Assembly Reference

Registers

General Purpose

eax/rax → accumulator (return values, math)
ebx/rbx → base register (general data)
ecx/rcx → counter (loops, 1st arg in Win64)
edx/rdx → data register (2nd arg in Win64)

Pointers & Index

esp/rsp → stack pointer (top of stack)
ebp/rbp → base pointer (stack frame)
esi/rsi → source index (string/mem ops)
edi/rdi → destination index (string/mem ops)

Control & Flags

eip/rip → instruction pointer
eflags/rflags → status flags (ZF, SF, CF, OF, etc.)

Segments (legacy, flat memory today)

cs, ds, ss, es, fs, gs

Assembly Instructions

Stack Operations

push <val> → push to stack the top of the stack (esp/rsp -= size)
push [val] → push memory address to the top of the stack (esp/rsp -= size)
pop <reg> → pop from the top of the stack (esp/rsp += size)
pop [val] → pop memory address from the top of the stack (esp/rsp += size)
call <func> → push return addr, jump
ret → pop return addr, return

Arithmetic

add reg, val → reg += val
sub reg, val → reg -= val
inc reg / dec reg → increment / decrement
mul / imul → unsigned / signed multiply
div / idiv → unsigned / signed divide
and reg, val → bitwise AND
or reg, val → bitwise OR
xor reg, val → bitwise XOR (exclusive OR)
not reg → bitwise NOT (invert bits)

Data Movement

mov dst, src → dst = src (can also do mov dst, [src] to move the value at src into dst (dereference))
lea reg, [mem] → load effective address: calculate the address of the source operand and store that address in the dest register -> Common in loops, array indexing, struct field access.

Supposing var1 is defined as: var1 equ 1

Instruction	Result in `eax`
`mov eax, var1`	eax = 1 (immediate)
`mov eax, [var1]`	eax = value at memory address (1)
`lea eax, [var1]`	eax = address of `var1`

movzx -> Copy a smaller value into

Instruction	Result in `eax`
`mov eax, var1`	eax = 1 (immediate)
`mov eax, [var1]`	eax = value at memory address (1)
`lea eax, [var1]`	eax = address of `var1`

movzx -> Copy a smaller value into a larger register and fills the extra high bits with 0
movsx → Copies a smaller value into a larger register and fills the extra high bits with the sign bit (MSB)
xchg → swap
movsb -> moves one byte from the memory location pointed to by ESI to EDI
stos stores the value of the accumulator register (AL, AX, or EAX) into memory at the address pointed to by EDI/RDI (destination index), then increments or decrements EDI/RDI depending on the direction flag (DF). Direction flag (DF): determines increment/decrement of EDI. cld → increment. std → decrement
- stosb ; store byte from AL → [EDI]
- stosw ; store word from AX → [EDI]
- stosl ; store doubleword from EAX → [EDI]
The stos instruction is commonly used with rep (repeat).
rep <instruction> - repeats the following instruction ECX number of times
- e.g. rep stosl, rep movsb etc.

Value Comparison

cmp a, b → subtract, set flags (no result stored)
test a, b → AND, set flags (no result stored)
Flags: ZF (zero), SF (sign), CF (carry), OF (overflow)

Conditionals & Jumps

Unconditional: jmp label
Conditional:
- je/jz → equal / zero
- jne/jnz → not equal / nonzero
- jg/jnle → greater (signed)
- jl/jnge → less (signed)
- ja/jb → above / below (unsigned)

Debugging and RE Instructions

Registers

Assembly Basics

Intel Assembly – Reference Sheet

remember: intel syntax operation [destination], [source]

Debugging & Reverse-Engineering Instructions

nop → no operation (used for patching/aligning).
int3 → software breakpoint (triggers debugger).
hlt → halt CPU until interrupt (rare, low-level).
ud2 → undefined instruction (forces exception).

Breakpoint Types

Software Breakpoint

Software breakpoint is represented by the CPU instruction: int3 or 0xCC. Creating software breakpoints directly modify the program's code. In some cases, malware may attempt to detect this.

