Skip to main content

Neo Virtual Machine Opcodes

Use this handy table to skip ahead to the opcode reference.

00010203040508090A0B0C0D0E0F
101112131415161718191A1B1C1D1E1F
202122232425262728292A2B2C2D2E2F
303132333435363738393A3B3C3D3E3F
404143454648494A4B4D4E
505152535455565758595A5B5C5D5E5F
606162636465666768696A6B6C6D6E6F
707172737475767778797A7B7C7D7E7F
808182838485868788898B8C8D8E
909192939798999A9B9C9D9E9F
A0A1A2A3A4A5A6A8A9AAABAC
B1B3B4B5B6B7B8B9BABBBEBF
C0C1C2C3C4C5C6C8CACBCCCDCECF
D0D1D2D3D4D8D9DB
E0E1

Overview#

This opcode set defines instructions for stack operations, compound-type handling, bitwise logic, arithmetic calculations, and more.

  • Constants

    Constants opcodes push constant values onto the stack. These include instructions for pushing integers of various sizes (e.g., signed integers from 1 byte to 32 bytes), with opcodes ranging from PUSHINT8 to PUSHINT256. Additionally, there are instructions for pushing Boolean values (PUSHT for true and PUSHF for false), pointers (PUSHA), null values (PUSHNULL), data blocks (PUSHDATA1 through PUSHDATA4), and fixed values (PUSHM1 through PUSH16) onto the stack.

  • Flow Control

    Flow control opcodes manage the program execution flow. They are typically used for conditional jumps, loops, and method calls, enabling the implementation of complex logic control.

  • Stack

    Stack opcodes handle data manipulation on the stack, supporting push, pop, duplicate, and swap operations. These are crucial for efficient data handling and transfer.

  • Slot

    The slot opcode manages local variable slots so that data can be stored or retrieved from specific slots, facilitating the management of local variables and parameters.

  • Splice

    The splice opcode handles splice, split, and extract operations on byte arrays and strings. These instructions can be used to merge multiple data chunks or extract portions of existing data.

  • Bitwise Logic

    Bitwise logical opcodes perform bitwise operations (e.g., AND, OR, XOR, NOT, etc.) commonly used in low-level data processing tasks, such as encryption and compression algorithms.

  • Arithmetic

    Arithmetic opcodes perform basic mathematical operations (e.g., addition, subtraction, multiplication, division), essential for data calculations and numerical processing.

  • Compound-Type

    Compound-type opcodes manipulate complex data types like arrays, structures, and custom types. These instructions are used to create, modify and destroy complex data types.

  • Types

    Type opcodes manage data type conversion and checking. They are used to determine the data type or convert one type to another.

  • Extensions

    Advanced operations with special effects.

