PUSH / POP

PUSH and POP are the primary instructions for manipulating the call stack. In 64-bit mode the default operand size is 64 bits (8 bytes).

Operation

push rax      ; RSP -= 8 ; [RSP] = rax
pop  rbx      ; rbx = [RSP] ; RSP += 8
push 0x1234   ; immediate push — sign-extended to 64 bits

PUSH first decrements RSP by the operand size, then writes the value. POP first reads the value at [RSP], then increments RSP.

Neither instruction modifies EFLAGS (except POPF/POPFD/POPFQ, which restore flags from the stack).

Function prologue/epilogue pattern

; Prologue — save callee-saved registers
push rbp
mov  rbp, rsp
push rbx
push r12

; ... body ...

; Epilogue — restore in reverse order
pop  r12
pop  rbx
pop  rbp
ret

The push rbp / mov rbp, rsp pair creates a stack frame that debuggers and unwinders use to walk the call chain.

Reverse-engineering notes

• A string of push instructions at the start of a function usually saves callee-saved registers; the matching pops at the end are the epilogue.
• Some compilers replace push reg with sub rsp, 8 / mov [rsp], reg — functionally identical but slightly larger code; common with -O2.
• push imm is a compact way to pass a constant argument on the stack (32-bit sign-extended) when stack-based argument passing is needed.
• Spotting mismatched push/pop counts is an easy way to identify stack-cleanup bugs or intentional obfuscation.