of the current function, so local variables can be accessed relative to its value.
As for the last row of the table which belongs to the address 8(%rbp) just below the bottom of the stack frame, when the program environment (i.e. the cmd.exe in our case) runs the abcs.exe program, it calls the 'main' global function of the abcs.exe program, and the current value of the instruction pointer is automatically pushed onto the top of the stack. (Thus when the called 'main' function exits and returns, the CPU can continue the execution of the caller program by popping the address of the next instruction to be performed from the stack and loading it into the instruction pointer).
In general, when a specific function of the program is called by another function (from the same or from another program),
the return address of the next instruction to be executed after the 'call' instruction is automatically pushed onto the top of the stack.
Note that in the fetch-execute cycle the address of the next instruction is always stored in the %rip instruction pointer or program counter register. Thus the 'call' function, when executed, pushes the current value of the instruction pointer onto the top of the stack. After that the called function pushes the value of the basic pointer into the stack and creates its stack frame.
Listing the first 10 natural numbers
First, let us see a C program that prints the first 10 natural numbers (starting with 1, then 2, 3, 4, ..., 10).
Open a new 'cmd' window in the c:\temp\gcc directory, run the
notepad natural.c
command, and create a new file named 'natural.c' with the following content:
#include <stdio.h>
int main() {
int x=1;
int i, n=10;
for(i=1;i<=n;i++) {
printf("%d\n",x);
x++;
}
return i;
}
Compile, link and run the compiled C program as follows:
Now it can be very instructive to see the compiled assembly version of the C program. Type and run in the 'cmd' window the
gcc natural.c -S -o nat.s
command. After making some changes (omitting some parts, commenting some of the instructions etc.), the resulting file will look like something like this:
.data
.pattern:
.ascii "%d\12\0"
.text
printf:
pushq %rbp
pushq %rbx # callee saved
subq $56, %rsp
leaq 48(%rsp), %rbp
/* 56=48+8; pushing %rbx allocates +8 bytes at the stack⇒ */
movq %rcx, 32(%rbp) # 4th argument stored
movq %rdx, 40(%rbp) # 3rd argument stored
movq %r8, 48(%rbp) # 5th argument stored
movq %r9, 56(%rbp) # 6th argument stored
leaq 40(%rbp), %rax
movq %rax, -16(%rbp) # local variable
movq -16(%rbp), %rbx
movl $1, %ecx
movq __imp___acrt_iob_func(%rip), %rax
call *%rax
movq %rax, %rcx
movq 32(%rbp), %rax
movq %rbx, %r8
movq %rax, %rdx
call __mingw_vfprintf
movl %eax, -4(%rbp)
movl -4(%rbp), %eax
addq $56, %rsp
popq %rbx
popq %rbp
ret
.text
.globl main
main:
pushq %rbp
movq %rsp, %rbp
subq $48, %rsp # stack frame (48 bytes)
call __main
movl $1, -4(%rbp) # variable x
movl $10, -12(%rbp) # variable n
movl $1, -8(%rbp) # variable i
jmp .L4
/* begin of loop */
.L5:
movl -4(%rbp), %eax # variable x to print
movl %eax, %edx # 3rd parameter (printf)
leaq .pattern(%rip), %rax # copy address
movq %rax, %rcx # 4th parameter (printf)
call printf
addl $1, -4(%rbp) # x++
addl $1, -8(%rbp) # i++
.L4:
movl -8(%rbp), %eax # i -> %eax
cmpl -12(%rbp), %eax # i≤n ?
jle .L5 # jump if i≤n
/* end of loop */
movl -8(%rbp), %eax
addq $48, %rsp
popq %rbp
ret
Before the 'printf' function is called and the local variables are "declared" (i.e. before the 'jmp .L4' instruction), the content of the stack frame created by the 'main' function is as follows:
| address
| content
|
| 0(%rsp)
| -48(%rbp)
|
allocated space for the four parameters (or arguments) for the function 'printf'
|
| 8(%rsp)
| -40(%rbp)
|
| 16(%rsp)
| -32(%rbp)
|
| 24(%rsp)
| -24(%rbp)
|
|
|
| (not used)
|
|
| -12(%rbp)
| variable n (initially n=10)
|
|
| -8(%rbp)
| variable i (initially i=1)
|
|
| -4(%rbp)
| variable x (initially x=1)
|
| 48(%rsp)
| 0(%rbp)
| previous value of %rbp (pushed by the first instruction of main)
|
|
| 8(%rbp)
| return address for the caller of 'main' (for 'ret' in main)
|
After the 'printf' function is called for the first time by the 'main' function, the content of the stack frame created by the 'printf' function is as follows:
| address
| content
|
| 0(%rsp)
| -48(%rbp)
|
|
| ...
