about summary refs log tree commit diff stats
diff options
context:
space:
mode:
authorKartik Agaram <vc@akkartik.com>2018-12-29 13:36:06 -0800
committerKartik Agaram <vc@akkartik.com>2018-12-29 13:36:06 -0800
commitdd9ba09a7c74455f17afb515c377a217fa8be8bc (patch)
treebdeba01efd5c56d3ccf4df10750bd99087d1bb24
parentd762282438f603d47804be04cebf77d6137c2728 (diff)
downloadmu-dd9ba09a7c74455f17afb515c377a217fa8be8bc.tar.gz
4888
We only can't use rm32=5 when mod=0. Totally fine when it's mod=1.
-rw-r--r--subx/050_write.subx6
-rw-r--r--subx/051test.subx6
-rw-r--r--subx/052kernel_string_equal.subx6
-rw-r--r--subx/053new_segment.subx2
-rw-r--r--subx/054string_equal.subx4
-rw-r--r--subx/055trace.subx20
-rw-r--r--subx/056write.subx12
-rw-r--r--subx/057stop.subx8
-rw-r--r--subx/058read.subx14
-rw-r--r--subx/059read-byte.subx2
-rw-r--r--subx/060write-stream.subx14
-rw-r--r--subx/061error.subx10
-rw-r--r--subx/062write-byte.subx6
-rw-r--r--subx/063print-byte.subx10
-rw-r--r--subx/064write-buffered.subx4
-rw-r--r--subx/065error-byte.subx18
-rw-r--r--subx/066allocate.subx4
-rwxr-xr-xsubx/apps/crenshaw2-1bin8333 -> 8241 bytes
-rw-r--r--subx/apps/crenshaw2-1.subx56
-rwxr-xr-xsubx/apps/crenshaw2-1bbin8892 -> 8800 bytes
-rw-r--r--subx/apps/crenshaw2-1b.subx56
-rwxr-xr-xsubx/apps/factorialbin7228 -> 7159 bytes
-rw-r--r--subx/apps/factorial.subx10
-rwxr-xr-xsubx/apps/hexbin11840 -> 11755 bytes
-rw-r--r--subx/apps/hex.subx42
-rwxr-xr-xsubx/examples/ex10bin165 -> 163 bytes
-rw-r--r--subx/examples/ex10.subx4
-rwxr-xr-xsubx/examples/ex11bin1125 -> 1117 bytes
-rw-r--r--subx/examples/ex11.subx16
-rwxr-xr-xsubx/examples/ex8bin139 -> 138 bytes
-rw-r--r--subx/examples/ex8.subx2
-rwxr-xr-xsubx/examples/ex9bin129 -> 127 bytes
-rw-r--r--subx/examples/ex9.subx4
-rwxr-xr-xsubx/test_apps10
34 files changed, 173 insertions, 173 deletions
diff --git a/subx/050_write.subx b/subx/050_write.subx
index 1f146a5d..58cfde7c 100644
--- a/subx/050_write.subx
+++ b/subx/050_write.subx
@@ -22,12 +22,12 @@ _write:  # fd : int, s : (address array byte) -> <void>
     53/push-EBX
     # syscall(write, fd, (data) s+4, (size) *s)
     # . fd : EBX
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           3/r32/EBX   8/disp8         .                 # copy *(EBP+8) to EBX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           3/r32/EBX   8/disp8         .                 # copy *(EBP+8) to EBX
     # . data : ECX = s+4
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           1/r32/ECX   0xc/disp8       .                 # copy *(EBP+12) to ECX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           1/r32/ECX   0xc/disp8       .                 # copy *(EBP+12) to ECX
     81          0/subop/add         3/mod/direct    1/rm32/ECX    .           .             .           .           .               4/imm32           # add to ECX
     # . size : EDX = *s
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           2/r32/EDX   0xc/disp8       .                 # copy *(EBP+12) to EDX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           2/r32/EDX   0xc/disp8       .                 # copy *(EBP+12) to EDX
     8b/copy                         0/mod/indirect  2/rm32/EDX    .           .             .           2/r32/EDX   .               .                 # copy *EDX to EDX
     # . syscall
     b8/copy-to-EAX  4/imm32/write
diff --git a/subx/051test.subx b/subx/051test.subx
index 98816c80..e0b91d17 100644
--- a/subx/051test.subx
+++ b/subx/051test.subx
@@ -30,8 +30,8 @@ check-ints-equal:  # (a : int, b : int, msg : (address array byte)) -> <void>
     51/push-ECX
     53/push-EBX
     # load first 2 args into EAX and EBX
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           0/r32/EAX   8/disp8         .                 # copy *(EBP+8) to EAX
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           3/r32/EBX   0xc/disp8       .                 # copy *(EBP+12) to EBX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           0/r32/EAX   8/disp8         .                 # copy *(EBP+8) to EAX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           3/r32/EBX   0xc/disp8       .                 # copy *(EBP+12) to EBX
     # if EAX == EBX success
     39/compare                      3/mod/direct    0/rm32/EAX    .           .             .           3/r32/EBX   .               .                 # compare EAX and EBX
     75/jump-if-unequal  $check-ints-equal:else/disp8
@@ -49,7 +49,7 @@ check-ints-equal:  # (a : int, b : int, msg : (address array byte)) -> <void>
 $check-ints-equal:else:
     # . _write(2/stderr, msg)
     # . . push args
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           1/r32/ECX   0x10/disp8      .                 # copy *(EBP+16) to ECX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           1/r32/ECX   0x10/disp8      .                 # copy *(EBP+16) to ECX
     51/push-ECX
     68/push  2/imm32/stderr
     # . . call
diff --git a/subx/052kernel_string_equal.subx b/subx/052kernel_string_equal.subx
index 02284c20..f663f504 100644
--- a/subx/052kernel_string_equal.subx
+++ b/subx/052kernel_string_equal.subx
@@ -54,12 +54,12 @@ kernel-string-equal:  # s : null-terminated ascii string, benchmark : length-pre
     #   return *s1 == 0
     #
     # initialize s into EDI
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           7/r32/EDI   8/disp8         .                 # copy *(EBP+8) to EDI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           7/r32/EDI   8/disp8         .                 # copy *(EBP+8) to EDI
     # initialize benchmark length n into EDX
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           2/r32/EDX   0xc/disp8       .                 # copy *(EBP+12) to EDX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           2/r32/EDX   0xc/disp8       .                 # copy *(EBP+12) to EDX
     8b/copy                         0/mod/indirect  2/rm32/EDX    .           .             .           2/r32/EDX   .               .                 # copy *EDX to EDX
     # initialize benchmark data into ESI
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           6/r32/ESI   0xc/disp8       .                 # copy *(EBP+12) to ESI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           6/r32/ESI   0xc/disp8       .                 # copy *(EBP+12) to ESI
     81          0/subop/add         3/mod/direct    6/rm32/ESI    .           .             .           .           .               4/imm32           # add to ESI
     # initialize loop counter i into ECX
     b9/copy-to-ECX  0/imm32/exit
diff --git a/subx/053new_segment.subx b/subx/053new_segment.subx
index d88abdc6..0aee0539 100644
--- a/subx/053new_segment.subx
+++ b/subx/053new_segment.subx
@@ -29,7 +29,7 @@ new-segment:  # len : int -> address
     53/push-EBX
     # copy len to _mmap-new-segment->len
     # TODO: compute _mmap-new-segment+4 before runtime
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           0/r32/EAX   8/disp8         .                 # copy *(EBP+8) to EAX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           0/r32/EAX   8/disp8         .                 # copy *(EBP+8) to EAX
     bb/copy-to-EBX  _mmap-new-segment/imm32
     89/copy                         1/mod/*+disp8   3/rm32/EBX    .           .             .           0/r32/EAX   4/disp8         .                 # copy EAX to *(EBX+4)
     # mmap(_mmap-new-segment)
diff --git a/subx/054string_equal.subx b/subx/054string_equal.subx
index 2ac7cb72..fe6dd17b 100644
--- a/subx/054string_equal.subx
+++ b/subx/054string_equal.subx
@@ -35,9 +35,9 @@ string-equal:  # s : string, benchmark : string -> EAX : boolean
     #   s[i]: EAX
     #
     # var s/EAX : (address array byte)
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           0/r32/EAX   8/disp8         .                 # copy *(EBP+8) to EAX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           0/r32/EAX   8/disp8         .                 # copy *(EBP+8) to EAX
     # var benchmark/EBX : (address array byte)
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           3/r32/EBX   0xc/disp8       .                 # copy *(EBP+12) to EBX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           3/r32/EBX   0xc/disp8       .                 # copy *(EBP+12) to EBX