OpCodes#

No.NameStack InputStack OutputExpressionDescriptions
00PUSHINT8-
a
-Pushes a 1-byte signed integer onto the stack.
01PUSHINT16-
a
-Pushes a 2-byte signed integer onto the stack.
02PUSHINT32-
a
-Pushes a 4-byte signed integer onto the stack.
03PUSHINT64-
a
-Pushes a 8-byte signed integer onto the stack.
04PUSHINT128-
a
-Pushes a 16-byte signed integer onto the stack.
05PUSHINT256-
a
-Pushes a 32-byte signed integer onto the stack.
08PUSHT-
true
-Pushes the boolean value true onto the stack.
09PUSHF-
false
-Pushes the boolean value false onto the stack.
0APUSHA-
Pointer
-Converts the 4-bytes offset to an Pointer, and pushes it onto the stack..
0BPUSHNULL-
null
-The item null is pushed onto the stack.
0CPUSHDATA1-
a
-The next byte contains the number of bytes to be pushed onto the stack.
0DPUSHDATA2-
a
-The next two bytes contain the number of bytes to be pushed onto the stack.
0EPUSHDATA4-
a
-The next four bytes contain the number of bytes to be pushed onto the stack.
0FPUSHM1-
-1
-The number -1 is pushed onto the stack.
10PUSH0-
0
-The number 0 is pushed onto the stack.
11PUSH1-
1
-The number 1 is pushed onto the stack.
12PUSH2-
2
-The number 2 is pushed onto the stack.
13PUSH3-
3
-The number 3 is pushed onto the stack.
14PUSH4-
4
-The number 4 is pushed onto the stack.
15PUSH5-
5
-The number 5 is pushed onto the stack.
16PUSH6-
6
-The number 6 is pushed onto the stack.
17PUSH7-
7
-The number 7 is pushed onto the stack.
18PUSH8-
8
-The number 8 is pushed onto the stack.
19PUSH9-
9
-The number 9 is pushed onto the stack.
1APUSH10-
10
-The number 10 is pushed onto the stack.
1BPUSH11-
11
-The number 11 is pushed onto the stack.
1CPUSH12-
12
-The number 12 is pushed onto the stack.
1DPUSH13-
13
-The number 13 is pushed onto the stack.
1EPUSH14-
14
-The number 14 is pushed onto the stack.
1FPUSH15-
15
-The number 15 is pushed onto the stack.
20PUSH16-
16
-The number 16 is pushed onto the stack.
21NOP---The NOP operation does nothing. It is intended to fill in space if opcodes are patched.
22JMP---Unconditionally transfers control to a target instruction. The target instruction is represented as a 1-byte signed offset from the beginning of the current instruction.
23JMP_L---Unconditionally transfers control to a target instruction. The target instruction is represented as a 4-bytes signed offset from the beginning of the current instruction.
24JMPIF
a
--Transfers control to a target instruction if the value is true, not null, or non-zero. The target instruction is represented as a 1-byte signed offset from the beginning of the current instruction.
25JMPIF_L
a
--Transfers control to a target instruction if the value is true, not null, or non-zero. The target instruction is represented as a 4-bytes signed offset from the beginning of the current instruction.
26JMPIFNOT
a
--Transfers control to a target instruction if the value is false, a null reference, or zero. The target instruction is represented as a 1-byte signed offset from the beginning of the current instruction.
27JMPIFNOT_L
a
--Transfers control to a target instruction if the value is false, a null reference, or zero. The target instruction is represented as a 4-bytes signed offset from the beginning of the current instruction.
28JMPEQ
ba
--Transfers control to a target instruction if two values are equal. The target instruction is represented as a 1-byte signed offset from the beginning of the current instruction.
29JMPEQ_L
ba
--Transfers control to a target instruction if two values are equal. The target instruction is represented as a 4-bytes signed offset from the beginning of the current instruction.
2AJMPNE
ba
--Transfers control to a target instruction when two values are not equal. The target instruction is represented as a 1-byte signed offset from the beginning of the current instruction.
2BJMPNE_L
ba
--Transfers control to a target instruction when two values are not equal. The target instruction is represented as a 4-bytes signed offset from the beginning of the current instruction.
