PROWAREtech

x86-64 Assembly: Tutorial - A Quick Guide to the Changes in 64-bit Assembly - Page 1

Be familiar with x86 assembly as the differences between x86 and x64 assembly are minor.

The x64 Registers

All of the new x64 registers begin with "r" and are all 64-bit or QWORD (quad-word) values.

These are rax, rbx, rcx and rdx all of which extend the x86 registers eax, ebx, ecx and edx, respectively. By manipulating eax, the first 32-bits of rax are modified, just like ax manipulates the first 16-bits of eax.

rax
				eax
						ax
						ah	al
*RAX register diagram

rbx
				ebx
						bx
						bh	bl
*RBX register diagram

rcx
				ecx
						cx
						ch	cl
*RCX register diagram

rdx
				edx
						dx
						dh	dl
*RDX register diagram

There is also the 64-bit registers rsi, rdi, rbp and rsp. The hardest part about moving to x64 assembly from x86 assembly is getting used to the these new names. Otherwise, x64 is simplier than x86 thanks to all the new 64-bit registers.

The All New x64 Registers

Because programmers writing complex assembly programs had to juggle the limited number of x86 registers, the x64 designers decided to add eight new general purpose 64-bit registers: r8, r9, r10, r11, r12, r13, r14 and r15.

This makes programming complex programs in x64 considerably easier than in x86.

These new registers have easy access to the first DWORD, WORD and BYTE values (the first 32-, 16- and 8-bits) with the registers r8d, r8w and r8b, for example.

r8
				r8d
						r8w
							r8b
*R8 register diagram

r9
				r9d
						r9w
							r9b
*R9 register diagram

r10
				r10d
						r10w
							r10b
*R10 register diagram

r11
				r11d
						r11w
							r11b
*R11 register diagram

Changes in x64 Registers

The segment registers ds, es and ss were removed in x64. This is because x64 always uses the flat memory model so all these segments exist in the same segment (this is one reason 16-bit applications cannot run on x64 operating systems). The segment registers cs, fs and gs still exist.

The flags register is now a QWORD so there are new instructions to pop and push the value on the stack: PUSHFQ and POPFQ. The 16-bit PUSHF and POPF instructions can still be used, but not PUSHFD and POPFD.

Only 16- and 64-bit register values may be pushed onto the stack.

push al  ; cannot do this
push ax  ; okay
push eax ; cannot do this
push rax ; okay

The stack, or RSP register, is misaligned when it's not divisible by 4. If it's hexadecimal address does not end with a 0, 4, 8 or C then it is misaligned, which hampers performance when pushing and popping values.

---