Assembly Reference

Add-with-carry and subtract-with-borrow. The carry flag is folded into the operation, which is exactly how the CPU chains arithmetic across multiple words.

Bit-counting instructions: find the first or last set bit, count leading or trailing zeros, or count how many bits are set. The hardware behind ffs, clz and popcount.

Test, set, reset or complement a single bit selected by index, capturing the old value in the carry flag. The compact way to manipulate bitfields and flags.

Branchless conditional move: copies the source to the destination only when a flag condition holds. The compiler's favourite way to compile a ternary without a jump.

Integer division: DIV is unsigned, IDIV is signed. Both read an implicit double-width dividend and return quotient and remainder in fixed registers — and both can fault.

Increment and decrement by one. Smaller than ADD/SUB and almost identical — except they deliberately leave the carry flag (CF) untouched.

Two's-complement negation — computes 0 minus the operand. Useful for unary minus, absolute value, and as a quick 'is it zero?' carry test.

Writes 1 or 0 to a byte operand based on a flag condition. The idiomatic way to turn a comparison into a boolean value without branching.

The accumulator-widening instructions that replicate the sign bit before signed division — and the family that explains MOVSX-style behaviour.

Atomically exchange two operands. Harmless between registers — but with a memory operand it carries an implicit LOCK, making it a foundational synchronization primitive.

Core ARM64 instructions — MOV, LDR/STR, B/BL/BLR, CMP, ADD/SUB, and RET — with their encodings and reverse-engineering patterns.

x86 string instructions operate on data pointed to by RSI/RDI and are typically combined with REP prefixes to implement bulk memory copy, fill, and scan.

x86-64 uses the SYSCALL instruction to enter the kernel; the older INT 0x80 is the 32-bit Linux interface — confusing them leads to incorrect syscall number mapping.

The single-byte INT3 instruction (0xCC) raises exception #BP, making it the universal software breakpoint mechanism used by all x86 debuggers.

The single-byte 0x90 NOP and its multi-byte variants do nothing except consume cycles and bytes — critical for recognising padding, patching, and anti-analysis.

MUL is unsigned widening multiply; IMUL is the signed (and most compiler-used) form with one-, two-, and three-operand variants.

Zero-extending and sign-extending moves that widen a smaller source operand into a larger destination — essential for understanding type promotions in decompiler output.

Bitwise logical instructions used for masking, flag testing, and bit manipulation; AND and OR set flags while NOT does not.

Logical and arithmetic shifts move bits left or right; rotates wrap bits around — all appear heavily in crypto, hashing, and compiler optimisations.

ADD computes the sum and SUB the difference of two operands, storing the result and updating all arithmetic flags.

Bitwise exclusive-OR; the xor reg,reg idiom is the canonical way to zero a register and is shorter and faster than mov reg,0.

CMP subtracts operands and discards the result to set flags; TEST ANDs them and discards the result — both are the standard way to condition a Jcc.

The Jcc family transfers control based on EFLAGS bits set by prior CMP, TEST, or arithmetic instructions — the source of all if/loop control flow.

CALL pushes the return address and transfers control; RET pops it and jumps back — the backbone of the x86-64 call stack.

Unconditionally transfers control to a target address — direct, indirect via register, or indirect via memory.

Computes an address expression and stores the result in a register — no memory access occurs, making it a fast arithmetic shortcut.

Pushes a value onto the stack (decrements RSP, then writes) or pops one off (reads, then increments RSP).

The fundamental data-transfer instruction: copies a value between registers, memory and immediates without affecting flags.

ARM64 provides 31 general-purpose registers (X0–X30) with 32-bit W-aliases, plus SP, LR, PC, and PSTATE — each with a defined ABI role.

Overview of the x86-64 SIMD register file — XMM (128-bit, SSE), YMM (256-bit, AVX), and ZMM (512-bit, AVX-512) — and their aliasing relationship.

In 64-bit user mode FS and GS are repurposed as thread-local and process-local base pointers — FS on Linux points to the TLS block, GS on Windows to the TEB.

The 64-bit RFLAGS register holds status, control, and system flags that arithmetic and logical instructions set — conditional jumps and SETcc read these bits.

The 16 general-purpose registers (RAX–R15) with their byte, word, and dword sub-register aliases — and their conventional roles in the System V and Microsoft ABIs.

How AArch64 passes arguments and return values: x0–x7 for the first eight integer args, x8 for indirect results, and the link register x30 for the return address.

cdecl, stdcall, fastcall and thiscall — the stack-based 32-bit ABIs you still meet in legacy Windows binaries, malware and DLLs. Who passes args where, and who cleans up.

How arguments, return values and registers are passed across function calls in the System V (Linux/macOS) and Microsoft x64 ABIs.

How ELF programs call functions in shared libraries: the Procedure Linkage Table trampolines, the Global Offset Table holds resolved addresses, and lazy binding fills them in on first call.

Page permissions — read, write, execute — and the W^X rule that no page is both writable and executable. The mitigation that turned simple shellcode injection into ROP.

Why modern binaries load at a random base address every run, how position-independent code uses RIP-relative addressing to cope, and what that means for reversing and exploitation.

x86-64 instructions are variable-length, built from up to six fields: prefixes, opcode, ModRM, SIB, displacement, and immediate — understanding this is critical for disassembly and shellcode analysis.

Endianness describes the byte order in which multi-byte values are stored in memory — x86/x64 is little-endian while network protocols and many file formats are big-endian.

Two's complement is the universal encoding of signed integers on x86-64 — understanding it explains why negation is ~x+1, and how overflow and sign extension work.

x86-64 memory operands follow the base + index*scale + displacement formula, encoded in the ModRM and SIB bytes — understanding them is essential for reading any memory access.

The call stack is a LIFO region of memory managed by RSP where function frames, saved registers, return addresses, and local variables live.