RDI Register

RDI is a 64-bit general-purpose register in the x86-64 architecture, extending EDI. The name means destination index: in string and block instructions such as movs, stos, and scas, RDI is the implicit destination pointer, advanced automatically after each element according to the direction flag.

As an argument register the two ABIs diverge sharply. In the System V AMD64 ABI (Linux, macOS), RDI holds the first integer/pointer argument and is caller-saved — so the very first thing passed to almost every Linux function lands here. In the Microsoft x64 ABI (Windows), RDI is not an argument register; it is callee-saved (non-volatile) and must be preserved before use.

Sub-registers

lea rdi, [buf]       ; destination pointer
mov al, 0
mov rcx, 256
rep stosb            ; fill RCX bytes at RDI with AL (memset)
; edi = low 32 bits (zeroes upper half on write)
; di  = low 16 bits
; dil = low 8 bits

Why it matters in reverse engineering

On Linux binaries, the value in RDI just before a call is the first argument — often a pointer or a file descriptor — so it is usually where you start reading a function's intent. In rep stos/movs loops, RDI marks the buffer being written, which immediately identifies a memset or memcpy target.

See the general register concept and the assembly reference. The argument-order differences are covered in x86 vs x64 assembly. It is the counterpart to the RSI register, the source of the same string operations.