You've loaded an old revision of the document! If you save it, you will create a new version with this data. Media Files{{tag>english it-security cheatsheet basics}} ====== 64-Bit Stack CheatSheet ====== {{page>en:vorlagen:64_bit_stack_nav}} ==== x64 Register ==== The x64 register is as follows aufgebaut((https://learn.microsoft.com/de-de/windows-hardware/drivers/debugger/x64-architecture)) ((https://www.complang.tuwien.ac.at/ubvl/amd64/amd64h.html)) ^ 64-bit registry ^ Lower 32 bits ^ Name ^ Application ^ | @lightgreen:**RAX** | @orange:EAX | Temporary register | First return register | | @lightgreen:**RBX** | @orange:EBX | Callee-backed register | | | @lightgreen:**RCX** | @orange:ECX | Argument register | fourth integer argument | | @lightgreen:**RDX** | @orange:EDX | Argument register | third integer argument, second return register | | @lightgreen:**RSI** | @orange:ESI | Argument register | second integer argument | | @lightgreen:**RDI** | @orange:EDI | Argument register | first argument | | @lightgreen:**RBP** | @orange:EBP | @red:Callee-saved register | @red:**Frame Pointer** | | @lightgreen:**RSP** | @orange:ESP | @red: | @red:**Stack Pointer** | | @lightgreen:**RIP** | @orange:EIP | @red:Instruction Pointer | @red:**Address of the next machine instruction to be executed, read-only** | | @lightgreen:**R8** | @orange:R8D | Argument register | fifth argument | | @lightgreen:**R9** | @orange:R9D | Argument register | sixth argument | | @lightgreen:**R10** | @orange:R10D | Temporary register | | | @lightgreen:**R11** | @orange:R11D | Temporary register | | | @lightgreen:**R12** | @orange:R12D | Callee-saved register | | |... | ... | ... | ... | | @lightgreen:**R15** | @orange:R15D | Callee-secured register | | === Calling conventions === A function (caller) calls a sub-function (callee). The registers RBP, RBX, R12 to R15 belong to the caller. If the callee wants to change them, it must save them on the stack with <code asm>push</code> to save them on the stack. Before returning to the function, these registers must then be restored using <code asm>pop</code> to restore these registers. More on this can be found in the Cheat-Sheet((https://cs.brown.edu/courses/cs033/docs/guides/x64_cheatsheet.pdf))Please solve the following equation to prove you're human. 207 +2 = Please keep this field empty: SavePreviewCancel Edit summary Note: By editing this page you agree to license your content under the following license: CC Attribution-Noncommercial-Share Alike 4.0 International