Skip to main content
20 votes

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

It's the wrong question, really. AH is the exception. Now the real question is, why is AH such an exception? It's an old register, from the 8086 era. It exists to facilitate moving over code from ...
MSalters's user avatar
  • 301
19 votes
Accepted

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones? It is impossible to access the higher parts of the EAX and RAX registers, or of any other 32 and 64-bit ...
NirIzr's user avatar
  • 11.8k
18 votes
Accepted

Randomly picking up a x86 register for an instruction

To better understand this, you need to study instruction encoding formats i.e. x86 for this question. An x86 instruction looks like this +----------------------+--------+--------+-----+--------------...
0xec's user avatar
  • 6,090
11 votes
Accepted

How many registers does an x86_64 CPU actually have?

Wikipedia has a page about the x86 architecture and all its known registers. Here is a small picture gathering all what we know about it. In fact, not all these registers are officially documented. ...
perror's user avatar
  • 19.1k
8 votes

How many registers does an x86_64 CPU actually have?

I believe the discrepancy between 40 and actual sum of 48 is mostly an error, however there are many other registers used for handling hardware, memory management, and control of different features of ...
NirIzr's user avatar
  • 11.8k
7 votes
Accepted

Register Calling Convention: written in stone, or in mud?

If the compiler can prove that it has all call sites for a given function under its control then it can discard conventions and arrange things around to its liking. Microsoft's C/C++ compiler has been ...
DarthGizka's user avatar
  • 2,010
7 votes
Accepted

PowerPC TOC and SDA

First, a bit of background on why these registers are needed. PPC is a RISC-like ISA, in that all instructions are of the same size (32 bits) and there is limited space for immediate values (usually ...
Igor Skochinsky's user avatar
  • 36.7k
6 votes

x64dbg (x32dbg) log registers every step like windbg

There is no such functionality in x64dbg out of the box, but we can make your own by writing a plugin! There are many examples (often with source code) available on http://plugins.x64dbg.com. In this ...
mrexodia's user avatar
  • 1,652
6 votes

Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?

Update: Thanks to Nirlzr, I see I missed the emphasized point at the bottom of the post. This answer, though not what OP is looking for, may serve useful for anyone down the road who is looking for a ...
dsasmblr's user avatar
  • 2,234
6 votes
Accepted

How do the PSHUFLW and PSHUFD instructions work?

The visual story of PSHUFLW is as follows: I will use Position as same mean as Order here and starts from Zero (Zero-Indexed). As you can see it selects words from source based on value of N. The ...
arman's user avatar
  • 141
5 votes

How are addresses calculated from the values in x86 segment registers?

In protected mode the segment selectors are indexes into the descriptor table (local or global one, depending on the TI bit of the selector). The descriptor entry describes the base address, limit (...
Igor Skochinsky's user avatar
  • 36.7k
4 votes

How are addresses calculated from the values in x86 segment registers?

You're looking at 32 bit registers (probably in a 32bit process). Since 32bit processors segment registers are rarely used as offset addresses for the simple reason 32 bit is enough to represent a ...
NirIzr's user avatar
  • 11.8k
4 votes

EBP + C what is that?

EBP stands for extended base pointer keeping track of the current stackframe. Since the current ESP (extended stack pointer) changes frequently in functions as stuff gets pushed to and poped of the ...
Nordwald's user avatar
  • 2,906
4 votes
Accepted

Moving integer to xmm register

To move a number into an XMM register, you'll first need to move that number into a memory address since you can't move an immediate into an XMM register (meaning, you can't do something like mov XMM1,...
dsasmblr's user avatar
  • 2,234
4 votes
Accepted

TEST instruction and ZF flag

Why the zero flag must be different from zero? It is a little confusing, but the Zero Flag is set (i.e. its value is 1), if the last result IS zero: result is 0 ⇒ ZF is not 0 result is not 0 ⇒ ZF is ...
MarianD's user avatar
  • 1,130
4 votes
Accepted

Why aren't compilers using registers for their intended purpose?

