Assembly Guide — x86-64 Architecture and Registers

In this tutorial, you will learn about Assembly Guide. We cover key concepts, practical examples, and best practices to help you master this topic.

x86-64 architecture uses 16 general-purpose registers, a flags register, and an instruction pointer register, providing the foundation for all assembly language programming.

What You'll Learn

• General-purpose registers: RAX through R15
• Special registers: RIP, RFLAGS
• Register size variants (AL, AX, EAX, RAX)
• Calling conventions with registers
• Memory addressing modes

Why It Matters

Registers are the fastest storage in the CPU. Understanding registers is essential for performance-critical code and reverse engineering. Durga Antivirus Pro uses assembly knowledge for malware analysis.

Real-World Use

Operating system kernels, Embedded Systems, game engines, and security tools require register-level understanding.

flowchart LR
    A["Registers"] --> B["GPRs"]
    B --> C["Special"]
    C --> D["Sizes"]
    D --> E["Conventions"]
    A:::current --> B
    style A fill:#2563eb,stroke:#2563eb,color:#fff
    style B fill:#dbeafe,stroke:#2563eb,color:#1e40af
    style C fill:#dbeafe,stroke:#2563eb,color:#1e40af
    style D fill:#dbeafe,stroke:#2563eb,color:#1e40af
    style E fill:#f1f5f9,stroke:#94a3b8,color:#64748b

General-Purpose Registers

; 16 GPRs in x86-64
; RAX, RBX, RCX, RDX
; RSI, RDI, RBP, RSP
; R8 through R15

; RAX: Accumulator (return values)
; RBX: Base (callee-saved)
; RCX: Counter (loop counter)
; RDX: Data (I/O operations)

Register Size Variants

; 64-bit:  RAX, RBX, RCX, RDX
; 32-bit:  EAX, EBX, ECX, EDX
; 16-bit:  AX,  BX,  CX,  DX
; 8-bit:   AL,  BL,  CL,  DL

; Example:
mov rax, 0xFFFFFFFFFFFFFFFF  ; 64-bit
mov eax, 0xFFFFFFFF           ; 32-bit
mov ax, 0xFFFF               ; 16-bit
mov al, 0xFF                 ; 8-bit

; Writing to EAX zero-extends to RAX
; Writing to AX does not affect upper bits

Special Registers

; RIP: Instruction Pointer
; Points to next instruction to execute
; Cannot be directly modified

; RFLAGS: Status Flags
; CF: Carry Flag
; ZF: Zero Flag
; SF: Sign Flag
; OF: Overflow Flag

; Segment registers (mostly legacy)
; CS, DS, ES, FS, GS, SS

Calling Convention Registers

; System V AMD64 ABI (Linux, macOS)
; Arguments (left to right):
; RDI, RSI, RDX, RCX, R8, R9
; Return value: RAX

; Callee-saved (must preserve):
; RBX, RBP, R12-R15
; Caller-saved (can freely use):
; RAX, RCX, RDX, RSI, RDI, R8-R11

Stack Pointer

; RSP: Stack Pointer
; Points to top of stack
; Grows downward

; Push: RSP -= 8, [RSP] = value
push rax

; Pop: value = [RSP], RSP += 8
pop rax

; Stack alignment: RSP % 16 == 0 at function calls
sub rsp, 8  ; Align stack

RFLAGS in Detail

; Common flags after operations:
; ZF: Zero Flag - set if result is zero
; SF: Sign Flag - set if result is negative
; CF: Carry Flag - set if unsigned overflow
; OF: Overflow Flag - set if signed overflow

; Example:
mov rax, 5
sub rax, 5   ; ZF = 1 (result is 0)

mov rax, 10
sub rax, 15  ; SF = 1 (result is negative)
             ; CF = 1 (borrow occurred)

Common Mistakes

1. Assuming register size

Writing to EAX zero-extends to RAX on x86-64. Writing to AX or AL does not. This causes subtle bugs.

2. Not preserving callee-saved registers

If a function modifies RBX, RBP, or R12-R15, it must restore them before returning.

3. Wrong argument registers

System V uses RDI, RSI, RDX, RCX, R8, R9. Windows uses RCX, RDX, R8, R9.

4. Stack alignment

The ABI requires 16-byte stack alignment at function call boundaries. Misalignment causes crashes.

5. RFLAGS side effects

Most instructions modify flags. Don't assume flags survive across unrelated instructions.

Practice Questions

1. How many general-purpose registers does x86-64 have? 16 GPRs: RAX-RDX, RSI, RDI, RBP, RSP, and R8-R15.

2. What is the difference between RAX and EAX? EAX is the lower 32 bits of RAX. Writing to EAX zero-extends to RAX on x86-64.

3. Which registers must be preserved by a function? RBX, RBP, RSP, and R12-R15 are callee-saved. The function must restore their original values.

Challenge: Write an assembly function that takes two arguments and returns their sum, using the correct calling convention.

FAQ

{{< faq question="What is RIP used for?" >} RIP (Instruction Pointer) holds the address of the next instruction. Used for position-independent code and relative addressing. {{< /faq >}}

{{< faq question="Can I use RSP as a general-purpose register?" >} Technically yes, but it breaks stack operations. Use RSP only for stack management. {{< /faq >}}

{{< faq question="What is the difference between Windows and Linux calling conventions?" >} Windows uses RCX, RDX, R8, R9 for arguments. Linux uses RDI, RSI, RDX, RCX, R8, R9. {{< /faq >}}

{{< faq question="Are 32-bit registers faster than 64-bit?" >} On modern CPUs, there is no significant speed difference. Use the appropriate size for your data. {{< /faq >}}

{{< faq question="What is the red zone?" >} The 128 bytes below RSP that can be used without adjusting RSP. Only in user-space code. Not available in kernel. {{< /faq >}}

Mini Project

Write a function that uses registers correctly:

; Function: long sum(long a, long b, long c)
; Args: RDI=a, RSI=b, RDX=c
; Return: RAX = a + b + c

sum:
    mov rax, rdi      ; RAX = a
    add rax, rsi      ; RAX += b
    add rax, rdx      ; RAX += c
    ret

What's Next

Now that you understand registers, explore memory addressing and data access.