     # if s->length != b->length return false
     # EDX = s->length
     8b/copy                         0/mod/indirect  0/rm32/EAX    .           .             .           2/r32/EDX   .               .                 # copy *EAX to EDX
diff --git a/subx/055trace.subx b/subx/055trace.subx
index c420c38a..17ecb29b 100644
--- a/subx/055trace.subx
+++ b/subx/055trace.subx
@@ -80,9 +80,9 @@ trace:  # t : (address trace-stream), line : string
     56/push-ESI
     57/push-EDI
     # EDI = t
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none              7/r32/EDI   8/disp8         .                 # copy *(EBP+8) to EDI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .                         7/r32/EDI   8/disp8         .                 # copy *(EBP+8) to EDI
     # ESI = line
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none              6/r32/ESI   0xc/disp8       .                 # copy *(EBP+12) to ESI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .                         6/r32/ESI   0xc/disp8       .                 # copy *(EBP+12) to ESI
     # ECX = t->write
     8b/copy                         0/mod/indirect  7/rm32/EDI    .           .             .           1/r32/ECX   .               .                 # copy *EDI to ECX
     # EDX = t->length
@@ -143,7 +143,7 @@ clear-trace-stream:  # t : (address trace-stream)
     50/push-EAX
     51/push-ECX
     # EAX = t
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none              0/r32/EAX   8/disp8         .                 # copy *(EBP+8) to EAX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .                         0/r32/EAX   8/disp8         .                 # copy *(EBP+8) to EAX
     # ECX = t->length
     8b/copy                         1/mod/*+disp8   0/rm32/EAX    .           .             .           1/r32/ECX   8/disp8         .                 # copy *(EAX+8) to ECX
     # ECX = &t->data[t->length]
@@ -284,7 +284,7 @@ _append-3:  # out : address, outend : address, s : (array byte) -> num_bytes_app
     51/push-ECX
     # _append-4(out, outend, &s->data[0], &s->data[s->length]) -> num_bytes_appended/EAX
     # . . push &s->data[s->length]
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none              0/r32/EAX   0x10/disp8      .                 # copy *(EBP+16) to EAX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .                         0/r32/EAX   0x10/disp8      .                 # copy *(EBP+16) to EAX
     8b/copy                         0/mod/indirect  0/rm32/EAX    .           .             .           1/r32/ECX   .               .                 # copy *EAX to ECX
     8d/copy-address                 1/mod/*+disp8   4/rm32/sib    0/base/EAX  1/index/ECX   .           1/r32/ECX   4/disp8         .                 # copy EAX+ECX+4 to ECX
     51/push-ECX
@@ -292,9 +292,9 @@ _append-3:  # out : address, outend : address, s : (array byte) -> num_bytes_app
     8d/copy-address                 1/mod/*+disp8   0/rm32/EAX    .           .             .           1/r32/ECX   4/disp8         .                 # copy EAX+4 to ECX
     51/push-ECX
     # . . push outend
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . push out
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  _append-4/disp32
     # . . discard args
@@ -321,13 +321,13 @@ _append-4:  # out : address, outend : address, in : address, inend : address ->
     # EAX/num_bytes_appended = 0
     b8/copy-to-EAX  0/imm32
     # EDI = out
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           7/r32/EDI   8/disp8         .                 # copy *(EBP+8) to EDI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           7/r32/EDI   8/disp8         .                 # copy *(EBP+8) to EDI
     # EDX = outend
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           2/r32/EDX   0xc/disp8       .                 # copy *(EBP+12) to EDX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           2/r32/EDX   0xc/disp8       .                 # copy *(EBP+12) to EDX
     # ESI = in
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           6/r32/ESI   0x10/disp8      .                 # copy *(EBP+16) to ESI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           6/r32/ESI   0x10/disp8      .                 # copy *(EBP+16) to ESI
     # ECX = inend
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           1/r32/ECX   0x14/disp8      .                 # copy *(EBP+20) to ECX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           1/r32/ECX   0x14/disp8      .                 # copy *(EBP+20) to ECX
 $_append-4:loop:
     # if ESI/in >= ECX/inend break
     39/compare                      3/mod/direct    6/rm32/ESI    .           .             .           1/r32/ECX   .               .                 # compare ESI with ECX
diff --git a/subx/056write.subx b/subx/056write.subx
index 3e52b4f2..395d33b5 100644
--- a/subx/056write.subx
+++ b/subx/056write.subx
@@ -33,11 +33,11 @@ write:  # f : fd or (address stream), s : (address array byte) -> <void>
     55/push-EBP
     89/copy                         3/mod/direct    5/rm32/EBP    .           .             .           4/r32/ESP   .               .                 # copy ESP to EBP
     # if (f < 0x08000000) _write(f, s), return  # f can't be a user-mode address, so treat it as a kernel file descriptor
-    81          7/subop/compare     1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         0x08000000/imm32  # compare *(EBP+8)
+    81          7/subop/compare     1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         0x08000000/imm32  # compare *(EBP+8)
     7d/jump-if-greater-or-equal  $write:fake/disp8
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  _write/disp32
     # . . discard args
@@ -51,14 +51,14 @@ $write:fake:
     52/push-EDX
     53/push-EBX
     # ECX = f
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none              1/r32/ECX   8/disp8         .                 # copy *(EBP+8) to ECX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .                         1/r32/ECX   8/disp8         .                 # copy *(EBP+8) to ECX
     # EDX = f->write
     8b/copy                         0/mod/indirect  1/rm32/ECX    .           .             .           2/r32/EDX   .               .                 # copy *ECX to EDX
     # EBX = f->length
     8b/copy                         1/mod/*+disp8   1/rm32/ECX    .           .             .           3/r32/EBX   8/disp8         .                 # copy *(ECX+8) to EBX
     # EAX = _append-3(&f->data[f->write], &f->data[f->length], s)
     # . . push s
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . push &f->data[f->length]
     8d/copy-address                 1/mod/*+disp8   4/rm32/sib    1/base/ECX  3/index/EBX   .           3/r32/EBX   0xc/disp8       .                 # copy ECX+EBX+12 to EBX
     53/push-EBX
@@ -90,7 +90,7 @@ clear-stream:  # f : (address stream) -> <void>
     50/push-EAX
     51/push-ECX
     # EAX = f
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none              0/r32/EAX   8/disp8         .                 # copy *(EBP+8) to EAX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .                         0/r32/EAX   8/disp8         .                 # copy *(EBP+8) to EAX
     # ECX = f->length
     8b/copy                         1/mod/*+disp8   0/rm32/EAX    .           .             .           1/r32/ECX   8/disp8         .                 # copy *(EAX+8) to ECX
     # ECX = &f->data[f->length]
diff --git a/subx/057stop.subx b/subx/057stop.subx
index b1aee746..f9e67f9e 100644
--- a/subx/057stop.subx
+++ b/subx/057stop.subx
@@ -56,7 +56,7 @@ tailor-exit-descriptor:  # ed : (address exit-descriptor), nbytes : int -> <void
     50/push-EAX
     51/push-ECX
     # EAX = nbytes
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           0/r32/EAX   0xc/disp8       .                 # copy *(EBP+12) to EAX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           0/r32/EAX   0xc/disp8       .                 # copy *(EBP+12) to EAX