2CJMPGT
ba
--Transfers control to a target instruction if the first value is greater than the second value. The target instruction is represented as a 1-byte signed offset from the beginning of the current instruction.
2DJMPGT_L
ba
--Transfers control to a target instruction if the first value is greater than the second value. The target instruction is represented as a 4-bytes signed offset from the beginning of the current instruction.
2EJMPGE
ba
--Transfers control to a target instruction if the first value is greater than or equal to the second value. The target instruction is represented as a 1-byte signed offset from the beginning of the current instruction.
2FJMPGE_L
ba
--Transfers control to a target instruction if the first value is greater than or equal to the second value. The target instruction is represented as a 4-bytes signed offset from the beginning of the current instruction.
30JMPLT
ba
--Transfers control to a target instruction if the first value is less than the second value. The target instruction is represented as a 1-byte signed offset from the beginning of the current instruction.
31JMPLT_L
ba
--Transfers control to a target instruction if the first value is less than the second value. The target instruction is represented as a 4-bytes signed offset from the beginning of the current instruction.
32JMPLE
ba
--Transfers control to a target instruction if the first value is less than or equal to the second value. The target instruction is represented as a 1-byte signed offset from the beginning of the current instruction.
33JMPLE_L
ba
--Transfers control to a target instruction if the first value is less than or equal to the second value. The target instruction is represented as a 4-bytes signed offset from the beginning of the current instruction.
34CALL---Calls the function at the target address which is represented as a 1-byte signed offset from the beginning of the current instruction.
35CALL_L---Calls the function at the target address which is represented as a 4-bytes signed offset from the beginning of the current instruction.
36CALLA---Pop the address of a function from the stack, and call the function.
37CALLT---Calls the function which is described by the token.
38ABORT---It turns the vm state to FAULT immediately, and cannot be caught.
39ASSERT
a
--Pop the top value of the stack. If it's false, exit vm execution and set vm state to FAULT.
3ATHROW
a
--Pop the top value of the stack, and throw it.
3BTRY---TRY CatchOffset(sbyte) FinallyOffset(sbyte). If there's no catch body, set CatchOffset 0. If there's no finally body, set FinallyOffset 0.
3CTRY_L---TRY_L CatchOffset(int) FinallyOffset(int). If there's no catch body, set CatchOffset 0. If there's no finally body, set FinallyOffset 0.
3DENDTRY---Ensures that the appropriate surrounding finally blocks are executed. And then unconditionally transfers control to the specific target instruction, represented as a 1-byte signed offset from the beginning of the current instruction.
3EENDTRY_L---Ensures that the appropriate surrounding finally blocks are executed. And then unconditionally transfers control to the specific target instruction, represented as a 4-byte signed offset from the beginning of the current instruction.
3FENDFINALLY---End finally, If no exception happen or be catched, vm will jump to the target instruction of ENDTRY/ENDTRY_L. Otherwise, vm will rethrow the exception to upper layer.
40RET---Returns from the current method.
41SYSCALL---Calls to an interop service.
43DEPTH-
a
-Puts the number of stack items onto the stack.
45DROP
abc
ab
-Removes the top stack item.
46NIP
abc
ac
-Removes the second-to-top stack item.
48XDROP
-
--The item n back in the main stack is removed.
49CLEAR
-
--Clear the stack
4ADUP
abc
abcc
-Duplicates the top stack item.
4BOVER
abc
abcb
-Copies the second-to-top stack item to the top.
4DPICK
anb
anbn
-The item n back in the stack is copied to the top.
4ETUCK
abc
abcc
