XOR

Table of Contents

1. XOR（xor）
   1. Basic Function
   2. Instruction Execution Process
   3. Instruction Format
   4. Behavioral Characteristics
   5. Common Uses

XOR（xor）

Basic Function

The XOR instruction performs a bitwise exclusive OR on two operands: dest = dest XOR src。
If the corresponding bits are the same, the result is 0; if they are different, the result is 1.
After execution, EFLAGS is updated.

Instruction Execution Process

• Compute the XOR result
• Write the result back to the destination operand
• Update flags such as ZF, SF, and PF
• CF and OF are cleared to 0

Instruction Format

1
xor r/m32, r32
2
xor r/m64, r64
3
xor r/m32, imm32
4
xor r/m64, imm32

Behavioral Characteristics

• XOR REG, REG → clears the register to zero (a classic fast zeroing method)
• Does not produce a carry
• Commonly used in encryption/obfuscation logic —>rc4 encryption
• Fast and compact in encoding; one of the most common bitwise operations

Common Uses

• Clear a register: xor eax, eax
• Construct specific register values
• Obfuscation algorithms, encoders, and decryptors
• Used in shellcode to avoid badchars