     # Let X be the value of ESP in the caller, before the call to tailor-exit-descriptor.
     # The return address for a call in the caller's body will be at:
     #   X-8 if the caller takes 4 bytes of args for the exit-descriptor (add 4 bytes for the return address)
@@ -83,7 +83,7 @@ tailor-exit-descriptor:  # ed : (address exit-descriptor), nbytes : int -> <void
     f7          3/subop/negate      3/mod/direct    0/rm32/EAX    .           .             .           .           .               .                 # negate EAX
     8d/copy-address                 1/mod/*+disp8   4/rm32/sib    5/base/EBP  0/index/EAX   .           0/r32/EAX   0xc/disp8         .               # copy EBP+EAX+12 to EAX
     # copy EAX to ed->target
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           1/r32/ECX   8/disp8         .                 # copy *(EBP+8) to ECX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           1/r32/ECX   8/disp8         .                 # copy *(EBP+8) to ECX
     89/copy                         0/mod/indirect  1/rm32/ECX    .           .             .           0/r32/EAX   .               .                 # copy EAX to *ECX
     # initialize ed->value
     c7          0/subop/copy        1/mod/*+disp8   1/rm32/ECX    .           .             .           .           4/disp8         0/imm32           # copy to *(ECX+4)
@@ -172,7 +172,7 @@ _test-stop-1:  # ed : (address exit-descriptor)
     89/copy                         3/mod/direct    5/rm32/EBP    .           .             .           4/r32/ESP   .               .                 # copy ESP to EBP
     # _test-stop-2(ed)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  _test-stop-2/disp32
     # should never get past this point
@@ -200,7 +200,7 @@ _test-stop-2:  # ed : (address exit-descriptor)
     # . stop(ed, 1)
     # . . push args
     68/push  1/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  stop/disp32
     # should never get past this point
diff --git a/subx/058read.subx b/subx/058read.subx
index 16b50f07..42056a13 100644
--- a/subx/058read.subx
+++ b/subx/058read.subx
@@ -57,11 +57,11 @@ read:  # f : fd or (address stream), s : (address stream) -> num-bytes-read/EAX
     55/push-EBP
     89/copy                         3/mod/direct    5/rm32/EBP    .           .             .           4/r32/ESP   .               .                 # copy ESP to EBP
     # if (f < 0x08000000) return _read(f, s)  # f can't be a user-mode address, so treat it as a kernel file descriptor
-    81          7/subop/compare     1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         0x08000000/imm32  # compare *(EBP+8)
+    81          7/subop/compare     1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         0x08000000/imm32  # compare *(EBP+8)
     7d/jump-if-greater-or-equal  $read:fake/disp8
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  _read/disp32
     # . . discard args
@@ -74,9 +74,9 @@ $read:fake:
     56/push-ESI
     57/push-EDI
     # ESI = f
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           6/r32/ESI   8/disp8         .                 # copy *(EBP+8) to ESI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           6/r32/ESI   8/disp8         .                 # copy *(EBP+8) to ESI
     # EDI = s
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           7/r32/EDI   0xc/disp8       .                 # copy *(EBP+12) to ESI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           7/r32/EDI   0xc/disp8       .                 # copy *(EBP+12) to ESI
     # EAX = _append-4(out = &s->data[s->write], outend = &s->data[s->length],
     #                 in  = &f->data[f->read],  inend  = &f->data[f->write])
     # . . push &f->data[f->write]
@@ -128,14 +128,14 @@ _read:  # fd : int, s : (address stream) -> num-bytes-read/EAX
     53/push-EBX
     56/push-ESI
     # ESI = s
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           6/r32/ESI   0xc/disp8       .                 # copy *(EBP+12) to ESI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           6/r32/ESI   0xc/disp8       .                 # copy *(EBP+12) to ESI
     # EAX = s->write
     8b/copy                         0/mod/indirect  6/rm32/ESI    .           .             .           0/r32/EAX   .               .                 # copy *ESI to EAX
     # EDX = s->length
     8b/copy                         1/mod/*+disp8   6/rm32/ESI    .           .             .           2/r32/EDX   8/disp8         .                 # copy *(ESI+8) to EDX
     # syscall(read, fd, &s->data[s->write], s->length - s->write)
     # . . fd : EBX
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           3/r32/EBX   8/disp8         .                 # copy *(EBP+8) to EBX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           3/r32/EBX   8/disp8         .                 # copy *(EBP+8) to EBX
     # . . data : ECX = &s->data[s->write]
     8d/copy-address                 1/mod/*+disp8   4/rm32/sib    6/base/ESI  0/index/EAX   .           1/r32/ECX   0xc/disp8       .                 # copy ESI+EAX+12 to ECX
     # . . size : EDX = s->length - s->write
diff --git a/subx/059read-byte.subx b/subx/059read-byte.subx
index e4b54b61..fc583809 100644
--- a/subx/059read-byte.subx
+++ b/subx/059read-byte.subx
@@ -50,7 +50,7 @@ read-byte:  # f : (address buffered-file) -> byte-or-eof/EAX
     51/push-ECX
     56/push-ESI
     # ESI = f
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           6/r32/ESI   8/disp8         .                 # copy *(EBP+8) to ESI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           6/r32/ESI   8/disp8         .                 # copy *(EBP+8) to ESI
     # ECX = f->read
     8b/copy                         1/mod/*+disp8   6/rm32/ESI    .           .             .           1/r32/ECX   8/disp8         .                 # copy *(ESI+8) to ECX
     # if (f->read >= f->write) populate stream from file
diff --git a/subx/060write-stream.subx b/subx/060write-stream.subx
index 66e15c7b..a9859ec9 100644
--- a/subx/060write-stream.subx
+++ b/subx/060write-stream.subx
@@ -24,11 +24,11 @@ write-stream:  # f : fd or (address stream), s : (address stream) -> <void>
     55/push-EBP
     89/copy                         3/mod/direct    5/rm32/EBP    .           .             .           4/r32/ESP   .               .                 # copy ESP to EBP
     # if (f < 0x08000000) _write-stream(f, s), return  # f can't be a user-mode address, so treat it as a kernel file descriptor
-    81          7/subop/compare     1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         0x08000000/imm32  # compare *(EBP+8)
+    81          7/subop/compare     1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         0x08000000/imm32  # compare *(EBP+8)
     7d/jump-if-greater-or-equal  $write-stream:fake/disp8
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  _write-stream/disp32
     # . . discard args
@@ -41,9 +41,9 @@ $write-stream:fake:
     56/push-ESI
     57/push-EDI
     # EDI = f
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none              7/r32/EDI   8/disp8         .                 # copy *(EBP+8) to EDI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .                         7/r32/EDI   8/disp8         .                 # copy *(EBP+8) to EDI
     # ESI = s
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none              6/r32/ESI   0xc/disp8       .                 # copy *(EBP+12) to ESI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .                         6/r32/ESI   0xc/disp8       .                 # copy *(EBP+12) to ESI
     # EAX = _append-4(&f->data[f->write], &f->data[f->length], &s->data[s->read], &s->data[s->write])
     # . . push &s->data[s->write]
     8b/copy                         0/mod/indirect  6/rm32/ESI    .           .             .           0/r32/EAX   .               .                 # copy *ESI to EAX
@@ -91,14 +91,14 @@ _write-stream:  # fd : int, s : (address stream) -> <void>
     56/push-ESI
     57/push-EDI
     # ESI = s
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           6/r32/ESI   0xc/disp8       .                 # copy *(EBP+12) to ESI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           6/r32/ESI   0xc/disp8       .                 # copy *(EBP+12) to ESI
     # EDI = s->read
     8b/copy                         1/mod/*+disp8   6/rm32/ESI    .           .             .           7/r32/EDI   4/disp8         .                 # copy *(ESI+4) to EDI
     # EDX = s->write
     8b/copy                         0/mod/indirect  6/rm32/ESI    .           .             .           2/r32/EDX   .               .                 # copy *ESI to EDX
     # syscall(write, fd, &s->data[s->read], s->write-s->read)
     # . . fd : EBX
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           3/r32/EBX   8/disp8         .                 # copy *(EBP+8) to EBX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           3/r32/EBX   8/disp8         .                 # copy *(EBP+8) to EBX
     # . . data : ECX = &s->data[s->read]
     8d/copy-address                 1/mod/*+disp8   4/rm32/sib    6/base/ESI  7/index/EDI   .           1/r32/ECX   0xc/disp8       .                 # copy ESI+EDI+12 to ECX
     # . . size : EDX = s->write - s->read
