26288 total geeks with 3498 solutions
Recent challengers:
 Welcome, you are an anonymous user! [register] [login] Get a yourname@osix.net email address 

Articles

GEEK

User's box
Username:
Password:

Forgot password?
New account

Shoutbox
MaxMouse
It's Friday... That's good enough for me!
CodeX
non stop lolz here but thats soon to end thanks to uni, surely the rest of the world is going good?
stabat
how things are going guys? Here... boring...
CodeX
I must be going wrong on the password lengths then, as long as it was done on ECB
MaxMouse
lol... the key is in hex (MD5: of the string "doit" without the "'s) and is in lower case. Maybe i should have submitted this as a challenge!

Donate
Donate and help us fund new challenges
Donate!
Due Date: May 31
May Goal: $40.00
Gross: $0.00
Net Balance: $0.00
Left to go: $40.00
Contributors


News Feeds
The Register
Open wide, Google:
Here comes an
advertising
antitrust probe
El Reg drills into
Office 365: Email
migration
Daft tweet by
Speaker Bercow"s
loquacious wife DID
libel lord
Paul Allen buys
lovingly restored
vintage V-2 Nazi
ballistic missile
Hey, you, dev. What
do you mean,
storage is BORING?
Curse you, old
person, for
inventing
computers!
Feds slam
hacker-friendly
backdoors in
jalopy, grub
factories
4G LTE: Good for
tweets and watching
Dr Who. Crap
at saving lives
Microsoft exposes
green users"
privates in web
quiz snafu
Woolwich beheading
sparks call to
REVIVE UK Snoopers"
Charter
Slashdot
Drupalcon Attendees
Come Together To
Build Help4ok.org
In 24 Hours
Twitter"s New
Money-Making Plan:
Lead Generation
Bandages That Can
Turn Off Genes
Encourages Wound
Healing
BT Runs an 800Gbps
Channel On Old
Fiber
Australian Police
Move To Make 3D
Printed Guns
Illegal
Cockroaches
Evolving To Avoid
Roach Motels
Meet the 23-Ton
X-Wing, the World"s
Largest Lego Model
Android Malware
Intercepts Text
Messages, Forwards
To Criminals
Scientists Growing
New Crystals To
Make LED Lights
Better
Google Takes Street
View To the
Galapagos Islands
Article viewer

Whats new in x86-64 ?



Written by:dimport
Published by:NeorageX
Published on:2003-06-21 07:19:46
Topic:Assembly
Search OSI about Assembly.More articles by dimport.
 viewed 9510 times send this article printer friendly

Digg this!
    Rate this article :
I saw someone asking about 64 bit asm in our irc channel the other day (irc.cyberarmy.com #osi), mainly what the differences were between 64 and 32 bit assembly are, so for your reading pleasure, a primer on the new stuff in x86-64 (working knowledge of assembly assumed).

The 64 bit versions of the 32 bit extended registers are prefixed with r instead of e;

  • eax becomes rax
  • edx becomes rdx
  • exc becomes rcx
  • ebx becomes rbx
  • esi becomes rsi
  • edi becomes rdi
  • esp becomes rsp


These ‘new’ registers work like the old e versions except for implicit usage with shift counters or string operation type instructions. The new 64 bit architecture has 8 new int registers encoded with a REX prefix;

  • rXb ;8 bit
  • rXw ;16 bit
  • rXd ;32 bit
  • rX ;64 bit


Where X is an integer in the range of 8-16. Most instructions remain 32 bit and their 64 bit counterparts are invoked by the fourth bit in the REX prefix, so every 32 bit instruction has a natural 64 bit equivalent, to utilise the 64 bit version use the q (quad) postfix.

movl $1, %eax

becomes

movq $1, %rax

There are exceptions, in the case of stack manipulation instructions, where the 32 bit instructions have been depreciated (pop, push, call, enter, leave and ret) but the 16 bit versions remain;

pushq %rax

is fine, but

pushl %eax

isn't.
The result of any 32 bit operation is now zero extended to a 64 bit value, obviously 8 and 16 bit operations don''t affect the upper part of registers so they’re fine and if you’re really crafty you can use the 8-16 bit registers for optimisation.

Immediate values within an instruction remain 32 bits, their values are sign extended to 64 bits pre calculation, as a result:

subq $1, %rax

Is fine, but:

subq $0xffffffff, %rax

isn't.
There is an exception to this when the moves of constant to registers that have 64 bit form:

movq 0xffffffff, %rax

Is a 10 byte instruction that is equivalent to:

movl 0xffffffff, %eax

Which is 5 bytes. You can write symbolic expressions as operands to 62 and 32 bit operations, 32 bit operations result in zero extending relocations whilst 64 bit operations result in sign extensions:

movl $symb, %eax

Is a 5 byte instruction, whilst

movq $symb, %rax

Is a 7 bytes instruction.
To load a symb as 64 bit use the movabs instruction (which is a synonym for mov)

movandq %symb, %rax

The new 64 bit architecture has a system of relative addressing which makes it easier to write position independent code, the original displacement type addressing is now encoded by one of the redundant SIB form and as such relative instruction pointer (RIP) addressing is more efficient than displacement:

movl $0x1, 0x01(%rip)

Will store the value 0x1, 10 bytes past the end of the instruction, symbolic location is implicitly RIP relative so:

movl $0x1, symb(%rip)

Will place 0x1 at the address of $symb, its advised to use RIP to increase speed and efficiency.

This article was originally written by pigsbig78

Did you like this article? There are hundreds more.

Comments:
<none>
Anonymously add a comment: (or register here)
(registration is really fast and we send you no spam)
BB Code is enabled.
Captcha Number:


Blogs: (People who have posted blogs on this subject..)
jackier
jackier on Mon 13th Oct 10am
111
sefo
Sneak - encryption on Fri 17th Nov 12pm
I'm developing the win32 version of sneak: http://snarkles.net/scripts/sneak/sneak. php The ASM source code is available on cyberarmy svn (for members only - free) Check the forum for details: http://www.cyberarmy.net/forum/sneak/mes sages/295244.
sefo
Geek Toolbar on Mon 13th Nov 8am
This a very simple and small toolbar I wrote in my spare time. I use the same set of tools very often and I find it very annoying to look for them in the start menu, on the desktop or in explorer. http://www.osix.net/modules/folder/index .php?tid=134
sefo
BinScan and Alternate Data Stream on Thu 27th Jul 9am
BinScan I created this tool to quickly identify modifications in the PE, use of a TLS callback and Alternate Data Streams. -> Some modifications done in the PE structure of an executable can prevent debuggers or other tools to open the executable.
sefo
Wmf Creator on Wed 26th Jul 7am
Now that the blog is online, I'll be able to share two or three tools I wrote. The first one I'd like to share is WMF Creator. I already put a link in the comments of my article: Wmf Exploit but I thought it would look nicer here. This tool will tak

Test Yourself: (why not try testing your skill on this subject? Clicking the link will start the test.)
Reverse Engineering by Geek_Freek

A test to check your assembly and reversing skills.
Assembly Language - non compiler specific by TroPe

You can test your assembly knowledge by taking this test. It starts out relatively easy, but gets progressively hards very quickly! If you know assembly, or just want to see what you DONT know about assembly, this test is for you. A more advanced assembly


     
Your Ad Here
 
Copyright Open Source Institute, 2006