Codes for Addressing Method

A Direct address; the instruction has no MODRM field; the address of the operand is encoded in the instruction; no base register, index register, or scaling factor can be applied; e.g., far JMP (EA).
C The reg field of the MODRM field selects a control register; e.g., MOV (0F20, 0F22).
D The reg field of the MODRM field selects a debug register; e.g., MOV (0F21, 0F23).
E A MODRM field follows the opcode and specifies the operand. The operand is either a general register or a memory address. If it is a memory address, the address is computed from a segment register and any of the following values: a base register, an index register, a scaling factor, a displacement.
F Flags register
G The reg field of the MODRM field selects a general register; e.g,. ADD (00).
I Immediate data. The value of the operand is encoded in subsequent bytes of the instruction.
J The instruction contains a relative offset to be added to the instruction-pointer register; e.g., JMP short, LOOP.
M The MODRM field may refer only to memory; e.g., BOUND, LES, LDS, LSS, LFS, LGS.
O The instruction has no MODRM field; the offset of the operand is coded as a word or dword (depending on address sie attribute) in the instruction. No base register, index register, or scaling factor can be applied; e.g., MOV (A0–A3).
R The mod field of the MODRM field may refer only to a general register; e.g., MOV(0F20–0F24, 0F26).
S The reg field of the MODRM field selects a segment register; e.g., MOV (8C, 8E).
T The reg field of the MODRM field selects a test register; e.g., MOV (0F24, 0F26).
X Memory addressed by DS:SI; e.g., MOVS, COMPS, OUTS, LODS, SCAS.
Y Memory addressed by ES:DI; e.g., MOVS, CMPS, INS, STOS.

Codes for Operand Type

a Two one-word operands in memory or two dword operands in memory, depending on operand size attribute (used only by BOUND).
b Byte (regardless of operand size attribute).
c Byte or word, depending on operand size attribute.
d Dword (regardless of operand size attribute).
p 32-bit or 48-bit pointer, depending on operand size attribute.
s Six-byte pesudo-descriptor.
v Word or dword, depending on operand size attribute.
w Word (regardless of operand size attribute).

Register Codes

When an operand is a specific register encoded in the opcode, the register is identifed by its name; e.g., AX, CL, or ESI. The name of the register indicates whether the register is 32, 16, or 8 bits wide. A register identifier of the form eXX is used when the width of the register depends on the operand size attribute. For example, eAX indicates that the AX register is used when the operand size attribute is 16, and the EAX register is used when the operand size attribute is 32.

