RAX Register

RAX is the primary accumulator in the x86-64 architecture. It is the 64-bit extension of the older EAX, and historically the CPU's default target for arithmetic, logic, and string operations. Many instructions encode RAX implicitly, which makes it one of the busiest registers in any disassembly.

Its single most important convention is that RAX holds the return value of a function. In both the System V AMD64 ABI (Linux, macOS, BSD) and the Microsoft x64 ABI (Windows), an integer or pointer result comes back in RAX. On System V, RAX is also caller-saved (volatile) and, for variadic calls, carries the number of vector registers used. It is never preserved across a call by the callee.

Sub-registers

RAX decomposes into smaller views that all alias the same physical storage:

mov rax, 0x1122334455667788   ; full 64-bit
; eax = 0x55667788  (low 32 bits; writing eax zeroes upper 32)
; ax  = 0x7788      (low 16 bits)
; al  = 0x88        (low 8 bits)
; ah  = 0x77        (bits 8-15)

Why it matters in reverse engineering

When you read disassembly, RAX after a call almost always carries the result you care about — a status code, a pointer, or a boolean. Functions frequently end with xor eax, eax (return 0) or mov eax, 1. Watching RAX in a debugger is often the fastest way to confirm what a routine produced.

See the general register concept, the assembly reference, and the x86 vs x64 assembly deep dive. Compare with the RDX register, which pairs with RAX for wide multiply and divide.