9

I am currently learning reverse engineering and am studying the flags register.

I had in my mind that rflags was just another name for one of the 16 general purpose registers, for example rax or rbx.

But it looks like rflags is actually an additional register. So that makes 17 registers in total... how many more could there be?

I have spent at least an hour on this and found numerous different answers.

The best answer so far is this, which says that there are 40 registers in total.

  • 16 General Purpose Registers
  • 2 Status Registers
  • 6 Code Segment Registers
  • 16 SSE Registers
  • 8 FPU/MMX Registers

But if I add that up, I get 48.

Could anybody provide an official answer on how many registers an x86_64 CPU has (e.g. an Intel i7).

Additionally, I have seen references to 'hardware' and 'architectural' registers. What are those registers and how many are there?

Improve this question
3
  • 2
    If you know that the CPU has 10000 registers, but can actually use only ~40 of them, how is that useful? ... – user202729 Oct 23 '18 at 0:02
  • Although OP is learning reverse engineering, this question in particular has little specifically related to reverse engineering. – user202729 Oct 23 '18 at 0:02
  • 1
    How many registers does a x86-64 processor have? – phuclv Oct 23 '18 at 9:37
6

Wikipedia has a page about the x86 architecture and all its known registers. Here is a small picture gathering all what we know about it.

amd64 Registers

In fact, not all these registers are officially documented. But, all the registers we know (and we know how to use) are listed in the picture. And, it makes much more than 40.

And, I do not know what are these 'hardware' or 'architectural' registers, because for me they are all 'hardware' (not software simulated). And, what we call a CPU architecture is also including the list of available hardware registers. So, up to my knowledge, they are all both hardware and architectural registers.

EDIT

Note that most of the registers are specialized and have been introduced to support a specific instruction set (the best example are the FPU registers ST0-ST7, introduced to support floating point computation).

Improve this answer
3
  • I like the fact you say "known" registers. So it looks like nobody really knows because it's not public information? Is it true that when most people say 'register', they really mean general purpose register? – rubberband876 Oct 22 '18 at 23:01
  • 3
    First of all, knowing what is inside hardware is really hard (see the Intel God-mode talk given at BlackHat 2018 for example), so there is always the possibility that unknown feature are here unknown of everybody (it may be a register or an instruction). And, no, they are not all GPR, most of the registers are linked to an instruction set. The only GPR are the Rxx registers (RAX, RBX, RCX, RDX, R8, ... R15 so 12 registers in total). – perror Oct 23 '18 at 7:41
  • 2
    @rubberband876 we only need to know the architectural exposed registers. Other things inside are just unnecessary implementation details. For example with register renaming there are actually a lot more registers that maps to the running program's registers. There are also a lot of internal hardware registers to store data temporarily, like between each stage in the pipeline. Those will change between every implementation that we have no way to know – phuclv Oct 23 '18 at 9:24
6

I believe the discrepancy between 40 and actual sum of 48 is mostly an error, however there are many other registers used for handling hardware, memory management, and control of different features of the CPU.

The answer you linked to covers all the commonly used registers in the following image (taken from there):

commonly used registers

There are, however plenty of less commonly known registers. Those registers are not likely used by user mode programs but used to control and initialize the processor and low-level constructs the CPU is aware of. They control CPU subsystems such as the MMU unit, task scheduling, etc. Documentation of those registers can be found in the AMD64 Architecture Manual.

You can see most of them in the following figure, taken from the AMD64 Architecture Manual:

system registers

Not in the above picture is the new Extended Control Registers family of registers, for which only XCR0 is currently defined.

The System Registers are part of the Model Specific Registers that, as the name implied, are model specific. The variety also changes between CPUs. A full list for the AMD64 architecture can be found in "Appendix A MSR Cross-Reference" of the AMD64 Architecture Manual.

There are extensions that certain AMD64 based CPUs support/implement that extend the set of XMM registers available. The XMM (and later YMM and ZMM) are currently extended to up to 32 registers of 512 bit each in AVX-512. Similar to general registers, XMM registers allow access to the lower parts of their YMM and ZMM counterparts.

There are additionally what's called "memory mapped registers" which basically means those registers are accessed through memory operations instead of designated instructions. They can be, depending on your definition, countered as registers. One such example is the "APIC Registers" described in section 16.3.2 of the AMD64

There are even internal registers that are not exposed through the instruction set but are used for performance reasons.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.