diff --git a/subx/061error.subx b/subx/061error.subx
index ef244162..efda8ea3 100644
--- a/subx/061error.subx
+++ b/subx/061error.subx
@@ -20,15 +20,15 @@ error:  # ed : (address exit-descriptor), out : fd or (address stream), msg : (a
     # write(out, "Error: ")
     # . . push args
     68/push  "Error: "/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
     81          0/subop/add         3/mod/direct    4/rm32/ESP    .           .             .           .           .               8/imm32           # add to ESP
     # write(out, msg)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x10/disp8      .                 # push *(EBP+16)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x10/disp8      .                 # push *(EBP+16)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -36,7 +36,7 @@ error:  # ed : (address exit-descriptor), out : fd or (address stream), msg : (a
     # write(out, Newline)
     # . . push args
     68/push  Newline/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -44,7 +44,7 @@ error:  # ed : (address exit-descriptor), out : fd or (address stream), msg : (a
     # stop(ed, 1)
     # . . push args
     68/push  1/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  stop/disp32
     # should never get past this point
diff --git a/subx/062write-byte.subx b/subx/062write-byte.subx
index d6a3a90b..ad29d9f1 100644
--- a/subx/062write-byte.subx
+++ b/subx/062write-byte.subx
@@ -43,7 +43,7 @@ write-byte:  # f : (address buffered-file), n : int -> <void>
     51/push-ECX
     57/push-EDI
     # EDI = f
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           7/r32/EDI   8/disp8         .                 # copy *(EBP+8) to EDI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           7/r32/EDI   8/disp8         .                 # copy *(EBP+8) to EDI
     # ECX = f->write
     8b/copy                         1/mod/*+disp8   7/rm32/EDI    .           .             .           1/r32/ECX   4/disp8         .                 # copy *(EDI+4) to ECX
     # if (f->write >= f->length) flush and clear f's stream
@@ -68,7 +68,7 @@ $write-byte:to-stream:
     # write to stream
     # f->data[f->read] = LSB(n)
     31/xor                          3/mod/direct    0/rm32/EAX    .           .             .           0/r32/EAX   .               .                 # clear EAX
-    8a/copy-byte                    1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           0/r32/AL    0xc/disp8       .                 # copy byte at *(EBP+12) to AL
+    8a/copy-byte                    1/mod/*+disp8   5/rm32/EBP    .           .             .           0/r32/AL    0xc/disp8       .                 # copy byte at *(EBP+12) to AL
     88/copy-byte                    1/mod/*+disp8   4/rm32/sib    7/base/EDI  1/index/ECX   .           0/r32/AL    0x10/disp8      .                 # copy AL to *(EDI+ECX+16)
     # ++f->read
     ff          0/subop/increment   1/mod/*+disp8   7/rm32/EDI    .           .             .           .           4/disp8         .                 # increment *(EDI+4)
@@ -89,7 +89,7 @@ flush:  # f : (address buffered-file) -> <void>
     50/push-EAX
     51/push-ECX
     # EAX = f
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           0/r32/EAX   8/disp8         .                 # copy *(EBP+8) to EAX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           0/r32/EAX   8/disp8         .                 # copy *(EBP+8) to EAX
     # write-stream(f->fd, data = f+4)
       # . . push args
     8d/copy-address                 1/mod/*+disp8   0/rm32/EAX    .           .             .           1/r32/ECX   4/disp8         .                 # copy EAX+4 to ECX
diff --git a/subx/063print-byte.subx b/subx/063print-byte.subx
index 61b19146..8bd9fbfc 100644
--- a/subx/063print-byte.subx
+++ b/subx/063print-byte.subx
@@ -19,7 +19,7 @@ print-byte:  # f : (address buffered-file), n : int -> <void>
     # . save registers
     50/push-EAX
     # AL = convert upper nibble to hex
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           0/r32/EAX   0xc/disp8       .                 # copy *(EBP+12) to EAX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           0/r32/EAX   0xc/disp8       .                 # copy *(EBP+12) to EAX
     c1/shift    5/subop/logic-right 3/mod/direct    0/rm32/EAX    .           .             .           .           .               4/imm8            # shift EAX right by 4 bits, while padding zeroes
     # . hex-char(AL)
     # . . push args
@@ -31,13 +31,13 @@ print-byte:  # f : (address buffered-file), n : int -> <void>
     # write-byte(f, AL)
     # . . push args
     50/push-EAX
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  write-byte/disp32
     # . . discard args
     81          0/subop/add         3/mod/direct    4/rm32/ESP    .           .             .           .           .               8/imm32           # add to ESP
     # AL = convert lower nibble to hex
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           0/r32/EAX   0xc/disp8       .                 # copy *(EBP+12) to EAX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           0/r32/EAX   0xc/disp8       .                 # copy *(EBP+12) to EAX
     25/and-EAX  0xf/imm32
     # . hex-char(AL)
     # . . push args
@@ -49,7 +49,7 @@ print-byte:  # f : (address buffered-file), n : int -> <void>
     # write-byte(f, AL)
     # . . push args
     50/push-EAX
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  write-byte/disp32
     # . . discard args
@@ -70,7 +70,7 @@ hex-char:  # n : int -> char_or_error/EAX
     55/push-EBP
     89/copy                         3/mod/direct    5/rm32/EBP    .           .             .           4/r32/ESP   .               .                 # copy ESP to EBP
     # EAX = n
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           0/r32/EAX   8/disp8         .                 # copy *(EBP+8) to EAX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           0/r32/EAX   8/disp8         .                 # copy *(EBP+8) to EAX
     # if it's <= 9 add '0' to it
     81          7/subop/compare     3/mod/direct    0/rm32/EAX    .           .             .           .           .               0x9/imm32         # compare EAX
     7f/jump-if-greater  $hex-char:check2/disp8
diff --git a/subx/064write-buffered.subx b/subx/064write-buffered.subx
index 55d703c2..3c3c7276 100644
--- a/subx/064write-buffered.subx
+++ b/subx/064write-buffered.subx
@@ -45,14 +45,14 @@ write-buffered:  # f : (address buffered-file), msg : (address array byte) -> <v
     56/push-ESI
     57/push-EDI
     # EAX = msg
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none              0/r32/EAX   0xc/disp8       .                 # copy *(EBP+12) to EAX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .                         0/r32/EAX   0xc/disp8       .                 # copy *(EBP+12) to EAX
     # in/ESI = msg->data
     8d/copy-address                 1/mod/*+disp8   0/rm32/EAX    .           .             .           6/r32/ESI   4/disp8         .                 # copy EAX+4 to ESI
     # inend/ECX = &msg->data[msg->length]
     8b/copy                         0/mod/indirect  0/rm32/EAX    .           .             .           1/r32/ECX   .               .                 # copy *EAX to ECX
     8d/copy-address                 0/mod/indirect  4/rm32/sib    6/base/ESI  1/index/ECX   .           1/r32/ECX   .               .                 # copy ESI+ECX to ECX
     # EDI = f
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none              7/r32/EDI   8/disp8         .                 # copy *(EBP+8) to EDI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .                         7/r32/EDI   8/disp8         .                 # copy *(EBP+8) to EDI
     # EDX = f->length
     8b/copy                         1/mod/*+disp8   7/rm32/EDI    .           .             .           2/r32/EDX   0xc/disp8       .                 # copy *(EDI+12) to EDX
     # EBX = f->write
diff --git a/subx/065error-byte.subx b/subx/065error-byte.subx
index bbbf6c36..5f9a4ada 100644
--- a/subx/065error-byte.subx
+++ b/subx/065error-byte.subx
@@ -34,15 +34,15 @@ error-byte:  # ed : (address exit-descriptor), out : (address buffered-file), ms
     # write-buffered(out, "Error: ")
     # . . push args
     68/push  "Error: "/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write-buffered/disp32
     # . . discard args
     81          0/subop/add         3/mod/direct    4/rm32/ESP    .           .             .           .           .               8/imm32           # add to ESP
     # write-buffered(out, msg)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x10/disp8      .                 # push *(EBP+16)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x10/disp8      .                 # push *(EBP+16)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write-buffered/disp32
     # . . discard args
@@ -50,15 +50,15 @@ error-byte:  # ed : (address exit-descriptor), out : (address buffered-file), ms
     # write-buffered(out, ": ")
     # . . push args
     68/push  ": "/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write-buffered/disp32
     # . . discard args
     81          0/subop/add         3/mod/direct    4/rm32/ESP    .           .             .           .           .               8/imm32           # add to ESP