Hardware Breakpoint

Hardware breakpoints are implemented by the CPU directly, and stored in the registers DR0, DR1, DR2 and DR3. Hardware breakpoints do not directly modify the program's executing code. This is advantageous when performing analysis. Note: Since only 4 registers exist for HW BP, you can only set 4 at a given time

Hardware Breakpoints can be set on either Address, or Memory Page (x64dbg -> Memory Map). You can specify conditions that cause the breakpoint to be triggered. See the table below:

Type	Breakpoint Description
Hardware, Access	When the address is accessed in any way, breakpoint is triggered
Hardware, Write	When the address is accessed and about to be written to breakpoint is triggered
Hardware, Execute	When the address is accessed for execution, breakpoint is triggered

Memory BreakPoint

Memory Breakpoints are implemented using by making modification to the Memory Protection attributes of a given memory page.

Memory, Access	When this memory page is accessed in any way, breakpoint is triggered
Memory, Read	When this memory page is accessed for a read operation, breakpoint is triggered
Memory, Write	When this memory page is accessed for a write operation, breakpoint is triggered
Memory, Execute	When this memory page is accessed for exection, breakpoint is triggered

Data Types

Local Variables

Stored on stack, accessed via [ebp-4], [rbp-8].

Global Variables

Stored in .data/.bss.
Heap → grows upward.
Stack → grows downward.

Array

Contiguous memory.
Address = base + (index * size).
Example (int[4] = {10,20,30,40}):

[0x1000] 0A 00 00 00  
[0x1004] 14 00 00 00  
[0x1008] 1E 00 00 00  
[0x100C] 28 00 00 00

Vector (C++ std::vector on Windows)

Internal layout:

+0x00 → pointer to heap data  
+0x08 → size  
+0x0C → capacity

Function Call Types

cdecl → Function args on stack Right to Left (R→L), caller cleans.
stdcall → Function args on stack (R→L), callee cleans.
fastcall → Function args in registers (ecx, edx), and the rest on stack.
x64 Windows → 1st 4 args in rcx, rdx, r8, r9; and the rest on stack.
call pushes return address → ret pops and returns.

cdecl

Args passed on stack (right-to-left).
Caller cleans stack.
Used by most C compilers (32-bit).

; int add(int a, int b)
add PROC
    mov eax, [esp+4]    ; a
    mov edx, [esp+8]    ; b
    add eax, edx
    ret
add ENDP

; Caller:
push 5
push 3
call add
add esp, 8             ; caller cleans up

stdcall

Args passed on stack (right-to-left).
Callee cleans stack.
Common in Windows API functions.

; int add(int a, int b)
add PROC
    mov eax, [esp+4]    ; a
    mov edx, [esp+8]    ; b
    add eax, edx
    ret 8               ; callee cleans up (2 args * 4 bytes)
add ENDP

; Caller:
push 5
push 3
call add
; no "add esp, 8" here, callee already cleaned

fastcall

First two arguments in registers (ecx, edx).
Remaining args on stack (right-to-left).
Callee usually cleans stack.

; int add(int a, int b)
add PROC
    mov eax, ecx        ; a
    add eax, edx        ; eax = a + b
    ret
add ENDP

; Caller:
mov ecx, 3              ; 1st arg → ecx
mov edx, 5              ; 2nd arg → edx
call add

x64 Windows call

First 4 args in rcx, rdx, r8, r9.
Additional args on stack.
Caller allocates "shadow space" (32 bytes) on stack before call.
Callee cleans local stack.

; int add(int a, int b)
add PROC
    mov eax, ecx        ; a in rcx (lower 32 bits → ecx)
    add eax, edx        ; b in rdx (lower 32 bits → edx)
    ret
add ENDP

; Caller:
sub rsp, 40             ; allocate 32-byte shadow space + alignment
mov ecx, 3              ; 1st arg → rcx
mov edx, 5              ; 2nd arg → rdx
call add
add rsp, 40             ; restore stack

DataTypes

Function Call Types