-The item at the top of the stack is copied and inserted before the second-to-top item.
50SWAP
ab
ba
-The top two items on the stack are swapped.
51ROT
abc
bca
-The top three items on the stack are rotated to the left.
52ROLL
anc
acn
-The item n back in the stack is moved to the top.
53REVERSE3
abc
cba
-Reverse the order of the top 3 items on the stack.
54REVERSE4
abcd
dcba
-Reverse the order of the top 4 items on the stack.
55REVERSEN
nba
abn
-Pop the number N on the stack, and reverse the order of the top N items on the stack.
56INITSSLOT---Initialize the static field list for the current execution context.
57INITSLOT---Initialize the argument slot and the local variable list for the current execution context.
58LDSFLD0-
a
-Loads the static field at index 0 onto the evaluation stack.
59LDSFLD1-
a
-Loads the static field at index 1 onto the evaluation stack.
5ALDSFLD2-
a
-Loads the static field at index 2 onto the evaluation stack.
5BLDSFLD3-
a
-Loads the static field at index 3 onto the evaluation stack.
5CLDSFLD4-
a
-Loads the static field at index 4 onto the evaluation stack.
5DLDSFLD5-
a
-Loads the static field at index 5 onto the evaluation stack.
5ELDSFLD6-
a
-Loads the static field at index 6 onto the evaluation stack.
5FLDSFLD-
a
-Loads the static field at a specified index onto the evaluation stack. The index is represented as a 1-byte unsigned integer.
60STSFLD0
-a
-
-Stores the value on top of the evaluation stack in the static field list at index 0.
61STSFLD1
-a-
--
-Stores the value on top of the evaluation stack in the static field list at index 1.
62STSFLD2
-a-
--
-Stores the value on top of the evaluation stack in the static field list at index 2.
63STSFLD3
-a-
--
-Stores the value on top of the evaluation stack in the static field list at index 0.
64STSFLD4
-a-
--
-Stores the value on top of the evaluation stack in the static field list at index 4.
65STSFLD5
-a-
--
-Stores the value on top of the evaluation stack in the static field list at index 5.
66STSFLD6
-a-
--
-Stores the value on top of the evaluation stack in the static field list at index 6.
67STSFLD
-a-
--
-Stores the value on top of the evaluation stack in the static field list at a specified index. The index is represented as a 1-byte unsigned integer.
68LDLOC0-
a
-Loads the local variable at index 0 onto the evaluation stack.
69LDLOC1-
a
-Loads the local variable at index 1 onto the evaluation stack.
6ALDLOC2-
a
-Loads the local variable at index 2 onto the evaluation stack.
6BLDLOC3-
a
-Loads the local variable at index 3 onto the evaluation stack.
6CLDLOC4-
a
-Loads the local variable at index 4 onto the evaluation stack.
6DLDLOC5-
a
-Loads the local variable at index 5 onto the evaluation stack.
6ELDLOC6-
a
-Loads the local variable at index 7 onto the evaluation stack.
6FLDLOC-
a
-Loads the local variable at a specified index onto the evaluation stack. The index is represented as a 1-byte unsigned integer.
70STLOC0-
a
-Stores the value on top of the evaluation stack in the local variable list at index 0.
71STLOC1-
-a-
-Stores the value on top of the evaluation stack in the local variable list at index 1.
72STLOC2-
-a-
-Stores the value on top of the evaluation stack in the local variable list at index 2.
73STLOC3-
-a-
-Stores the value on top of the evaluation stack in the local variable list at index 3.
74STLOC4-
-a-
-Stores the value on top of the evaluation stack in the local variable list at index 4.
75STLOC5-
-a-
-Stores the value on top of the evaluation stack in the local variable list at index 5.
76STLOC6-
-a-
-Stores the value on top of the evaluation stack in the local variable list at index 6.
77STLOC-
-a-
-Stores the value on top of the evaluation stack in the local variable list at a specified index. The index is represented as a 1-byte unsigned integer.
78LDARG0-
a
-Loads the argument at index 0 onto the evaluation stack.
79LDARG1-
a
-Loads the argument at index 1 onto the evaluation stack.
7ALDARG2-
a
