Introduction: The 32Bit Revolution
If you’ve ever wondered why 32-bit assembly feels like a completely different world from 16-bit assembly, you’re not alone. The transition from 16-bit to 32-bit x86 (the i386 revolution) wasn’t just about bigger registers or more memory—it was a fundamental rethinking of how assembly language should work.
I remember the first time I wrote a 32-bit program. It was 2003, Linux was gaining popularity, and I was tired of the segmented memory model of 16-bit DOS programming. When I discovered that 32-bit mode had flat memory (where segments could span the entire 4GB address space), it felt like waking up from a confusing dream.
In this article, we’re going to master 32-bit x86 assembly programming. We’ll explore the expanded register set, the flat memory model, the Linux syscall interface (int 0x80), the Windows calling conventions (stdcall, cdecl), and how to write complete, working programs that interact with the operating system.
Whether you’re writing shellcode, optimizing performance-critical code, or just want to understand how 32-bit programs really work, this article will give you the deep technical knowledge you need.
The 32Bit Transition (80386) – Why 32Bit Registers Changed Everything
The Intel 80386 (1985) was a watershed moment in computing history. It transformed the x86 architecture from a 16-bit microcontroller into a full-fledged 32-bit processor capable of running modern operating systems like Windows NT and Linux.
The Register Explosion (Well, Extension)
The 80386 didn’t just add new registers—it extended the existing registers from 16 bits to 32 bits. This was a stroke of engineering genius: it maintained backward compatibility while providing the benefits of 32-bit computing.
Here’s how the registers evolved:
16-bit (8086) 32-bit (80386)
───────────── ─────────────────
AX (16-bit) → EAX (32-bit)
BX (16-bit) → EBX (32-bit)
CX (16-bit) → ECX (32-bit)
DX (16-bit) → EDX (32-bit)
SP (16-bit) → ESP (32-bit)
BP (16-bit) → EBP (32-bit)
SI (16-bit) → ESI (32-bit)
DI (16-bit) → EDI (32-bit)
The ‘E’ prefix stands for “Extended.” And here’s the beautiful part: you can access the lower 16 bits of a 32-bit register using the old 16-bit name:
mov eax, 0x12345678 ; EAX = 0x12345678
mov ax, 0x0001 ; AX = 0x0001, EAX = 0x12340001
mov al, 0xFF ; AL = 0xFF, AX = 0x00FF, EAX = 0x123400FF
This backward compatibility meant that existing 16-bit code could be recompiled for 32-bit with minimal changes.
The Flat Memory Model: No More Segment Arithmetic
The biggest practical improvement of 32-bit mode was the flat memory model. In 16-bit real mode, you constantly fought with segment:offset addressing (Physical Address = Segment × 16 + Offset). In 32-bit protected mode, you could set up your segments to span the entire 4GB address space.
With a flat memory model:
- CS (Code Segment): Base = 0x00000000, Limit = 0xFFFFFFFF
- DS (Data Segment): Base = 0x00000000, Limit = 0xFFFFFFFF
- SS (Stack Segment): Base = 0x00000000, Limit = 0xFFFFFFFF
This meant you could use 32-bit addresses directly, without worrying about segments:
; In 16-bit real mode, this is a pain:
mov ax, 0x1000
mov ds, ax
mov bx, 0x2000
mov ax, [bx] ; Actually accesses physical address 0x12000
; In 32-bit flat mode, this is simple:
mov ebx, 0x00012000
mov eax, [ebx] ; Accesses address 0x00012000 directly
32-Bit Addressing Modes
The 80386 introduced new addressing modes that made pointer arithmetic much more flexible. In 32-bit mode, you can use any general-purpose register as a base or index:
; Register indirect
mov eax, [ebx] ; EAX = *(int *)EBX
; Base + displacement
mov eax, [ebx + 8] ; EAX = *(int *)(EBX + 8)
; Base + index
mov eax, [ebx + esi] ; EAX = *(int *)(EBX + ESI)
; Base + index × scale + displacement
mov eax, [ebx + esi*4 + 8] ; EAX = *(int *)(EBX + ESI*4 + 8)
That last mode (with the scale factor) is incredibly useful for array access. The scale can be 1, 2, 4, or 8, making it easy to index into arrays of bytes, words, dwords, or qwords.
The 32-Bit Instruction Prefixes
To maintain backward compatibility, the 80386 used instruction prefixes to switch between 16-bit and 32-bit operation. These prefixes are automatically added by the assembler based on the BITS 16 or BITS 32 directive:
- 0x66 (Operand Size Prefix): Switches between 16-bit and 32-bit operand size
- 0x67 (Address Size Prefix): Switches between 16-bit and 32-bit address size
[BITS 32]
mov ax, bx ; Machine code: 66 89 D8 (16-bit move in 32-bit mode)
mov eax, ebx ; Machine code: 89 D8 (32-bit move in 32-bit mode)
[BITS 16]
mov ax, bx ; Machine code: 89 D8 (16-bit move in 16-bit mode)
mov eax, ebx ; Machine code: 66 89 D8 (32-bit move in 16-bit mode)
Understanding these prefixes is crucial when reading disassembled code. If you see 0x66 or 0x67 in the machine code, it means the instruction is using a non-default operand or address size.
