Reverse Engineering for Beginners

APPENDIX A. X86 APPENDIX A. X86

A.2.15 RSP/ESP/SP/SPL

7th(byte number) 6th 5th 4th 3rd 2nd 1st 0th

RSP

ESP

SP

SPL

AKAstack pointer. Usually points to the current stack except in those cases when it is not yet initialized.

A.2.16 RBP/EBP/BP/BPL.

7th(byte number) 6th 5th 4th 3rd 2nd 1st 0th

RBP

EBP

BP

BPL

AKAframe pointer. Usually used for local variables and accessing the arguments of the function. More about it: (7.1.2 on
page 59).

A.2.17 RIP/EIP/IP

7th(byte number) 6th 5th 4th 3rd 2nd 1st 0th

RIPx64

EIP

IP

AKA“instruction pointer”^1. Usually always points to the instruction to be executed right now. Cannot be modified, however,
it is possible to do this (which is equivalent):

MOV EAX, ...
JMP EAX

Or:

PUSH value
RET

A.2.18 CS/DS/ES/SS/FS/GS

16-bit registers containing code selector (CS), data selector (DS), stack selector (SS).

FS in win32 points toTLS, GS took this role in Linux. It is done for faster access to theTLSand other structures like
theTIB.
In the past, these registers were used as segment registers (94 on page 868).

A.2.19 Flags register

AKAEFLAGS.

(^1) Sometimes also called “program counter”