RBX Register

RBX is a 64-bit general-purpose register in the x86-64 architecture, the extension of the legacy EBX. The "B" originally stood for base, since in 16-bit code BX was one of the few registers usable for memory addressing. Today it is simply a flexible scratch register with one important property: it is preserved across calls.

In both the System V AMD64 ABI and the Microsoft x64 ABI, RBX is callee-saved (non-volatile). A function that wants to use RBX must save the caller's value first — usually with push rbx in the prologue — and restore it before returning. It is not used to pass arguments or return values in either convention, which makes it a natural home for a value that must survive across several calls inside a function.

Sub-registers

push rbx              ; preserve caller's value
mov rbx, rdi          ; stash an argument that must outlive later calls
; ebx = low 32 bits (zeroes upper half on write)
; bx  = low 16 bits
; bl  = low 8 bits
pop  rbx              ; restore before ret

Why it matters in reverse engineering

Seeing push rbx near a function's start is a strong hint that the routine holds onto a long-lived value — often a loop counter, an object pointer, or a this handle. Because the value is preserved, you can trust RBX to stay meaningful across nested calls, which makes it easy to track in a debugger.

See the general register concept and the assembly reference. For how preservation rules changed between architectures, read x86 vs x64 assembly. Compare with the volatile RAX register.