| ...
| ...
|
| 48(%rsp)
| 0(%rbp)
|
|
| 56(%rsp)
| 8(%rbp)
| previous value of %rbx (pushed by the second instruction of printf)
|
|
| 16(%rbp)
| previous value of %rbp (pushed by the first instruction of printf)
|
|
| 24(%rbp)
| return address for the caller of 'printf', i.e. the address of the next instruction of 'main' after the 'call printf' instruction
|
|
(the following part of the stack is the same space for the arguments (or parameters) of the 'printf' function that has been allocated by the 'main' function, see the top of its stack frame in the table above)
|
|
| 32(%rbp)
| 4th argument of the function 'printf'
|
|
| 40(%rbp)
| 3rd argument of the function 'printf'
|
|
| 48(%rbp)
| 5th argument of the function 'printf'
|
|
| 56(%rbp)
| 6th argument of the function 'printf'
|
Let us now create an equivalent of the above program in assembly language which prints the first 10 natural numbers and uses quadword length local variables.
Open a new 'cmd' window in the c:\temp\gcc directory, run the
notepad natural.s
command, and create a new file named 'natural.s' with the following content:
.data
msg:
.ascii "The first %d natural numbers:\12\0"
pattern:
.ascii "%d\12\0"
.text
.globl main
main:
pushq %rbp
movq %rsp, %rbp
subq $64, %rsp
movl $1, -4(%rbp) # x
movl $10, -12(%rbp) # n
movl $1, -8(%rbp) # i
leaq msg(%rip), %rcx
movl -12(%rbp), %edx
call printf
.L0:
movl -8(%rbp), %eax
cmpl -12(%rbp), %eax # i>n ?
jg .L1
leaq pattern(%rip), %rcx
movl -4(%rbp), %edx
call printf
incl -4(%rbp)
incl -8(%rbp)
jmp .L0
.L1:
movl $0, %eax # return value
addq $64, %rsp
popq %rbp
ret
Compile, link and run the assembly program as follows:
Listing the first 10 even numbers
Using the assembly instructions we have learned so far, we can easily list the first even numbers.
Open a new 'cmd' window in the c:\temp\gcc directory, run the
notepad even.s
command, and create a new file named 'even.s' with the following content:
.data
.msg:
.ascii "i=%d, x=%d, n=%d\12\0"
.text
.globl main
main:
pushq %rbp
movq %rsp, %rbp
// pushq %rbx
subq $64, %rsp
movq %rbx, -8(%rbp)
movq $1, -16(%rbp) # local variable i (loop variable)
movq $0, -24(%rbp) # local variable x
movq $10, -32(%rbp) # local variable n
loop:
movq -32(%rbp), %r9 # 4th argument (var n)
movq -24(%rbp), %r8 # 3th argument (var x)
movq -16(%rbp), %rdx # 2rd argument (var i)
leaq .msg(%rip), %rcx
call printf
movq -24(%rbp), %rbx
addq $2, %rbx
movq %rbx, -24(%rbp)
movq -16(%rbp), %rax
addq $1, %rax
movq %rax, -16(%rbp)
cmpq -32(%rbp), %rax # compare 'n' with 'i'
jle loop # jump if i<=n
movq -8(%rbp), %rbx
movl $0, %eax
addq $64, %rsp
// popq %rbx
popq %rbp
ret
Note that there is one important solution in the above assembly program. We used the %rbx general-purpose register which should be callee-saved. But saving its value by the 'push' and 'pop' instructions caused some problems in our environment (using Windows 11 and gcc-13.2.0, 2026-03-05). So we simply saved the content of the %rbx register as the first quadword in the stack frame of the 'main' function, using the
movq %rbx, -8(%rbp)
instruction.
Listing the first 10 powers of 2
First, let us see a C program that prints the first 10 powers of 2 (starting with 1, then 2, 4, 8 etc.).
