x86, x64 and a little bit of ARM...

• String

  String in Intel speak is a 'continous sequence of bits, bytes, works, or doublewords'. So not what we normally think of as a string. Strings can be up to 2^32 -1 bytes in length.

• GRP - General Purpose Register. x86 has 8 16-bit registers, x64 has 16 32-bit registers, ARM has 16 registers.
• EIP - (??Extended??) Instruction Pointer (32-bit). Offset by the descriptor the CS segment register is currently pointing at.
• SIMD - Single-instruction Multiple-data
• FPU - 8 x 80-bit data registers, 16-bit control register, 16-bit status register, 16-bit tag register, 11-bit opcode register, 48-bit FPU instruction pointer register, 48-bit FPU data (operand) pointer register.
• MMX - 8 x 64-bit registers
• Bounds - 4 x 128-bit registers
• XMM - For SIMD operations. 8 x 128-bit registers, one 32-bit MXCSR register
• YMM - For SIMD operations. 8 x 256-bit registers
• EFLAGS - Single 32-bit register (technically 64-bit on x64, but upper 32-bits are reserved and the lower 32-bits have the same definitions as x86).
• DR - 6 (DR0-3, 6-7) debug registers

• Segmentation - 4 x 4-bit on x86, 6 x 16-bit on x64:

  • CS - Code Segment. Instruction fetches are relative to this segment.
  • DS - Data Segment. By default, all data reference that are not string destinations or relative to the stack are relative to the DS segment.
  • SS - Stack Segment. All pushes and pops are relative to this segment.
  • ES - Additional Data Segment. Can be used where the DS segment is the default. Only segment that supports string operations.
  • FS - Additional Data Segment [x64 only]. Can be used where the DS segment is the default.
  • GS - Additional Data Segment [x64 only]. Can be used where the DS segment is the default.

  When the ESP or EBP register is used as a base, the SS segment is the default segment. Otherwise it's the DS segment.

• Address Space

  • x86: 32-bits (4GB) of linear address space, increases to 36-bit (64GB) with segmentation.
  • x64: 64-bits of linear address space, ??of which only 2^46 can be populated??

• Address Models

  • Flat

    Code, data, and stacks all line in one linear, continous address space references by its physcial address (0 - 2^32 for x86, 0 - 2^64 for x64. Not that on x64 only 2^46 of the 2^64 space can be populated at any one time)

  • Segmented

    A set of independent address spaces. Code, data, and stacks exist in seperate segments and is refenced by segment identifier and offset (e.g. CS:1234H. These are often called far pointers). A segment points to a description that holds the "real" address the offset is relative to.

    x86 can reference up to 2^14-1 (16,383) segments of up to 2^32 bytes each (14+32=48 is why physical memory space on x64 is less than the addressable memory space).

  • Real-address

    8086 compatibilty model. Uses 64KB segments.

• Syntax to 'right-to-left'. For example MOV EBP, ESP copies the value held into the ESP register into the EBP register. Unless you are in the Linux / AT&T world, where left-to-right is more common. $ = immediate value (e.g. const) % = register value
• Most command indicate the size of the data they are operating via a suffix. q = quadword (64 bits), l = double word (32 bits), w = word (16 bits), b = byte. If there are two suffices involved, a type conversion from the first suffex to the second is occuring. Examples:
  • movq rax, rbx -> Move 64 bits from the bx register into the ra register
  • movzbl al, ebx -> Move 8 bits (b) from al into the 16-bits (l) of ebx, setting the remaining bits in ebx to zero (z)
• Stacks grow downwards (towards lower memory addresses)