The "intended purpose" of a processor register is generally irrelevant to a compiler, unless something fundamental about the instruction set or architecture makes use of that aspect of the ...
Rolf Rolles's user avatar
  • 9,198
3 votes
Accepted

Is the value of EBP before the main function important?

__libc_start_main is called by the entry point code (usually in a file called crt0.S or similar) and that code usually sets up the initial EBP value (usually to 0, to denote end of the call stack for ...
Igor Skochinsky's user avatar
  • 36.7k
3 votes
Accepted

Added instruction to shellcode

The original shellcode contains only eight instructions, but because you asked gdb to disassemble 14 instructions, it went ahead and did just what you asked. Since you asked to disassemble more than ...
Igor Skochinsky's user avatar
  • 36.7k
3 votes

EBP + C what is that?

C is a hexadecimal number (12 in decimal).DWORD PTR SS:[EBP+C] should mean memory at stack segment, by address (value of EBP register + 12). This CMP ECX,DWORD PTR SS:[EBP+C] means "compare the ...
w s's user avatar
  • 8,508
2 votes
Accepted

How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX?

We can see from this list that IA-32's Delphi/Free Pascal calling convention is the register calling convention. My guess is you're dealing with a binary that's the result of something like this: How ...
dsasmblr's user avatar
  • 2,234
2 votes

Can I step through a binary with IDA (eval version), reading registers step-wise?

I own an IDA license, so I have no use for the free one. I don't know with complete certainty whether the freeware version does debugging, but here's a quote from the freeware download page about the ...
Rolf Rolles's user avatar
  • 9,198
2 votes

x64dbg (x32dbg) log registers every step like windbg

You have registers listed in CPU view (View->CPU) like this: In case you want to get them in a trace log, you have to do: Trace->Trace into... and in Log Text field, write: registerName: {...
bart1e's user avatar
  • 3,399
2 votes

How to view registers values in string

Using drr is showing the strings.
E235's user avatar
  • 583
2 votes

Ollydbg: How to set a conditinal breakpoint for a register gets special value

ctrl+t -> Set Trace Condition checkmark condition is true check box and enter the condition in your case ecx == 12345678 and start tracing with either ctrl+f11 or ctrl+f12 snap shot shows trace ...
blabb's user avatar
  • 16.4k
2 votes

Ollydbg: How to set a conditinal breakpoint for a register gets special value

(Not exactly an answer but too long for a comment) This sounds like a simple problem but technically it isn't! I'd like to explain why and how if there is a solution for it, it is probably going to ...
Johann Aydinbas's user avatar
2 votes

x64dbg: break when a register contains a value

Going by the similar question for OllyDbg, it seems you should be able to achieve it by using Conditional Tracing. The doc also mentions: You can start a conditional tracing by “Trace over until ...
Igor Skochinsky's user avatar
  • 36.7k
2 votes

How can I move an integer number into a XMM register with Cheat Engine?

By its definition, movaps instruction can't get immediate value. It can only get another register or memory location. You can see it in its documentation. MOVAPS xmm1, xmm2/m128 Move packed single-...
macro_controller's user avatar
2 votes
Accepted

Why is the offset 16 bits?

You are referring to the early 80s of the last century. The 8086 architecture used this way of addressing 20-bit physical memory, the then tremendous amount of 1 (One!) MByte, or "one million ...
josh's user avatar
  • 1,974
2 votes

How to change local_184h to skip past jump commands with Radare2?

According to Intel's manual 3.4.3.1 Status Flags The status flags (bits 0, 2, 4, 6, 7, and 11) of the EFLAGS register indicate the results of arithmetic instructions, such as the ADD, SUB, MUL, and ...
sudhackar's user avatar
  • 2,709
2 votes

How can I get the inferred register value for an instruction in Ghidra scripting?

After looking into this a bit, I think that it will heavily depend on the exact context. The decompiler can definitely do a basic form of this: In this cases the PCode operation for the call ...
Florian Magin's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible