6 ms·

You are right in that 31 c0 xor %eax, %eax is shorter than b8 00 00 00 00 mov $0, %eax but that's not the main reason it's often used

You are right in that 31 c0 xor %eax, %eax is shorter than b8 00 00 00 00 mov $0, %eax but that's not the main reason it's often used in shellcode. The xor reg, reg is preferred because it means the resulting shellcode will not contain a null byte. This is desirable since the null-byte is often used as a string terminator, in environment variables for example.

limmeau 15y ago
Another reason to use xor: in the old days, ALU reg-reg commands were generally faster than reg-mem moves. The 8086 assembly tutorial book I used then recommended to use "sub ax, ax" instead because it was less surprising.