     # print-byte(out, byte)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x14/disp8      .                 # push *(EBP+20)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x14/disp8      .                 # push *(EBP+20)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  print-byte/disp32
     # . . discard args
@@ -66,14 +66,14 @@ error-byte:  # ed : (address exit-descriptor), out : (address buffered-file), ms
     # write-buffered(out, Newline)
     # . . push args
     68/push  Newline/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write-buffered/disp32
     # . . discard args
     81          0/subop/add         3/mod/direct    4/rm32/ESP    .           .             .           .           .               8/imm32           # add to ESP
     # . flush(out)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  flush/disp32
     # . . discard args
@@ -81,7 +81,7 @@ error-byte:  # ed : (address exit-descriptor), out : (address buffered-file), ms
     # stop(ed, 1)
     # . . push args
     68/push  1/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  stop/disp32
     # should never get past this point
diff --git a/subx/066allocate.subx b/subx/066allocate.subx
index 92da3815..0e3b54f6 100644
--- a/subx/066allocate.subx
+++ b/subx/066allocate.subx
@@ -46,13 +46,13 @@ allocate:  # ad : (address allocation-descriptor), n : int -> address-or-null/EA
     51/push-ECX
     52/push-EDX
     # ECX = ad
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           1/r32/ECX   8/disp8         .                 # copy *(EBP+8) to ECX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           1/r32/ECX   8/disp8         .                 # copy *(EBP+8) to ECX
     # save ad->curr
     8b/copy                         0/mod/indirect  1/rm32/ECX    .           .             .           0/r32/EAX   .               .                 # copy *ECX to EAX
     # check if there's enough space
     # . EDX = ad->curr + n
     89/copy                         3/mod/direct    2/rm32/EDX    .           .             .           0/r32/EAX   .               .                 # copy EAX to EDX
-    03/add                          1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           2/r32/EDX   0xc/disp8       .                 # add *(EBP+12) to EDX
+    03/add                          1/mod/*+disp8   5/rm32/EBP    .           .             .           2/r32/EDX   0xc/disp8       .                 # add *(EBP+12) to EDX
     3b/compare                      1/mod/*+disp8   1/rm32/ECX    .           .             .           2/r32/EDX   4/disp8         .                 # compare EDX with *(ECX+4)
     7c/jump-if-lesser  $allocate:commit/disp8
     # return null if not
diff --git a/subx/apps/crenshaw2-1 b/subx/apps/crenshaw2-1
index 1f3b5436..5a28117c 100755
--- a/subx/apps/crenshaw2-1
+++ b/subx/apps/crenshaw2-1
Binary files differdiff --git a/subx/apps/crenshaw2-1.subx b/subx/apps/crenshaw2-1.subx
index e0ab0f47..25dbe8a8 100644
--- a/subx/apps/crenshaw2-1.subx
+++ b/subx/apps/crenshaw2-1.subx
@@ -39,12 +39,12 @@
     89/copy                         3/mod/direct    5/rm32/EBP    .           .             .           4/r32/ESP   .               .                 # copy ESP to EBP
     # - if argc > 1 and argv[1] == "test" then return run_tests()
     # . argc > 1
-    81          7/subop/compare     1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0/disp8         1/imm32           # compare *EBP
+    81          7/subop/compare     1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0/disp8         1/imm32           # compare *EBP
     7e/jump-if-lesser-or-equal  $run-main/disp8
     # . argv[1] == "test"
     # . . push args
     68/push  "test"/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  kernel-string-equal/disp32
     # . . discard args
@@ -91,7 +91,7 @@ compile:  # in : (address buffered-file), out : fd or (address stream), err : fd
     # prime the pump
     # . Look = get-char(in)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8      .                    # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8      .                    # push *(EBP+8)
     # . . call
     e8/call  get-char/disp32
     # . . discard args
@@ -116,10 +116,10 @@ compile:  # in : (address buffered-file), out : fd or (address stream), err : fd
     # read a digit from 'in' into 'num'
     # . get-num(in, num, err, ed)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x14/disp8      .                 # push *(EBP+20)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x10/disp8      .                 # push *(EBP+16)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x14/disp8      .                 # push *(EBP+20)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x10/disp8      .                 # push *(EBP+16)
     51/push-ECX/num
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8      .                    # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8      .                    # push *(EBP+8)
     # . . call
     e8/call  get-num/disp32
     # . . discard args
@@ -132,7 +132,7 @@ compile:  # in : (address buffered-file), out : fd or (address stream), err : fd
     # . write(out, "bb/copy-to-EBX  ")
     # . . push args
     68/push  "bb/copy-to-EBX  "/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -140,7 +140,7 @@ compile:  # in : (address buffered-file), out : fd or (address stream), err : fd
     # . write-stream(out, num)
     # . . push args
     51/push-ECX/num
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write-stream/disp32
     # . . discard args
@@ -148,7 +148,7 @@ compile:  # in : (address buffered-file), out : fd or (address stream), err : fd
     # . write(out, Newline)
     # . . push args
     68/push  Newline/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -156,7 +156,7 @@ compile:  # in : (address buffered-file), out : fd or (address stream), err : fd
     # . write(out, "b8/copy-to-EAX  1/imm32/exit")
     # . . push args
     68/push  "b8/copy-to-EAX  1/imm32/exit"/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -164,7 +164,7 @@ compile:  # in : (address buffered-file), out : fd or (address stream), err : fd
     # . write(out, Newline)
     # . . push args
     68/push  Newline/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -172,7 +172,7 @@ compile:  # in : (address buffered-file), out : fd or (address stream), err : fd
     # . write(out, "cd/syscall  0x80/imm8")
     # . . push args
     68/push  "cd/syscall  0x80/imm8"/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -180,7 +180,7 @@ compile:  # in : (address buffered-file), out : fd or (address stream), err : fd
     # . write(out, Newline)
     # . . push args
     68/push  Newline/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -235,8 +235,8 @@ get-num:  # in : (address buffered-file), out : (address stream), err : fd or (a
     # . expected(ed, err, "integer")
     # . . push args
     68/push  "integer"/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x10/disp8      .                 # push *(EBP+16)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x14/disp8      .                 # push *(EBP+20)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x10/disp8      .                 # push *(EBP+16)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x14/disp8      .                 # push *(EBP+20)
     # . . call
     e8/call  expected/disp32  # never returns
     # . . discard args
@@ -252,9 +252,9 @@ $get-num:main:
     57/push-EDI
     # read necessary variables to registers
     # ESI = in
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           6/r32/ESI   8/disp8         .                 # copy *(EBP+8) to ESI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           6/r32/ESI   8/disp8         .                 # copy *(EBP+8) to ESI
     # EDI = out
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           7/r32/EDI   0xc/disp8       .                 # copy *(EBP+12) to EDI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           7/r32/EDI   0xc/disp8       .                 # copy *(EBP+12) to EDI
     # ECX = out->write
     8b/copy                         0/mod/indirect  7/rm32/EDI    .           .             .           1/r32/ECX   .               .                 # copy *EDI to ECX
     # EDX = out->length
@@ -265,8 +265,8 @@ $get-num:main:
     # . error(ed, err, msg)  # TODO: show full number
     # . . push args
     68/push  "get-num: too many digits in number"/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x10/disp8      .                 # push *(EBP+16)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x14/disp8      .                 # push *(EBP+20)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x10/disp8      .                 # push *(EBP+16)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x14/disp8      .                 # push *(EBP+20)
     # . . call
     e8/call  error/disp32  # never returns
     # . . discard args
@@ -487,15 +487,15 @@ expected:  # ed : (address exit-descriptor), f : fd or (address stream), s : (ad
     # write(f, "Error: ")
     # . . push args
     68/push  "Error: "/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
