flags

x86 reverse engineering - last updated 2026-05-12

overview

To my understanding, flags are used to indicate the results or the success of operations performed by the processor. There are three types of flags common to 32-bit assembly.

status flags

The first type of flags are status flags, which are as follows:

FlagPurpose
CFThe carry flag is set when a math operation on an unsigned integer generates a carry or borrow for the most significant bit.
PFThe parity flag is used to indicate that data was corrupted as a result of a math operation within a register.
AFThe adjust flag is used in Binary Coded Decimal math operations and is set if a carry or borrow operation occurs from bit 3 of the register used for the calculation.
ZFThe zero flag is set if the result of an operation is zero.
SFThe sign flag is set to the most significant bit of the result which is the sign bit and indicates whether the result is positive or negative.
OFThe overflow flag is used in signed integer arithmetic when a positive value is too big or a negative value is too small to be represented in the register.

control flags

The second type of flags are control flags, although there is only one. It is as follows:

FlagPurpose
DFThe direction flag controls string instructions, so if its set to 1 then string pointers will decrement but if its 0 then they will increment.

system flags

The final type of flags are system flags. They are used to control OS level operations and should never be modified by any program or application normally. They are as follows:

FlagPurpose
IFThe interrupt enable flag is set to 1 or 0 to allow external interrupts.
TFThe trap flag enables single-step debugging, if it’s set to 1 then the processor will generate a debug exception after every instruction.
RFThis resumes execution after a debug exception.
ACThis will enable alignment checking of memory.
VMThis indicates that Virtual 8086 mode is enabled.
IOPLThe I/O privilege level flag indicates the privilege level of the current running process.
NTThe nested task bit controls the chaining of interrupted and called tasks.