-Loads the argument at index 2 onto the evaluation stack.
7BLDARG3-
a
-Loads the argument at index 3 onto the evaluation stack.
7CLDARG4-
a
-Loads the argument at index 4 onto the evaluation stack.
7DLDARG5-
a
-Loads the argument at index 5 onto the evaluation stack.
7ELDARG6-
a
-Loads the argument at index 6 onto the evaluation stack.
7FLDARG-
a
-Loads the argument at a specified index onto the evaluation stack. The index is represented as a 1-byte unsigned integer.
80STARG0
a
--Stores the value on top of the evaluation stack in the argument slot at index 0.
81STARG1
-a-
--Stores the value on top of the evaluation stack in the argument slot at index 1.
82STARG2
-a-
--Stores the value on top of the evaluation stack in the argument slot at index 2.
83STARG3
-a-
--Stores the value on top of the evaluation stack in the argument slot at index 3.
84STARG4
-a-
--Stores the value on top of the evaluation stack in the argument slot at index 4.
85STARG5
-a-
--Stores the value on top of the evaluation stack in the argument slot at index 5.
86STARG6
-a-
--Stores the value on top of the evaluation stack in the argument slot at index 6.
87STARG
-a-
--Stores the value on top of the evaluation stack in the argument slot at a specified index. The index is represented as a 1-byte unsigned integer.
88NEWBUFFER-
a
new Buffer(a)Creates a new Buffer and pushes it onto the stack.
89MEMCPY
edcba
-c.Slice(d, e).CopyTo(a.InnerBuffer.Span[b..])Copies a range of bytes from one Buffer to another. Using this opcode will require to dup the destination buffer.
8BCAT
ba
a.Concat(b)
a.Concat(b)Concatenates two strings.
8CSUBSTR
cba
a.Slice(b, c)
a.Slice(b, c)Concatenates two strings.
8DLEFT
ba
a[..b]
a[..b]Keeps only characters left of the specified point in a string.
8ERIGHT
ba
a[^b]
a[^b]Keeps only characters right of the specified point in a string.
90INVERT
a
~a
~aFlips all the bits in the input.
91AND
ba
a&b
a&bBoolean and between each bit in the inputs.
92OR
ba
a|b
a|bBoolean or between each bit in the inputs.
93XOR
ba
a^b
a^bBoolean exclusive or between each bit in the inputs.
97EQUAL
ba
a.Equals(b)
a.Equals(b)Returns 1 if the inputs are exactly equal, 0 otherwise.
98NOTEQUAL
ba
!a.Equals(b)
!a.Equals(b)Returns 1 if the inputs are not equal, 0 otherwise.
99SIGN
a
a.Sign
a.SignPuts the sign of top stack item on top of the main stack. If value is negative, put -1; if positive, put 1; if value is zero, put 0.
9AABS
a
abs(a)
abs(a)The input is made positive.
9BNEGATE
a
-a
-aThe sign of the input is flipped.
9CINC
a
a+1
a+11 is added to the input.
9DDEC
a
a-1
a-11 is subtracted from the input.
9EADD
ba
a+b
a+ba is added to b.
9FSUB
ba
a-b
a-bb is subtracted from a.
A0MUL
ba
a*b
a*ba is multiplied by b.
A1DIV
ba
a/b
a/ba is divided by b.
A2MOD
ba
a%b
a%bReturns the remainder after dividing a by b.
A3POW
ba
a^b
a^bThe result of raising value to the exponent power.
A4SQRT
a
sqrt(a)
sqrt(a)Returns the square root of a specified number.
A5MODMUL
cba
a*b%c
a*b%cPerforms modulus division on a number multiplied by another number.
A6MODPOW
cba
modpow(a, b, c)
modpow(a, b, c)Performs modulus division on a number raised to the power of another number. If the exponent is -1, it will have the calculation of the modular inverse.
A8SHL
ba
a << b
a << bShifts a left b bits, preserving sign.
A9SHR
ba
a >> b
a << bShifts a right b bits, preserving sign.
AANOT
a
!a
!aIf the input is 0 or 1, it is flipped. Otherwise, the output will be 0.
ABBOOLAND
ba
a && b
a && bIf both a and b are not 0, the output is 1. Otherwise, 0.
ACBOOLOR
ba
a || b
a || bIf a or b is not 0, the output is 1. Otherwise, 0.
B1NZ
a
a != 0
a != 0If a or b is not 0, the output is 1. Otherwise, 0.
B3NUMEQUAL
ba
b == a
b == aReturns 1 if the numbers are equal, 0 otherwise.
B4NUMNOTEQUAL
ba
b != a
b != aReturns 1 if the numbers are not equal, 0 otherwise.
B5LT
ba
a < b
a < bReturns 1 if a is less than b, 0 otherwise.
B6LE
ba
a ≤ b
a <= bReturns 1 if a is less than or equal to b, 0 otherwise.
B7GT
ba
a > b