     81          0/subop/add         3/mod/direct    4/rm32/ESP    .           .             .           .           .               8/imm32           # add to ESP
     # write(f, s)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x10/disp8      .                 # push *(EBP+16)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x10/disp8      .                 # push *(EBP+16)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -503,7 +503,7 @@ expected:  # ed : (address exit-descriptor), f : fd or (address stream), s : (ad
     # write(f, " expected")
     # . . push args
     68/push  " expected"/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -511,7 +511,7 @@ expected:  # ed : (address exit-descriptor), f : fd or (address stream), s : (ad
     # write(f, Newline)
     # . . push args
     68/push  Newline/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -519,7 +519,7 @@ expected:  # ed : (address exit-descriptor), f : fd or (address stream), s : (ad
     # stop(ed, 1)
     # . . push args
     68/push  1/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  stop/disp32
     # should never get past this point
@@ -538,7 +538,7 @@ get-char:  # f : (address buffered-file) -> <void>
     50/push-EAX
     # read-byte(f)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  read-byte/disp32
     # . . discard args
@@ -560,10 +560,10 @@ is-digit?:  # c : int -> bool/EAX
     # EAX = false
     b8/copy-to-EAX  0/imm32
     # if c < '0' return false
-    81          7/subop/compare     1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         0x30/imm32        # compare *(EBP+8)
+    81          7/subop/compare     1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         0x30/imm32        # compare *(EBP+8)
     7c/jump-if-lesser  $is-digit?:end/disp8
     # if c > '9' return false
-    81          7/subop/compare     1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         0x39/imm32        # compare *(EBP+8)
+    81          7/subop/compare     1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         0x39/imm32        # compare *(EBP+8)
     7f/jump-if-greater  $is-digit?:end/disp8
     # otherwise return true
     b8/copy-to-EAX  1/imm32
diff --git a/subx/apps/crenshaw2-1b b/subx/apps/crenshaw2-1b
index 08395a6b..46a26183 100755
--- a/subx/apps/crenshaw2-1b
+++ b/subx/apps/crenshaw2-1b
Binary files differdiff --git a/subx/apps/crenshaw2-1b.subx b/subx/apps/crenshaw2-1b.subx
index 268e6400..74222798 100644
--- a/subx/apps/crenshaw2-1b.subx
+++ b/subx/apps/crenshaw2-1b.subx
@@ -39,12 +39,12 @@
     89/copy                         3/mod/direct    5/rm32/EBP    .           .             .           4/r32/ESP   .               .                 # copy ESP to EBP
     # - if argc > 1 and argv[1] == "test" then return run_tests()
     # . argc > 1
-    81          7/subop/compare     1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0/disp8         1/imm32           # compare *EBP
+    81          7/subop/compare     1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0/disp8         1/imm32           # compare *EBP
     7e/jump-if-lesser-or-equal  $run-main/disp8
     # . argv[1] == "test"
     # . . push args
     68/push  "test"/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  kernel-string-equal/disp32
     # . . discard args
@@ -91,7 +91,7 @@ compile:  # in : (address buffered-file), out : fd or (address stream), err : fd
     # prime the pump
     # . Look = get-char(in)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8      .                    # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8      .                    # push *(EBP+8)
     # . . call
     e8/call  get-char/disp32
     # . . discard args
@@ -116,10 +116,10 @@ compile:  # in : (address buffered-file), out : fd or (address stream), err : fd
     # read a digit from 'in' into 'num'
     # . get-num(in, num, err, ed)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x14/disp8      .                 # push *(EBP+20)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x10/disp8      .                 # push *(EBP+16)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x14/disp8      .                 # push *(EBP+20)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x10/disp8      .                 # push *(EBP+16)
     51/push-ECX/num
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8      .                    # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8      .                    # push *(EBP+8)
     # . . call
     e8/call  get-num/disp32
     # . . discard args
@@ -132,7 +132,7 @@ compile:  # in : (address buffered-file), out : fd or (address stream), err : fd
     # . write(out, "bb/copy-to-EBX  ")
     # . . push args
     68/push  "bb/copy-to-EBX  "/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -140,7 +140,7 @@ compile:  # in : (address buffered-file), out : fd or (address stream), err : fd
     # . write-stream(out, num)
     # . . push args
     51/push-ECX/num
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write-stream/disp32
     # . . discard args
@@ -148,7 +148,7 @@ compile:  # in : (address buffered-file), out : fd or (address stream), err : fd
     # . write(out, Newline)
     # . . push args
     68/push  Newline/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -156,7 +156,7 @@ compile:  # in : (address buffered-file), out : fd or (address stream), err : fd
     # . write(out, "b8/copy-to-EAX  1/imm32/exit")
     # . . push args
     68/push  "b8/copy-to-EAX  1/imm32/exit"/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -164,7 +164,7 @@ compile:  # in : (address buffered-file), out : fd or (address stream), err : fd
     # . write(out, Newline)
     # . . push args
     68/push  Newline/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -172,7 +172,7 @@ compile:  # in : (address buffered-file), out : fd or (address stream), err : fd
     # . write(out, "cd/syscall  0x80/imm8")
     # . . push args
     68/push  "cd/syscall  0x80/imm8"/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -180,7 +180,7 @@ compile:  # in : (address buffered-file), out : fd or (address stream), err : fd
     # . write(out, Newline)
     # . . push args
     68/push  Newline/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -240,8 +240,8 @@ get-num:  # in : (address buffered-file), out : (address stream), err : fd or (a
     # . expected(ed, err, "integer")
     # . . push args
     68/push  "integer"/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x10/disp8      .                 # push *(EBP+16)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x14/disp8      .                 # push *(EBP+20)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x10/disp8      .                 # push *(EBP+16)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x14/disp8      .                 # push *(EBP+20)
     # . . call
     e8/call  expected/disp32  # never returns
     # . . discard args
@@ -257,9 +257,9 @@ $get-num:main:
     57/push-EDI
     # read necessary variables to registers
     # ESI = in
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           6/r32/ESI   8/disp8         .                 # copy *(EBP+8) to ESI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           6/r32/ESI   8/disp8         .                 # copy *(EBP+8) to ESI
     # EDI = out
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           7/r32/EDI   0xc/disp8       .                 # copy *(EBP+12) to EDI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           7/r32/EDI   0xc/disp8       .                 # copy *(EBP+12) to EDI
     # ECX = out->write
     8b/copy                         0/mod/indirect  7/rm32/EDI    .           .             .           1/r32/ECX   .               .                 # copy *EDI to ECX
     # EDX = out->length
@@ -271,8 +271,8 @@ $get-num:loop:
     # . error(ed, err, msg)  # TODO: show full number
     # . . push args
     68/push  "get-num: too many digits in number"/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x10/disp8      .                 # push *(EBP+16)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x14/disp8      .                 # push *(EBP+20)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x10/disp8      .                 # push *(EBP+16)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x14/disp8      .                 # push *(EBP+20)
     # . . call
     e8/call  error/disp32  # never returns
     # . . discard args
@@ -686,15 +686,15 @@ expected:  # ed : (address exit-descriptor), f : fd or (address stream), s : (ad
     # write(f, "Error: ")
     # . . push args
     68/push  "Error: "/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
     81          0/subop/add         3/mod/direct    4/rm32/ESP    .           .             .           .           .               8/imm32           # add to ESP
     # write(f, s)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x10/disp8      .                 # push *(EBP+16)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x10/disp8      .                 # push *(EBP+16)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -702,7 +702,7 @@ expected:  # ed : (address exit-descriptor), f : fd or (address stream), s : (ad
     # write(f, " expected")
     # . . push args
