General purpose registers - 32 bit
General purpose registers - 64 bit
RAX,RCX,RBX,RDX,RSI,RBP,RSP, + R8-R15
General purpose registers (i)
EAX/RAX - Acumulator Register - "imul 4, %eax"
Designed to work as calculator
EDX/RDX - Data Register - "add %eax, %edx"
Work with EAX on calculations
Pointer to input/output ports
ECX/RCX - Count Register - "mov 10, %ecx"
Used often with loops
EBX/RBX - Base Registers - 'inc %ebx"
General purpose registers
The lower 16-bits of the 32-bit General purpose registers can be referenced independently
The upper and lower 8 bits of the lower 16 bits can also be referenced independently with ah/al, dh/dl, ch/cl,bh/bl
General purpose registers (ii)
ESI/RSI - Source Index
Pointer to read locations during string operations and loops
repz cmpsb %es:(%edi),%ds:(%esi)"
EDI/RI - Destination Index
Pointer to write locations during string operations and loops
ESP/RSP - Stack Pointer - "movl %esp, %ebp"
Holds the address of the top of the stack
Changes as data is copied to and removed from the stack
EBP - Base Pointer- RBP is used for general purpose
Serves as an anchor point for the stack frame
Used to reference local variables
Segment registers - 16-bit
Often used to reference memory locations
FLAGS register - Mathemaical operations
Zero Flag | Negative Flag | Carry Flag and so on
Instruction Pointer(IP) Control registers
CRo - CR4
CR3 holds the start of the address of the page directory.
NOTE: The R in the register name on 64 bit system stands for Register.
diass - Dumps the assembly instruction of the function
break - Pauses the execution when the given function is reached
print - Prints out the content of a register and other variables
x/i - Examines memory allocations
info - prints the contents and state of registers and other variables
c or continue - Continues execution after a break point
si - Step one instruction
backtrace or bt - Prints the return pointer back to the callers as part of the current call chain
info function - Prints out all functions
This command will not print out stripped functions, only those located in the procedure linkage table
set disassembly-flavor - Changes the assembly syntax used
set disassembly-flavor att
info breakpoints and delete breakpoints - Lists and deletes breakpoints
del breakpoint 3
run - Runs or restart the program
sub $0x48, %esp
$ = Immediate Operand - subtract 0x48 to the value of the memory address %esp so (basically allocate memory address)
% = Indirect Operand
() = Pointer
 = Pointer