Instruction	Notes
MOV D, S	Move (S)ource into (D)estination
LEAQ D, S	Load effective address (S) into (D)
IMUL D,S IMULQ S MULQ S IDIVQ S DIVQ S	Signed multiplication of rax by (S), with result placed in dx:ax Unsiged version of above. Signed divide of dx:ax by S, with result stored in dx and remainder in ax Unsigned version of abovce
SAL D, bits SAR D, bits	(S)hift (A)rthimetic (L)eft/(R)right. Shift D bits to the (L)eft or (R)ight, preserving the highest order bit (i.e. the sign) and setting lowerest order bit to zero.
SAR D, bits SHL D, bits	(S)hift (H)? (L)eft/(R)ight Shift D bits as above, but set highest order bit to zero.
NEG D NOT D	Arithmetic negation of (D) e.g. 0 - D Bitwise complement of (D). e.g. 1001 -> 0110
CTWL CLTQ CQTO	(C)onvert 8-bit ax (T)o 32-bit (L)ong, maintaining sign (W?) and place result in eax (C)onvert eax (L) (T)o 64-bit (Q)uardword maintaining sign and place result in rax (C)onvert rax (Q)uadword (T)o 128-bit (O)ctoword
COM S1, S2 TEST S1, S2	Set flags for S1-S2 Set flags for S1 boolean AND S2 ?? TODO ??
SETE [SETNE] SETZ [SETNZ] SETS [SETNS] SETG / SETNLE SETGE / SETNL	(SE)t if equal / (Z)ero flag set. [Inverse] SE)t if not equal / (Z)ero flag not set. [Inverse] (SE)t if negative / (S)igned flag is set. [Inverse] (SE)t if (G)reater than / (N)ot (L)ess or (E)qual to. (SE)t if (G)reater than or (E)qual to / (N)ot (L)ess than.
PUSHFD / POPFD	Pushes / pops the eFlags register to / from the stack ?? What does the D stand for? ??

• TBC

• In x64 all registers now have a R prefix.

Calling conventions

• The increase to 16 registers also makes it more popular to pass parameters via registers than (expensive to access) memory.

• In x64 all registers now have a R prefix.
• For registers that also exist in x86, you can access the lower 32-bits part using the E prefix.
  • You can access the lower 32-bits part using the E prefix.
  • You can access the lowest 16-bits part by removing the R prefix.
  • You can access the lowest 8-bits part by dropping the X suffix (if present) and adding the L suffix.
• For registers that don't exist in x86:
  • You can access the lower 32-bits part using the D suffix.
  • You can access the lowest 16-bits part using the L suffix.
  • You can access the lowest 8-bits part using the B suffix.

name	64-bit	32-bit	16-bit	8-bit (bits 7-0)	8-bit (bits 15-8)	Intel special use notes (p 3-11)
Register A Extended	rax	ax	ax	al	ah	Accumulator for operands and results data
Register B Extended	rbx	bx	bx	bl	bh	Pointer to data in the DS segment
Register C Extended	rcx	cx	cx	cl	ch	Counter for string and loop operations
Register D Extended	rdx	dx	dx	dl	dh	I/O pointer
Register Source Index	rsi	si	si	sil		Pointer to data in the segment pointed to by the DS register; source pointer for string operations
Register Destination Index	rdi	di	di	dil		Pointer to data (or destination) in the segment pointed to by the ES register; destination pointer for string operations
Stack Pointer	rsp	sp	sp	spl		Stack pointer (in the SS segment)
Base Pointer	rbp	bp	bp	bpl		Pointer to data on the stack (in the SS segment)
Register 8 - 15	r8 - r15	r8-15d	r8-15w	r8-15b

Status Flags in EFLAGS register

(Intel notes p. 3-15)

Flags usable with CMPxx (compare), SETxx (set if), Jxx (jump if) etc instructions:

Bit	Short name	Full name	Notes
0	CF	Carry Flag	Set if borrow or carry outside of the most-significant bit of the number
2	PF	Parity Flag	Set if the least significant byte of the result contains an even number of 1 bits
4	AF	Auxillary carry Flag	Set if borrow or carry outside of bit three (used with BCD)
6	ZF	Zero Flag	Set is result is zero
7	SF	Sign Flag	Set to the most significant bit of the result (1 = negative, 0=positive)
11	OF	Overflow flag	Set if the result is (ignoring the sign bit) too big to fit the datatype

Only the CF flag can be set directly (?? why would we want to? ??)

Other Flags

Bit	Short name	Full name	Notes
10	DF	Direction flag	Controls whether string instruction (MOVS, CMPS, etc) to process downwards (set) or upwards (unset). Flag is set/unset via the STD/CLD instructions.