I am new to the world of reverse engineering and have been recommended by a number of people that I should start with IA32 because it is easier to learn the concepts. Aside from differences in the number of registers, what are the key differences between a 32bit system compared to a 64bit system.
2
-
If you are really interested in understanding the differences between these architectures, you should read chapters 1-3 fom AMD64 Architecture Programmer’s Manual Volume 1: Application Programming and chapters 1-7 from Intel 64 and IA-32 Architectures Software Developer’s Manual Volume 1: Basic Architecture. You can read the wikipedia articles about these architectures as well.– julian ♦Jun 17, 2017 at 15:03
-
Hi, whatever Intel architecture you dig into, you'll have to learn both. So, you might as well start with x86_64 en.wikipedia.org/wiki/X86-64 and see how the 32 bits builds a basis using 16 bits and 8 bits instructions. Top to bottom process. Otherwise, you'll have to go through the timely evolution of the IA and you'll waste your time on complicated constructs simplified or enlarged in 64 bits.– yasprJun 17, 2017 at 16:23
Add a comment
|
1 Answer
Short answer : Because it's an easier place to start .X64 allows for an extended instruction set , more access to memory and more allocation space in pretty much everything.
Long Answer: I wouldn't necessarily say that to start using a x86 system is a good way to start . I would say though , that starting with an x86 binary is a good area to start with.
Historically, going from 8 to 16 to 32 has added more and more instructions with each new addition of an architecture.
I recommend learning x86 as a start:
Because it's simple and is still used. There are many things written in x86, a lot of the exploits of APIs or were written upon the shoulders of giants of that time...
You can continue to use x86 in your x64 machine as x64 is just an extension of x68.
It's easier to read and you will deal with simpler value sizes.The way things are accessed .The amount of space that can be accessed is largely increased. With the two architectures, there are different ways of doing calls.
You'll need to learn x64 anyway as it's the next step in evolution. You'll appreciate it when you run into things with x86. Some things might include the amount of registers that you can use. Another might be instructions that allow you to access certain registers differently or in a more readable way.
Looks like this might have been answered previously here: https://stackoverflow.com/questions/7635013/difference-between-x86-x32-and-x64-architectures https://superuser.com/questions/56540/32-bit-vs-64-bit-systems
Some other links to read: http://www.techsupportalert.com/content/32-bit-and-64-bit-explained.htm https://en.wikipedia.org/wiki/X86-64
