Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340

Warning: preg_replace(): Compilation failed: invalid range in character class at offset 4 in /homepages/6/d727453692/htdocs/clickandbuilds/OhExFortyOne/wp-content/plugins/crayon-syntax-highlighter/crayon_langs.class.php on line 340
x64 ASM Fundamentals 0x01 – Registers and CPU Flags – OhExFortyOne

x64 ASM Fundamentals 0x01 – Registers and CPU Flags

Introduction

This post will be a quick whistle-stop tour of the following two concepts –

  • Registers (variables!)
  • CPU Flags

A lot of material is going to be covered in the next few sections – read it over a few times until it makes sense, and if it still doesn’t make sense then leave a comment below / hit me up on Twitter and I’ll try and lend a hand. 

What are registers?

Basically, a register is an area of storage in the CPU which can (in the majority of cases) be used to hold any piece of data you please.

This includes, but is not limited to – 

  • Small numbers (e.g 0x1, 0x2, 0x41)
  • Big numbers (e.g 0x0123456789abcdef)
  • Addresses in RAM (e.g 0x55555555464e)
  • booleans (e.g 0x0, 0xFF)
  • Characters (e.g 0x41534d344c494645 # bonus points for finding out what that is)

Registers are analogous to variables in high level programming languages, except they map to an area of storage in the CPU, whereas variables reside in RAM.

OK, but what ARE registers?

On 64 bit intel CPUs, the (everyday, normal, non-scary-and-weird) registers can be seen in the table below. All of these registers are 64 bits (8 bytes) wide, which is to say that they can accommodate an 8 byte value.

All of the CPU registers below are readable and writable, with the exception of the RIP register which the CPU is responsible for managing.

NAME“PURPOSE”
RAXThe “Accumulator”. Multi-purpose, nowadays
RBXThe “Base”. Multi-purpose, nowadays
RCXThe “Counter”. Used to be used to hold the current iteration of a loop, for example. Multi-purpose, nowadays
RDXThe “Data” register. Multi-purpose, with a caveat which we’ll cover in a future post
RDIMulti-purpose, with a caveat which we’ll cover in a future post
RSIMulti-purpose, with a caveat which we’ll cover in a future post
R8Multi-purpose, with a caveat which we’ll cover in a future post
R9Multi-purpose, with a caveat which we’ll cover in a future post
R10Multi-purpose, with a caveat which we’ll cover in a future post
R11Multi-purpose
R12Multi-purpose
R13Multi-purpose
R14Multi-purpose
R15Multi-purpose
RBPThe Base Pointer. This register stores the address of the beginning of the current stack frame. This will be explained in more detail shortly.
RSPThe Stack Pointer. This register stores the address of the current top of the stack. This will be explained in more detail shortly.
RIPThe Instruction Pointer. This register stores the address of the instruction which the CPU is executing at any one time.

There are other registers, which are used for handling phenominally large (or small!) floating point numbers. In the interest of not blowing your swede to pieces (🤯🤯🤯), I’m going to skip over those for now. They’re not massively important to the process of learning the basics of x64 assembly anyway.

What are those funny “R” prefixes on the register names?

EXCELLENT observation, reader.

The “R” signifies that the register is 64 bits wide.

Each of the named registers above (all of them except for R8 – R15) can actually be addressed in an alternative way as well. It’s possible to address only the “low” 32 bits, the “low” 16 bits of those “low” 32 bits, the “high” 8 bits of the “low” 16 bits and the “low” 8 bits of those “low” 16 bits.

That sounds absolutely insane when I write it out, so here’s an example to make it a bit less scary

64 BITsLOW 32 BITSLOW 16 BITSHIGH 8 BITSLOW 8 BITS
RAXEAXAXAHAL
RBXEBXBXBHBL
RCXECXCXCHCL
RDXEDXDXDHDL
RDIEDIDI
RSIESISI
RBPEBPBP
RSPESPSP
RIPEIPIP

See how the convention is very predictable and easy to understand? 

RIDICULOUSLY-Extended AX -> Extended AX -> AX -> A HIGH and A LOW

Another example, to really solidify what this means. Imagine that the RAX register contained 0xcafebabebadf00d.

EAX, the bottom 32 bits, would contain 0xbadf00d.

AX, the bottom 16 bits, would contain 0xf00d.

AH, the high 8 bits of AX, would contain 0xf0.

AL, the low 8 bits of AX, would contain 0x0d.

The same is true for the other registers outlined above. 

This part is important. Make sure that you understand.

What are CPU Flags?

There is a special register called the EFLAGS register, which is reserved for use by the CPU.

This register is managed by the CPU, and is used to track the outcome of certain instructions.

The EFLAGS register is 32bits wide, with each individual bit being used as a boolean for a particular flag. For example, bit number 6 is the Zero Flag, the Zero flag is set to 1 if the CPU has determined that the next conditional jump operation is going to be taken, and the Zero Flag will be set to 0 if the CPU has determined that the next conditional jump won’t be taken.

As a fledgling ASM writer or reverse engineer, you won’t need to mess with the EFLAGS register too often, but it’s worth knowing what the fields are and when they’re set.

Refer to this page for some extra information about the flags register, but don’t worry too much if it goes over your head for now. That’s normal.

Closing Thoughts

This was a load of theory. I realise that theory is dry and without concrete examples then it’s hard to make any of it stick. In the next post we’re going to write some sweet, sweet 64 bit assembly and actually USE some of these registers / see them in action.

Stay tuned. Thanks for reading.

One Comment

Add a Comment

Your email address will not be published. Required fields are marked *