Learning Win32 Assembly [20]: insight mark register

15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
	NT	Iopl		Of	DF	If	TF	SF	ZF		AF		PF		Cf
Wei Enable Use	Embed Set Mark Zhi	I/O Permission Flag Ranking 2		Overflow Output Mark Zhi	Fang Direction Mark Zhi	Medium Disconnected Allow Xu Mark Zhi	Single Step Mark Zhi	Character No. Mark Zhi	Zero Mark Zhi	Wei Enable Use	Auxiliary Help Mark Zhi	Wei Enable Use	Odd Even Mark Zhi	Wei Enable Use	Into Bit Mark Zhi

The table above shows the 16-bit low of the 32-bit register eflags.

Eflags cannot be read or written directly, but some convenient commands, such:
Lahf: reads eflags 8-bit lower to Ah; sahf is the inverse operation of lahf.

The command STC, CLC, and CMC are respectively set, reset, and reverse for CF (carry mark)

; ‑Flat, stdcallinclude windows. incinclude kernel32.incinclude masm32.incinclude Debug. incincludelib implements masm32.libincludelib Debug. Lib. Data szbin1 dB 8 DUP (?), 0 szbin2 dB 8 DUP (?), 0 szbin3 dB 8 DUP (?), 0 szbin4 dB 8 DUP (?), 0. codemain proc STC; Set CF, cf = 1 lahf invoke byt2bin_ex, ah, ADDR szbin1 clc; reset CF, cf = 0 lahf invoke byt2bin_ex, ah, ADDR szbin2 stc cmc; anti-CF, cf = Not CF lahf invoke byt2bin_ex, ah, ADDR szbin3 clc cmc; anti-CF, cf = Not CF lahf invoke byt2bin_ex, ah, ADDR szbin4 printstring szbin1; xxxxxxx1 printstring szbin2; xxxxxxx0 printstring szbin3; xxxxxxx0 printstring szbin4; xxxxxxx1 retmain endpend main

  
 

If you want to observe the 32 bits of the entire eflags, you can use the pushfd and popfd commands to enable eflags to go to the stack and exit the stack.

; ‑Flat, stdcallinclude windows. incinclude kernel32.incinclude masm32.incinclude Debug. incincludelib implements masm32.libincludelib Debug. Lib. Data szbin dB 32 DUP (?), 0. codemain proc STC pushfd invoke dw2bin_ex, dword ptr [esp + 4], ADDR szbin popfd printstring szbin; 00000000000000000000001001000111 CLC pushfd invoke dw2bin_ex, dword ptr [esp + 4], ADDR szbin popfd printstring szbin; 00000000000000000000001010000110 retmain endpend main

  
 

It seems that the data in the mark register is a bit unpredictable. It should not be so observed; pay attention to it later.