Open a new 'cmd' window in the c:\temp\gcc directory, run the
notepad powers.c
command, and create a new file named 'powers.c' with the following content:
#include <stdio.h>
int nextpow(int x) {
int p=x+x;
return p;
}
int main() {
int x=1;
int i=1, n=10;
do {
printf("%d\n",x);
x=nextpow(x);
i++;
} while(i<=n);
return i;
}
Compile, link and run the compiled C program as follows:
.globl main
.data
pattern:
.ascii "%d\12\0"
.text
nextpow:
pushq %rbp
movq %rsp, %rbp
subq $16, %rsp # stack frame size
movl %ecx, 16(%rbp) # parameter x
movl 16(%rbp), %eax
addl %eax, %eax
movl %eax, -4(%rbp) # local variable p
movl -4(%rbp), %eax
addq $16, %rsp
popq %rbp
ret
main:
pushq %rbp
movq %rsp, %rbp
subq $48, %rsp
movl $1, -4(%rbp) # variable x
movl $1, -8(%rbp) # variable i
movl $10, -12(%rbp) # variable n
.loop:
movl -4(%rbp), %edx
leaq pattern(%rip), %rcx
call printf
movl -4(%rbp), %ecx
call nextpow
movl %eax, -4(%rbp)
addl $1, -8(%rbp) # i++
movl -8(%rbp), %eax
cmpl -12(%rbp), %eax # i<=n ?
jle .loop
movl -8(%rbp), %eax
addq $48, %rsp
popq %rbp
ret
Compile, link and run the assembly program as follows:
Listing the first 10 factorials
First, let us see a C program that prints the first 10 factorials (starting with 1, then 2, 6, 24 etc.).
Open a new 'cmd' window in the c:\temp\gcc directory, run the
notepad fact.c
command, and create a new file named 'fact.c' with the following content:
#include <stdio.h>
int f(int n) {
int temp;
temp=1;
for(int i=2;i<=n;i++) {
temp=temp*i;
}
return temp;
}
int main() {
int n=10;
printf("List of the first %d factorials:\n",n);
int i=1;
while(i<=n) {
printf("%d\n",f(i));
i=i+1;
};
return i;
}
Compile, link and run the compiled C program as follows:
Let us now create an equivalent of the 'fact.c' program in Intel x86/x64 assembly language which prints the first 10 factorials.
Open a new 'cmd' window in the c:\temp\gcc directory, run the
notepad fact.s
command, and create a new file named 'fact.s' with the following content:
.globl main
.globl f
.data
.LC0:
.ascii "List of the first %d factorials:\12\0"
.LC1:
.ascii "%d\12\0"
.text
f:
pushq %rbp
movq %rsp, %rbp
subq $16, %rsp
movl %ecx, 16(%rbp)
movl $1, -4(%rbp)
movl $2, -8(%rbp)
jmp .L4
.L5:
movl -4(%rbp), %eax
imull -8(%rbp), %eax
movl %eax, -4(%rbp)
addl $1, -8(%rbp)
.L4:
movl -8(%rbp), %eax
cmpl 16(%rbp), %eax
jle .L5
movl -4(%rbp), %eax
addq $16, %rsp
popq %rbp
ret
main:
pushq %rbp
movq %rsp, %rbp
subq $48, %rsp
movl $10, -8(%rbp)
movl -8(%rbp), %eax
movl %eax, %edx
leaq .LC0, %rax
movq %rax, %rcx
call printf
movl $1, -4(%rbp)
jmp .L8
.L9:
movl -4(%rbp), %eax
movl %eax, %ecx
call f
movl %eax, %edx
leaq .LC1, %rax
movq %rax, %rcx
call printf
addl $1, -4(%rbp)
.L8:
movl -4(%rbp), %eax
cmpl -8(%rbp), %eax
jle .L9
movl -4(%rbp), %eax
addq $48, %rsp
popq %rbp
ret
Note that the imul assembly instruction executes a signed multiplication or product of the first operand (which can be either a register or a word-length or doubleword-length memory content) and the second operand (a register), and stores the resulting product in the the register specified as the second operand.
Compile, link and run the assembly program as follows:
Its main purpose is to execute the machine-level instructions of programs.
; note that, although this third stage is essential for the operation system, we will not deal with interrupts now),
