Registers
x86-64x86-64 General-Purpose Registers
The 16 general-purpose registers (RAX–R15) with their byte, word, and dword sub-register aliases — and their conventional roles in the System V and Microsoft ABIs.
x86-64 has 16 general-purpose integer registers, each 64 bits wide. Sub-register aliases provide access to the lower 32, 16, and 8 bits.
Register map
| 64-bit | 32-bit | 16-bit | 8-bit high | 8-bit low | Conventional use |
|---|---|---|---|---|---|
rax | eax | ax | ah | al | Return value, accumulator |
rbx | ebx | bx | bh | bl | Callee-saved (SysV & MSVC) |
rcx | ecx | cx | ch | cl | 4th arg (MSVC) / shift count |
rdx | edx | dx | dh | dl | 3rd arg (MSVC) / 2nd return |
rsi | esi | si | — | sil | 2nd arg (SysV) / string src |
rdi | edi | di | — | dil | 1st arg (SysV) / string dst |
rbp | ebp | bp | — | bpl | Frame pointer (callee-saved) |
rsp | esp | sp | — | spl | Stack pointer |
r8 | r8d | r8w | — | r8b | 5th arg (SysV) / 3rd arg (MSVC) |
r9 | r9d | r9w | — | r9b | 6th arg (SysV) / 4th arg (MSVC) |
r10 | r10d | r10w | — | r10b | Temp / syscall arg 4 (Linux) |
r11 | r11d | r11w | — | r11b | Temp / clobbered by SYSCALL |
r12 | r12d | r12w | — | r12b | Callee-saved |
r13 | r13d | r13w | — | r13b | Callee-saved |
r14 | r14d | r14w | — | r14b | Callee-saved |
r15 | r15d | r15w | — | r15b | Callee-saved (often GOT ptr in PIC) |
"High" 8-bit aliases (ah, bh, ch, dh) exist only for the original four
registers and cannot be used in instructions that also use a REX prefix.
Sub-register write behaviour
| Write width | Effect on full 64-bit register |
|---|---|
8-bit (al) | Merges into rax — upper 56 bits unchanged |
16-bit (ax) | Merges into rax — upper 48 bits unchanged |
32-bit (eax) | Zero-extends into rax — upper 32 bits cleared |
64-bit (rax) | Full register replaced |
The 32-bit zero-extension rule is a frequent source of confusion: writing eax
implicitly clears the upper half of rax, so xor eax, eax suffices to zero
the full rax.
Reverse-engineering notes
- Seeing
r15used as a base pointer throughout a function often means the compiler spilled the Global Offset Table pointer there (PIC shared libraries on Linux). rcxis clobbered bySYSCALLand by the Microsoft ABI's first argument — knowing the target ABI is essential before labellingrcxas loop counter vs. argument.- Decompilers infer variable types partly from which sub-register is used:
alsuggestschar/uint8_t,axsuggestsshort/uint16_t,eaxsuggestsint/uint32_t.