TEST

Table of Contents

1. TEST (test)
   1. Basic function
   2. Instruction execution process
   3. Instruction format
   4. Behavioral characteristics
   5. Common uses
   6. Small example: test whether eax is even

TEST (test)

Basic function

The TEST instruction performs a bitwise AND on two operands, but does not store the result; it only updates the flags.
It is commonly used for conditional checks, such as testing whether a register is 0 or whether a certain bit is set. Logical behavior:

1
temp = op1 & op2     ; 结果丢弃
2
更新 EFLAGS          ; 根据 temp 更新标志位

Instruction execution process

• Perform bitwise AND
• Do not write back the result (discard it)
• Update ZF, SF, PF, CF, OF, AF, where:
  • CF = 0
  • OF = 0
  • ZF depends on whether the result is 0
  • SF is determined by the highest bit of the result
  • PF is updated according to even parity

Instruction format

1
test r/m32, r32
2
test r/m64, r64
3
test r/m32, imm32
4
test r/m8,  imm8

Behavioral characteristics

• It is the “no-result version” of logical AND
• Commonly used to test whether a certain bit is 1
• Does not modify operands (non-destructive)
• Especially suitable for branch checks and state analysis

Difference from AND:

• and op1, op2 writes the result back to op1
• test op1, op2 does not modify any operand at all; it only affects the flags

Equivalent behavior example (logically equivalent):

1
and temp, op1, op2     ; 假设 temp 是一个不存在的寄存器
2
根据 temp 更新 EFLAGS
3
; temp 被丢弃

Common uses

• Test whether a register is 0:

1
    test eax, eax     ; 等价于检查 eax 是否为 0
2
    jz   is_zero

• Check whether a certain bit is set:

  1
  test rax, 0x100
  2
  jnz  bit_set

• Test whether a pointer is null or whether a flag bit is valid
• Protocol parsing (bitwise decomposition of flag fields)
• In reverse engineering analysis, it often appears in permission checks or state branches
• In PWN debugging, it is often used to understand whether validation logic has been bypassed

Small example: test whether eax is even

1
test eax, 1
2
jz   even

Principle: lowest bit is 0 → even number.