x86-64

computer-architecture

Definition

x86-64

x86-64 (also called AMD64) is the 64-bit extension of the x86 instruction set, originally designed by AMD and adopted by Intel. It widens the general-purpose registers to 64 bits, adds the R8–R15 registers, and provides a 64-bit virtual address space while keeping backward compatibility with 32-bit x86 code. The slides’ binary-analysis crash course is written in x86-64 assembly.

General-Purpose Registers

Roles of the GPRs on x86-64

The eight original registers are extended to 64 bits (R prefix); their lower 32-bit (E), 16-bit (no prefix) and 8-bit (L/H) views are still addressable.

Register	Role
RAX	addition, multiplication, return values
RBX / RDX	various operations
RCX	loop counter
RBP	base pointer — references arguments and local variables of the current [[Knowledge/Stack Frame
RSP	stack pointer — top of the stack
RSI / RDI	source / destination for memory-transfer instructions (and argument passing, see below)
R8–R15	additional general-purpose registers

The 32-bit equivalents are EAX, EBX/EDX, ECX, EBP, ESP, ESI/EDI. See Calling Convention (x86-64) for RDI/RSI/RDX/RCX/R8/R9 as argument-passing registers.

Special-Purpose Registers

The two non-general registers a binary analyst watches

• RIP — the instruction pointer, holding the address of the next instruction to execute; jumps and calls overwrite it.
• RFLAGS — status flags that record the outcome of the previous computation and drive conditional branches. The three the lectures single out are:
  • ZF (zero flag) — set when the last result is zero;
  • CF (carry flag) — set when the result is too large for the destination width;
  • SF (sign flag) — set when the result is negative.

A cmp dst, src subtracts src from dst, updates ZF/CF/SF accordingly, and the subsequent conditional jump (e.g. jle) reads those flags to decide whether to jump.

Syntaxes

Obs

x86-64 assembly admits two operand orders. Intel syntax writes command dst, src and is more readable; AT&T syntax writes command src, dst (register names prefixed with %, immediates with $) and is the default of GNU tools like objdump. Disassemble in Intel flavour with objdump -M intel -d.