One-byte 80386 Opcode Map

x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 xA xB xC xD xE xF
0x ADD PUSH ES POP ES OR PUSH CS 2-byte escape codes
Eb, Gb Ev, Gv Gb, Eb Gv, Ev AL, Ib eAX, Iv Eb, Gb Ev, Gv Gb, Eb Gv, Ev AL, Ib eAX, Iv
1x ADC PUSH SS POP SS SBB PUSH DS POP DS
Eb, Gb Ev, Gv Gb, Eb Gv, Ev AL, Ib eAX, Iv Eb, Gb Ev, Gv Gb, Eb Gv, Ev AL, Ib eAX, Iv
2x AND SEG =ES POP ES SUB SEG =CS DAS
Eb, Gb Ev, Gv Gb, Eb Gv, Ev AL, Ib eAX, Iv Eb, Gb Ev, Gv Gb, Eb Gv, Ev AL, Ib eAX, Iv
3x XOR SEG =SS AAA CMP SEG =DS AAS
Eb, Gb Ev, Gv Gb, Eb Gv, Ev AL, Ib eAX, Iv Eb, Gb Ev, Gv Gb, Eb Gv, Ev AL, Ib eAX, Iv
4x INC general register DEC general register
eAX eCX eDX eBX eSP eBP eSI eDI eAX eCX eDX eBX eSP eBP eSI eDI
5x PUSH general register POP general register
eAX eCX eDX eBX eSP eBP eSI eDI eAX eCX eDX eBX eSP eBP eSI eDI
6x PUSHA POPA BOUND Gv, Ma ARPL Gv, Ma SEG =FS SEG =GS Operand Size Address Size PUSH Iv IMUL GvEvIv PUSH Ib IMUL GvEvIb INSB Yb, Dx INSW/D Yv, Dx OUTSB Dx, Xb OUTSW/D Dx, Xb
7x Short-displacement jump on condition (Jb)
JO JNO JB JNB JZ JNZ JBE JNBE JS JNS JP JNP JL JNL JLE JNLE
8x Immediate Grp1 Grp1 Ev, Ib TEST XCHG MOV MOV Ew, Sw LEA Gv, M MOV Sw, Ew POP Ev
Eb, Ib Ev, Iv Eb, Gb Ev, Gv Eb, Gb Ev, Gv Eb, Gb Ev, Gv Gb, Eb Gv, Ev
9x NOP XCHG word or double-word register with eAX CBW CWD CALL Ap WAIT PUSHF Fv POPF Fv SAHF LAHF
eCX eDX eBX eSP eBP eSI eDI
Ax MOV MOVSB Xb, Yv MOVSW/D Xv, Yv CMPSB Xb, Yb CMPSW/D Xv, Yv TEST STOSB Yb, AL STOSW/D Yv, eAX LDSB AL, Xb LDSW/D eAX, Yv SCASB AL, Xb SCASW/D eAX, Xv
AL, Ob eAX, Ov Ob, AL Ov, eAX AL, Ib eAX, Iv
Bx MOV immediate byte into byte register MOV immediate word or double into word or double register
AL CL DL BL AH CH DH BH eAX eCX eDX eBX eSP eBP eSI eDI
Cx Shift Grp2 RET near LES Gv, Mp LDS Gv, Mp MOV ENTER LEAVE RET far INT 3 INT Ib INTO IRET
Eb, Ib Ev, Iv Iw Eb, Ib Ev, Iv Iw
Dx Shift Grp2 AAM AAD XLAT ESC (Escape to coprocessor instruction set)
Eb, 1 Ev, 1 Eb, CL Ev, CL
Ex LOOPNE Jb LOOPE Jb LOOP Jb JCXZ Jb IN OUT CALL Av JMP IN OUT
AL, Ib eAX, Ib Ib, AL Ib, eAX Jv Ap Jb AL, DX eAX, DX DX, AL DX, eAX
Fx LOCK REPNE REP / REPE HLT CMC Unary Grp3 CLC STC CLI STI CLD STD INC/DEC Grp4 Indirect Grp5
Eb Ev

Two-Byte 80386 Opcode Map (First byte is 0FH)

x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 xA xB xC xD xE xF
0x Grp6 Grp7 LAR Gv, Ew LSL Gv, Ew CLTS
1x
2x MOV Cd, Rd MOV Dd, Rd MOV Rd, Cd MOV Rd, Dd MOV Td, Rd MOV Rd, Td
≈
8x Long-displacement jump on condition (Jv)
JO JNO JB JNB JZ JNZ JBE JNBE JS JNS JP JNP JL JNL JLE JNLE
9x Byte set on condition (Eb)
SETO SETNO SETB SETNB SETZ SETNZ SETBE SETNBE SETS SETNS SETP SETNP SETL SETNL SETLE SETNLE
Ax PUSH FS POP FS BT Ev, Gv SHLD EvGvIb SHLD EvGvCL PUSH GS POP GS BTS Ev, Gv SHRD EvGvIb SHRD EvGvCL IMUL Gv, Ev
Bx LSS Mp BTR Ev, Gv LFS Mp LGS Mp MOVZX Grp8 Ev, Ib BTC Ev, Gv BSF Gv, Ev BSR Gv, Ev MOVSX
Gv, Eb Gv, Ew Gv, Eb Gv, Ew
≈
Fx

Opcodes Determined by Bits 5, 4, 3 of MODRM Field

mod nnn R/M

000 001 010 011 100 101 110 111
Group 1 ADD OR ADC SBB AND SUB XOR CMP
Group 2 ROL ROR RCL RCR SHL SHR SAR
Group 3 TEST Ib/Iv NOT NEG MUL AL/eAX IMUL AL/EAX DIV AL/eAX IDIV AL/eAX
Group 4 INC Eb DEC Eb
Group 5 INC Ev DEC Ev CALL Ev CALL Ep JMP Ev JMP Ep PUSH Ev
Group 6 SLDT Ew STR Ew LLDT Ew LTR Ew VERR Ew VERW Ew
Group 7 SGDT Ms SIDT Ms LGDT Ms LIDT Ms LMSW Ew
Group 8 BT BTS BTR BTC