     68/push  " expected"/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -710,7 +710,7 @@ expected:  # ed : (address exit-descriptor), f : fd or (address stream), s : (ad
     # write(f, Newline)
     # . . push args
     68/push  Newline/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write/disp32
     # . . discard args
@@ -718,7 +718,7 @@ expected:  # ed : (address exit-descriptor), f : fd or (address stream), s : (ad
     # stop(ed, 1)
     # . . push args
     68/push  1/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  stop/disp32
     # should never get past this point
@@ -736,7 +736,7 @@ get-char:  # f : (address buffered-file) -> <void>
     50/push-EAX
     # read-byte(f)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  read-byte/disp32
     # . . discard args
@@ -757,10 +757,10 @@ is-digit?:  # c : int -> bool/EAX
     # EAX = false
     b8/copy-to-EAX  0/imm32
     # if c < '0' return false
-    81          7/subop/compare     1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         0x30/imm32        # compare *(EBP+8)
+    81          7/subop/compare     1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         0x30/imm32        # compare *(EBP+8)
     7c/jump-if-lesser  $is-digit?:end/disp8
     # if c > '9' return false
-    81          7/subop/compare     1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         0x39/imm32        # compare *(EBP+8)
+    81          7/subop/compare     1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         0x39/imm32        # compare *(EBP+8)
     7f/jump-if-greater  $is-digit?:end/disp8
     # otherwise return true
     b8/copy-to-EAX  1/imm32
diff --git a/subx/apps/factorial b/subx/apps/factorial
index 3bd1c65b..679feb71 100755
--- a/subx/apps/factorial
+++ b/subx/apps/factorial
Binary files differdiff --git a/subx/apps/factorial.subx b/subx/apps/factorial.subx
index adc772db..068a63cb 100644
--- a/subx/apps/factorial.subx
+++ b/subx/apps/factorial.subx
@@ -24,12 +24,12 @@
     89/copy                         3/mod/direct    5/rm32/EBP    .           .             .           4/r32/ESP   .               .                 # copy ESP to EBP
     # - if argc > 1 and argv[1] == "test" then return run_tests()
     # . argc > 1
-    81          7/subop/compare     1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0/disp8         1/imm32           # compare *EBP
+    81          7/subop/compare     1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0/disp8         1/imm32           # compare *EBP
     7e/jump-if-lesser-or-equal  $run-main/disp8
     # . argv[1] == "test"
     # . . push args
     68/push  "test"/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  kernel-string-equal/disp32
     # . . discard args
@@ -63,10 +63,10 @@ factorial:  # n : int -> int/EAX
     # EAX = 1 (base case)
     b8/copy-to-EAX  1/imm32
     # if (n <= 1) return
-    81          7/subop/compare     1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         1/imm32           # compare *(EBP+8)
+    81          7/subop/compare     1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         1/imm32           # compare *(EBP+8)
     7e/jump-if-<=  $factorial:end/disp8
     # EBX = n-1
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none              3/r32/EBX   8/disp8         .                 # copy *(EBP+8) to EBX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .                         3/r32/EBX   8/disp8         .                 # copy *(EBP+8) to EBX
     81          5/subop/subtract    3/mod/direct    3/rm32/EBX    .           .             .           .           .               1/imm32           # subtract from EBX
     # EAX = factorial(n-1)
     # . . push args
@@ -76,7 +76,7 @@ factorial:  # n : int -> int/EAX
     # . . discard args
     81          0/subop/add         3/mod/direct    4/rm32/ESP    .           .             .           .           .               4/imm32           # add to ESP
     # return n * factorial(n-1)
-    f7          4/subop/multiply    1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none                          8/disp8         .                 # multiply *(EBP+8) into EAX
+    f7          4/subop/multiply    1/mod/*+disp8   5/rm32/EBP    .           .                                     8/disp8         .                 # multiply *(EBP+8) into EAX
     # TODO: check for overflow
 $factorial:end:
     # . epilog
diff --git a/subx/apps/hex b/subx/apps/hex
index 9287faa7..93c9f27f 100755
--- a/subx/apps/hex
+++ b/subx/apps/hex
Binary files differdiff --git a/subx/apps/hex.subx b/subx/apps/hex.subx
index 032c1da7..2660bd54 100644
--- a/subx/apps/hex.subx
+++ b/subx/apps/hex.subx
@@ -27,12 +27,12 @@
     89/copy                         3/mod/direct    5/rm32/EBP    .           .             .           4/r32/ESP   .               .                 # copy ESP to EBP
     # - if argc > 1 and argv[1] == "test" then return run_tests()
     # . argc > 1
-    81          7/subop/compare     1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0/disp8         1/imm32           # compare *EBP
+    81          7/subop/compare     1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0/disp8         1/imm32           # compare *EBP
     7e/jump-if-lesser-or-equal  $run-main/disp8
     # . argv[1] == "test"
     # . . push args
     68/push  "test"/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  kernel-string-equal/disp32
     # . . discard args
@@ -91,9 +91,9 @@ convert:  # in : (address buffered-file), out : (address buffered-file), err : (
 $convert:loop:
     # EAX = convert-next-octet(in, err, ed)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x14/disp8      .                 # push *(EBP+20)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x10/disp8      .                 # push *(EBP+16)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x14/disp8      .                 # push *(EBP+20)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x10/disp8      .                 # push *(EBP+16)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  convert-next-octet/disp32
     # . . discard first 2 args
@@ -104,7 +104,7 @@ $convert:loop:
     # write-byte(out, AL)
     # . . push args
     50/push-EAX
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  write-byte/disp32
     # . . discard args
@@ -114,7 +114,7 @@ $convert:loop:
 $convert:loop-end:
     # flush(out)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . call
     e8/call  flush/disp32
     # . . discard args
@@ -151,9 +151,9 @@ convert-next-octet:  # in : (address buffered-file), err : (address buffered-fil
     51/push-ECX
     # EAX = scan-next-byte(in, err, ed)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x10/disp8      .                 # push *(EBP+16)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x10/disp8      .                 # push *(EBP+16)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  scan-next-byte/disp32
     # . . discard args
@@ -167,9 +167,9 @@ convert-next-octet:  # in : (address buffered-file), err : (address buffered-fil
     89/copy                         3/mod/direct    1/rm32/ECX    .           .             .           0/r32/EAX   .               .                 # copy EAX to ECX
     # EAX = scan-next-byte(in, err, ed)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x10/disp8      .                 # push *(EBP+16)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x10/disp8      .                 # push *(EBP+16)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  scan-next-byte/disp32
     # . . discard args
@@ -181,8 +181,8 @@ convert-next-octet:  # in : (address buffered-file), err : (address buffered-fil
     # . . push args
     68/push  0x2e/imm32/period/dummy
     68/push  "convert-next-octet: partial byte found"/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x10/disp8      .                 # push *(EBP+16)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x10/disp8      .                 # push *(EBP+16)
     # . . call
     e8/call  error-byte/disp32  # never returns
 $convert-next-octet:convert:
@@ -508,7 +508,7 @@ scan-next-byte:  # in : (address buffered-file), err : (address buffered-file),
 $scan-next-byte:loop:
     # EAX = read-byte(in)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  read-byte/disp32
     # . . discard args
@@ -548,7 +548,7 @@ $scan-next-byte:check2:
     75/jump-if-not-equal  $scan-next-byte:check3/disp8
     # . skip-until-newline(in)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  skip-until-newline/disp32
     # . . discard args
@@ -559,8 +559,8 @@ $scan-next-byte:check3:
     # . . push args
     50/push-EAX
     68/push  "scan-next-byte: invalid byte"/imm32
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0x10/disp8      .                 # push *(EBP+16)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0x10/disp8      .                 # push *(EBP+16)
     # . . call
     e8/call  error-byte/disp32  # never returns
 $scan-next-byte:end:
@@ -1421,7 +1421,7 @@ is-hex-lowercase-byte?:  # c : byte -> bool/EAX
     # . save registers
     51/push-ECX
     # ECX = c
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           1/r32/ECX   8/disp8         .                 # copy *(EBP+8) to ECX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           1/r32/ECX   8/disp8         .                 # copy *(EBP+8) to ECX