a > bReturns 1 if a is greater than b, 0 otherwise.
B8GE
ba
a ≥ b
a >= bReturns 1 if a is greater than or equal to b, 0 otherwise.
B9MIN
ba
min(a, b)
-Returns the smallest of a and b.
BAMAX
ba
max(a, b)
-Returns the largest of a and b.
BBWITHIN
bax
a ≤ x < b
-Returns 1 if x is within the specified range (left-inclusive), 0 otherwise.
BEPACKMAP
item...item
map
-A value n is taken from top of main stack. The next n*2 items on main stack are removed, put inside n-sized map and this map is put on top of the main stack.
BFPACKSTRUCT
item...item
struct
-A value n is taken from top of main stack. The next n items on main stack are removed, put inside n-sized struct and this struct is put on top of the main stack.
C0PACK
item...item
array
-A value n is taken from top of main stack. The next n items on main stack are removed, put inside n-sized array and this array is put on top of the main stack.
C1UNPACK
collection
item...item
-A collection is removed from top of the main stack. Its elements are put on top of the main stack (in reverse order) and the collection size is also put on main stack.
C2NEWARRAY0-
new Array[0]
-An empty array (with size 0) is put on top of the main stack.
C3NEWARRAY
n
new Array\[n\]
-A value n is taken from top of main stack. A null-filled array with size n is put on top of the main stack.
C4NEWARRAY_T
T
new T\[n\]
-A value n is taken from top of main stack. An array of type T with size n is put on top of the main stack.
C5NEWSTRUCT0-
empty struct
-An empty struct (with size 0) is put on top of the main stack.
C6NEWSTRUCT
n
zero-filled struct with size n
-A value n is taken from top of main stack. A zero-filled struct with size n is put on top of the main stack.
C8NEWMAP-
new Map()
-A Map is created and put on top of the main stack.
CASIZE
a
sizeof(a)
-An array is removed from top of the main stack. Its size is put on top of the main stack.
CBHASKEY
arrayn
True/False
-An input index n (or key) and an array (or map) are removed from the top of the main stack. Puts True on top of main stack if array\[n\] (or map\[n\]) exist, and False otherwise.
CCKEYS
map
keys
-A map is taken from top of the main stack. The keys of this map are put on top of the main stack.
CDVALUES
map
values
-A map is taken from top of the main stack. The values of this map are put on top of the main stack.
CEPICKITEM
arrayn
array\[n\]
-An input index n (or key) and an array (or map) are taken from main stack. Element array\[n\] (or map\[n\]) is put on top of the main stack.
CFAPPEND
ba
a.concat(b)
-The item on top of main stack is removed and appended to the second item on top of the main stack.
D0SETITEM
arraynv
array (array\[n\]=v)
-A value v, index n (or key) and an array (or map) are taken from main stack. Attribution array\[n\]=v (or map\[n\]=v) is performed.
D1REVERSEITEMS
array
--An array is removed from the top of the main stack and its elements are reversed.
D2REMOVE
arrayn
--An input index n (or key) and an array (or map) are removed from the top of the main stack. Element array\[n\] (or map\[n\]) is removed.
D3CLEARITEMS
items
--Remove all the items from the compound-type.
D4POPITEM
array
array[i]
-Remove the last element from an array, and push it onto the stack.
D8ISNULL
a
a == null
-Returns true if the input is null;
D9ISTYPE
a
a is T
-Returns true if the top item of the stack is of the specified type;
DBCONVERT
a
(T)a
-Converts the top item of the stack to the specified type.
E0ABORTMSG
a
--Pops the top stack item. Then, turns the vm state to FAULT immediately, and cannot be caught. The top stack
E1ASSERTMSG
ba
--Pops the top two stack items. If the second-to-top stack value is false, exits the vm execution and sets the vm state to FAULT. In this case, the top stack value is used as reason for the exit. Otherwise, it is ignored.

Reference#

Definition of OpCodes in Neo https://github.com/neo-project/neo/blob/master/src/Neo.VM/OpCode.cs

OpCodes implementation in NeoVM: https://github.com/neo-project/neo/tree/master/src/Neo.VM/JumpTable