I’m pretty good at learning x86_64 assembly. I’ve done it more times than I can count. But now I’ve reached the point where I would like to stop learning assembly, and just have a good reference for assembly. But I couldn’t find one, so I made a reference for assembly.
This reference is a work in progress, and will be continuously updated as I find myself looking up stuff.
General Purpose Registers
The following are the “general purpose” registers for x86_64. The calling convention describes the convention for *nix systems. All registers not denoted “Callee Saved” are caller saved, if required.
|rbp||ebp||bp||bpl||Base Pointer (Callee Saved)|
|rsp||esp||sp||spl||Stack Pointer (Callee Saved)|
The rFlags register is a special register that contains information about the status of, amongst other things, arithmetic operations. It is used a lot in, for instance, control flow operations. Many of them are “system registers”, which I haven’t had a reason to care about yet, and therefore are not included.
|4||AF||Auxilary Carry Flag|
If the last integer operation has resulted in a carry on the most significant bit, the value of this flag is set to 1. Otherwise, it is set to zero. On subtraction, it is set to one in the case of a borrow.
It is not changed by increment, decrement. Bit shifting shift into the carry flag.
If the last arithmetic operation resulted in zero, this flag is set to one, otherwise it is set to zero.
This flag is also set by the
These instructions sign extend
First of all,
mov is Turing-complete.
So keep this in mind before stepping into this particular hell.
zxaffix means that the
movdoes sign extension
jmpge, etc. are computed based on the information in rFlags.
jmple can be computed by combining the information from the carry flag and the zero flag.
jmpge are mnemonics for “jump less than or equal” and “jump greater than or equal”, there are also
jmpae and friends, which treat the operands as unsigned numbers.
Syscalls are how programs interact with the kernel.
Syscalls have their own calling convention, separate from procedure calls.
Each syscall has its own number, which is put into the
The arguments are put into the registers
r9, and the values of
r11 are destroyed.
rax is used as the return value.
The leave instruction is equivalent to:
movq %rsp, %rbp popq %rbp
If you found something wrong, or a notable omission, I would love to hear it. Please, send me an e-mail.