Hello everyone. 1
In this lesson we are going to see the x86 processor mode. The Intel64 architecture introduces 2
a new mode called IA-32e mode which contains 2 sub modes the 64-bit mode and compatibility 3
mode. In 64-bit mode, 4
we can run 64-bit operating system and 64-bit programs. In compatibility mode. 5
We can run 16-bit. 6
or 32-bit programs under 64-bit operating system without recompiling those programs. 7
In this course we will only focus on 64-bit mode. So in 64-bit mode we have 16 64-bit 8
general purpose registers available to use and 64-bit flags register called rflags. 9
64-bit instruction pointer called RIP and 48-bit 10
virtual address support. The processor only implements 48-bit 11
virtual address 12
out of 64-bit address. An address is considered to be in canonical form 13
if bit 63 through to the most significant implemented bit by the micro architecture 14
are set to either all 1s or all 0s. 15
What does it mean? Let's look at the example. Suppose we have a 48-bit address from bit 0 16
to bit 47 and notice that the bit 47 is 1. 17
Bit 47 here is the most significant implemented bit. So we can only set the upper 16 bits which is from 18
bit 48 to bit 63 to all 1s. Other value in the 16 bits 19
in this case will be considered as an invalid address or non-canonical address. If we, for example, 20
have 0 in bit 47 then we can only set the upper 16 bits to all 0s okay. 21
Let's talk a little bit about RIP register 22
The instruction pointer or RIP register holds address of the next instruction to be executed 23
Suppose RIP holds the address of the instruction at address 3, the CPU will fetch the instruction in 24
this location from memory and execute. It also increments the RIP to make it point to the next instruction 25
then it will fetch the instruction from address 4 and execute, increments RIP register and it will 26
repeat the same process over and over. Notice that this is only for demonstrating purpose and there are 27
more processes involving here and the size of the x86 instructions. 28
are different, so the RIP will be incremented by different sizes depending on 29
the instructions. 30
By default the CPU just executes instructions sequentially as is shown in this example, but there are 31
some instructions which can manipulate the rip register which means they can modify the value of rip 32
to make the CPU branch to a new location. 33
And we will see those instructions later in this course. 34
OK. 35
Let's move on to the last part of this lesson. 36
The general purpose registers they are used for data transfer arithmetic and logical operations and some 37
other operations. As you can see here there are quite a few registers. 38
You don't have to memorize all their names. 39
I will show you the relations between these registers. Registers in the first column are the 64-bit 40
registers, the second column are the 32-bit registers, the third column 16-bit 41
registers and the last column 8-bit registers. Each row here contains the full 64-bit registers 42
and lower 32 bits, lower 16 bits and lower 8 bits of the registers. We will 43
use RAX as an example. Other registers follow the same pattern. The RAX is 64-bit register. 44
If we want to access 64 bits of the register, we simply use rax. If we want to access the lower 45
32 bits of the rax register, we can use the name eax. Likewise we use ax to access the lower 16 bits of 46
the rax register. You may notice that the first four rows of 8-bit registers have two different names 47
In this case, 48
ah is used to access the upper half of ax register and al the lower half of ax register. 49
Other 8-bit registers can only be used to access the lower 8 bits of the registers. 50
Okay the rsp register is used for stack operations and rbp is used for stack frame pointer 51
in some cases. So you can use all the other registers in your project for practice OK. 52
That is the introduction to the processor mode and I'll see you in the next lesson.