Assembly Reference

Core ARM64 instructions — MOV, LDR/STR, B/BL/BLR, CMP, ADD/SUB, and RET — with their encodings and reverse-engineering patterns.

x86 string instructions operate on data pointed to by RSI/RDI and are typically combined with REP prefixes to implement bulk memory copy, fill, and scan.

x86-64 uses the SYSCALL instruction to enter the kernel; the older INT 0x80 is the 32-bit Linux interface — confusing them leads to incorrect syscall number mapping.

The single-byte INT3 instruction (0xCC) raises exception #BP, making it the universal software breakpoint mechanism used by all x86 debuggers.

The single-byte 0x90 NOP and its multi-byte variants do nothing except consume cycles and bytes — critical for recognising padding, patching, and anti-analysis.

MUL is unsigned widening multiply; IMUL is the signed (and most compiler-used) form with one-, two-, and three-operand variants.

Zero-extending and sign-extending moves that widen a smaller source operand into a larger destination — essential for understanding type promotions in decompiler output.

Bitwise logical instructions used for masking, flag testing, and bit manipulation; AND and OR set flags while NOT does not.

Logical and arithmetic shifts move bits left or right; rotates wrap bits around — all appear heavily in crypto, hashing, and compiler optimisations.

ADD computes the sum and SUB the difference of two operands, storing the result and updating all arithmetic flags.

Bitwise exclusive-OR; the xor reg,reg idiom is the canonical way to zero a register and is shorter and faster than mov reg,0.

CMP subtracts operands and discards the result to set flags; TEST ANDs them and discards the result — both are the standard way to condition a Jcc.

The Jcc family transfers control based on EFLAGS bits set by prior CMP, TEST, or arithmetic instructions — the source of all if/loop control flow.

CALL pushes the return address and transfers control; RET pops it and jumps back — the backbone of the x86-64 call stack.

Unconditionally transfers control to a target address — direct, indirect via register, or indirect via memory.

Computes an address expression and stores the result in a register — no memory access occurs, making it a fast arithmetic shortcut.

Pushes a value onto the stack (decrements RSP, then writes) or pops one off (reads, then increments RSP).

The fundamental data-transfer instruction: copies a value between registers, memory and immediates without affecting flags.

ARM64 provides 31 general-purpose registers (X0–X30) with 32-bit W-aliases, plus SP, LR, PC, and PSTATE — each with a defined ABI role.

Overview of the x86-64 SIMD register file — XMM (128-bit, SSE), YMM (256-bit, AVX), and ZMM (512-bit, AVX-512) — and their aliasing relationship.

In 64-bit user mode FS and GS are repurposed as thread-local and process-local base pointers — FS on Linux points to the TLS block, GS on Windows to the TEB.

The 64-bit RFLAGS register holds status, control, and system flags that arithmetic and logical instructions set — conditional jumps and SETcc read these bits.

The 16 general-purpose registers (RAX–R15) with their byte, word, and dword sub-register aliases — and their conventional roles in the System V and Microsoft ABIs.

How arguments, return values and registers are passed across function calls in the System V (Linux/macOS) and Microsoft x64 ABIs.

x86-64 instructions are variable-length, built from up to six fields: prefixes, opcode, ModRM, SIB, displacement, and immediate — understanding this is critical for disassembly and shellcode analysis.

Endianness describes the byte order in which multi-byte values are stored in memory — x86/x64 is little-endian while network protocols and many file formats are big-endian.

Two's complement is the universal encoding of signed integers on x86-64 — understanding it explains why negation is ~x+1, and how overflow and sign extension work.

x86-64 memory operands follow the base + index*scale + displacement formula, encoded in the ModRM and SIB bytes — understanding them is essential for reading any memory access.

The call stack is a LIFO region of memory managed by RSP where function frames, saved registers, return addresses, and local variables live.