Skip to content
Reverse Engineering

Glossary

RCX Register

RCX is the 64-bit x86-64 counter register, used for loop and shift counts and to pass function arguments in both major calling conventions.

RCX is a 64-bit general-purpose register in the x86-64 architecture, extending the legacy ECX. The "C" stands for counter: instructions like loop, rep movs, and the shift/rotate family (shl, shr) use CL or RCX as an implicit repeat or shift count. That implicit role makes RCX instantly recognizable in tight copy and string loops.

It is also an argument register, but the two ABIs disagree on which position. In the System V AMD64 ABI (Linux, macOS), RCX carries the fourth integer/pointer argument. In the Microsoft x64 ABI (Windows), RCX carries the first argument. In both conventions RCX is caller-saved (volatile) and is not used for the return value.

Sub-registers

asm
mov rcx, 16          ; loop count
rep movsb            ; copy RCX bytes from RSI to RDI
; ecx = low 32 bits (zeroes upper half on write)
; cx  = low 16 bits
; cl  = low 8 bits   (used as the shift count by shl/shr)

Why it matters in reverse engineering

When you see RCX set just before a call on Windows binaries, it is almost certainly the first argument — frequently a this pointer for C++ methods. On Linux it is the fourth argument. Recognizing RCX as the active count in rep-prefixed and loop instructions tells you the size of a memory operation at a glance.

See the general register concept and the assembly reference. The ABI differences are covered in x86 vs x64 assembly. Compare with the RDX register, the next argument in sequence.