• Table Of Content

Basics

Register

<aside> 👉 General purpose registers

</aside>

Due to various design decisions made during the design of x86_64, accessing EAX would wipe out the upper 32-bits of the RAX register (and all other GPRs)

• RAX is the accumulator register and used to store operands and data, it’s the most common register which is used in operations.

• RBX is the base register, and points to data

• RCX is the counter register, and is useful in loop operations

• RDX is the data register and acts as an I/O pointer

• RSI and EDI are used as data pointer registers for memory locations

• RSP is the Stack Pointer Register and used for stack manipulation, points to the top of the stack.

• RBP is the Stack Data Pointer Register, and is used to distinguish stack frames from one another.

• There are 16 general purpose registers in the x86_64 ISA

• GPR RAX, RBX, RCX, and RDX are of 64-bytes each, and their lower 32-bits can be accessed by EAX, EBX, ECX, EDX, and their lower 16-bits can be accessed by AX, BX, CX and DX and their lower and upper halves can be accessed by AL, BL, CL, DL and AH, BH, CH, DH respectively.

• GPR RSI, RDI, RBP and RSPare 64-bits in size, and their lower 32-bits can be accessed by ESI, EDI, EBP, ESP, and their lower 16-bits can be accessed by SI, DI, BP, SP and their lower 8- bits can be accessed by SIL, DIL, BPL and SPL.
• There are other 8 GPR, named from R8 - R15. The whole 64-bits can be accessed via R8, the lower 32-bits via R8D (double word), the lower 16-bits via R8W (R8-word), and further lower 8-bits via R8B (R8-byte)

<aside> 👉 RFLAGS registers

</aside>

All the flags are same as that in x86 ISA, the only difference being there are reserved 32 bits at the start.

<aside> 👉 Instruction pointer

</aside>

The instruction registers (or instruction pointer) is 64-bits in size RIP.

Invoking syscalls

• We can check the syscall numbers in the /usr/include/x86_64-linux-gnu/asm/unistd_64.h header file.
• We pass the syscall number in the accumulator RAX, and the arguments into RDI, RSI, RDX, R10, R8 and R9 according to the need, and then finally invoke the syscall instruction.

Fundamental data types

Special tokens

$
;;Evaluate to the current line

$$
;;Evaluate to the beginning of the current line

Basic instruction set

Data initialisation