     # return false if c < '0'
     b8/copy-to-EAX  0/imm32/false
     81          7/subop/compare     3/mod/direct    1/rm32/ECX    .           .             .           .           .               0x30/imm32        # compare ECX
@@ -1601,7 +1601,7 @@ skip-until-newline:  # in : (address buffered-file) -> <void>
 $skip-until-newline:loop:
     # . EAX = read-byte(in)
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  read-byte/disp32
     # . . discard args
diff --git a/subx/examples/ex10 b/subx/examples/ex10
index e6d8b3c4..9cdfb983 100755
--- a/subx/examples/ex10
+++ b/subx/examples/ex10
Binary files differdiff --git a/subx/examples/ex10.subx b/subx/examples/ex10.subx
index 9ac6d6cb..0b937fa5 100644
--- a/subx/examples/ex10.subx
+++ b/subx/examples/ex10.subx
@@ -22,9 +22,9 @@
     89/copy                         3/mod/direct    5/rm32/EBP    .           .             .           4/r32/ESP   .               .                 # copy ESP to EBP
     # argv-equal(argv[1], argv[2])
     # . . push argv[2]
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . push argv[1]
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call argv-equal/disp32
     # syscall(exit, EAX)
diff --git a/subx/examples/ex11 b/subx/examples/ex11
index f4329e00..cdabbf0a 100755
--- a/subx/examples/ex11
+++ b/subx/examples/ex11
Binary files differdiff --git a/subx/examples/ex11.subx b/subx/examples/ex11.subx
index 5acd5bf0..84ef43d9 100644
--- a/subx/examples/ex11.subx
+++ b/subx/examples/ex11.subx
@@ -53,12 +53,12 @@ kernel-string-equal:  # s : null-terminated ascii string, benchmark : length-pre
     #       return false
     #   return *s1 == 0
     # initialize s into EDI
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           7/r32/EDI   8/disp8         .                 # copy *(EBP+8) to EDI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           7/r32/EDI   8/disp8         .                 # copy *(EBP+8) to EDI
     # initialize benchmark length n into EDX
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           2/r32/EDX   0xc/disp8       .                 # copy *(EBP+12) to EDX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           2/r32/EDX   0xc/disp8       .                 # copy *(EBP+12) to EDX
     8b/copy                         0/mod/indirect  2/rm32/EDX    .           .             .           2/r32/EDX   .               .                 # copy *EDX to EDX
     # initialize benchmark data into ESI
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           6/r32/ESI   0xc/disp8       .                 # copy *(EBP+12) to ESI
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           6/r32/ESI   0xc/disp8       .                 # copy *(EBP+12) to ESI
     81          0/subop/add         3/mod/direct    6/rm32/ESI    .           .             .           .           .               4/imm32           # add to ESI
     # initialize loop counter i into ECX
     b9/copy-to-ECX  0/imm32/exit
@@ -261,8 +261,8 @@ check-ints-equal:  # (a : int, b : int, msg : (address array byte)) -> boolean
     51/push-ECX
     53/push-EBX
     # load args into EAX, EBX and ECX
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           0/r32/EAX   8/disp8         .                 # copy *(EBP+8) to EAX
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           3/r32/EBX   0xc/disp8       .                 # copy *(EBP+12) to EBX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           0/r32/EAX   8/disp8         .                 # copy *(EBP+8) to EAX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           3/r32/EBX   0xc/disp8       .                 # copy *(EBP+12) to EBX
     # if EAX == b/EBX print('.') and return
     39/compare                      3/mod/direct    0/rm32/EAX    .           .             .           3/r32/EBX   .               .                 # compare EAX and EBX
     75/jump-if-unequal  $check-ints-equal:else/disp8
@@ -278,7 +278,7 @@ check-ints-equal:  # (a : int, b : int, msg : (address array byte)) -> boolean
     # otherwise print(msg)
 $check-ints-equal:else:
     # copy msg into ECX
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           1/r32/ECX   0x10/disp8       .                # copy *(EBP+16) to ECX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           1/r32/ECX   0x10/disp8       .                # copy *(EBP+16) to ECX
     # print(ECX)
     # . . push args
     51/push-ECX
@@ -315,10 +315,10 @@ write-stderr:  # s : (address array byte) -> <void>
     # . . fd = 2 (stderr)
     bb/copy-to-EBX  2/imm32
     # . . x = s+4
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           1/r32/ECX   8/disp8         .                 # copy *(EBP+8) to ECX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           1/r32/ECX   8/disp8         .                 # copy *(EBP+8) to ECX
     81          0/subop/add         3/mod/direct    1/rm32/ECX    .           .             .           .           .               4/imm32           # add to ECX
     # . . size = *s
-    8b/copy                         1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           2/r32/EDX   8/disp8         .                 # copy *(EBP+8) to EDX
+    8b/copy                         1/mod/*+disp8   5/rm32/EBP    .           .             .           2/r32/EDX   8/disp8         .                 # copy *(EBP+8) to EDX
     8b/copy                         0/mod/indirect  2/rm32/EDX    .           .             .           2/r32/EDX   .               .                 # copy *EDX to EDX
     # . . syscall
     b8/copy-to-EAX  4/imm32/write
diff --git a/subx/examples/ex8 b/subx/examples/ex8
index dda61510..9a92bc7d 100755
--- a/subx/examples/ex8
+++ b/subx/examples/ex8
Binary files differdiff --git a/subx/examples/ex8.subx b/subx/examples/ex8.subx
index 75a77a50..d9234123 100644
--- a/subx/examples/ex8.subx
+++ b/subx/examples/ex8.subx
@@ -23,7 +23,7 @@
     89/copy                         3/mod/direct    5/rm32/EBP    .           .             .           4/r32/ESP   .               .                 # copy ESP to EBP
     # EAX = ascii-length(argv[1])
     # . . push args
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  ascii-length/disp32
     # . . discard args
diff --git a/subx/examples/ex9 b/subx/examples/ex9
index dc9c0e3c..ffbea21b 100755
--- a/subx/examples/ex9
+++ b/subx/examples/ex9
Binary files differdiff --git a/subx/examples/ex9.subx b/subx/examples/ex9.subx
index bc842e4b..b3a125ea 100644
--- a/subx/examples/ex9.subx
+++ b/subx/examples/ex9.subx
@@ -26,9 +26,9 @@
     89/copy                         3/mod/direct    5/rm32/EBP    .           .             .           4/r32/ESP   .               .                 # copy ESP to EBP
     # ascii-difference(argv[1], argv[2])
     # . . push argv[2]
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           0xc/disp8       .                 # push *(EBP+12)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           0xc/disp8       .                 # push *(EBP+12)
     # . . push argv[1]
-    ff          6/subop/push        1/mod/*+disp8   4/rm32/sib    5/base/EBP  4/index/none  .           .           8/disp8         .                 # push *(EBP+8)
+    ff          6/subop/push        1/mod/*+disp8   5/rm32/EBP    .           .             .           .           8/disp8         .                 # push *(EBP+8)
     # . . call
     e8/call  ascii-difference/disp32
     # . . discard args
diff --git a/subx/test_apps b/subx/test_apps
index edd2116b..4de0ce06 100755
--- a/subx/test_apps
+++ b/subx/test_apps
@@ -80,7 +80,7 @@ test `uname` = 'Linux'  &&  {
 
 echo ex8
 CFLAGS=-g ./subx translate examples/ex8.subx  -o examples/ex8
-git diff --quiet examples/ex8
+[ "$1" != record ]  && git diff --quiet examples/ex8
 CFLAGS=-g ./subx run examples/ex8 abcd  ||  ret=$?
 test $ret -eq 4  # length('abcd')
 test `uname` = 'Linux'  &&  {
@@ -90,7 +90,7 @@ test `uname` = 'Linux'  &&  {
 
 echo ex9
 CFLAGS=-g ./subx translate examples/ex9.subx  -o examples/ex9
-git diff --quiet examples/ex9
+[ "$1" != record ]  && git diff --quiet examples/ex9
 CFLAGS=-g ./subx run examples/ex9 z x  ||  ret=$?
 test $ret -eq 2  # 'z' - 'x'
 test `uname` = 'Linux'  &&  {
@@ -100,7 +100,7 @@ test `uname` = 'Linux'  &&  {
 
 echo ex10
 CFLAGS=-g ./subx translate examples/ex10.subx  -o examples/ex10
-git diff --quiet examples/ex10
+[ "$1" != record ]  && git diff --quiet examples/ex10
 CFLAGS=-g ./subx run examples/ex10 abc abc  ||  ret=$?
 test $ret -eq 1  # equal
 CFLAGS=-g ./subx run examples/ex10 abc abcd  # 0; not equal
@@ -112,7 +112,7 @@ test `uname` = 'Linux'  &&  {
 
 echo ex11
 CFLAGS=-g ./subx translate examples/ex11.subx  -o examples/ex11
-git diff --quiet examples/ex11
+[ "$1" != record ]  && git diff --quiet examples/ex11
 CFLAGS=-g ./subx run examples/ex11
 echo
 test `uname` = 'Linux'  &&  {
@@ -122,7 +122,7 @@ test `uname` = 'Linux'  &&  {
 
 echo ex12
 CFLAGS=-g ./subx translate examples/ex12.subx  -o examples/ex12
-git diff --quiet examples/ex12
+[ "$1" != record ]  && git diff --quiet examples/ex12
 CFLAGS=-g ./subx run examples/ex12  # final byte of mmap'd address is well-nigh guaranteed to be 0
 test `uname` = 'Linux'  &&  examples/ex12