0Pricing
Cyber Security Academy · Lesson

x86/x64 Assembly Essentials for Reversers

Read MOV, CMP, JNE, CALL, RET and follow data flow through registers and the stack.

x86/x64 Assembly Essentials for Reversers is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Assembly for Reversers?

Ghidra's decompiler is helpful but imperfect — it misses some constructs, misinfers types, and can't decompile obfuscated code. Reading assembly directly provides ground truth. A reverser needs to read assembly, not write it.

Registers

x86-64 key registers:

  • RAX — accumulator, return values
  • RBX, RCX, RDX — general purpose
  • RSI, RDI — source/destination index, first/second function args
  • RSP — stack pointer
  • RBP — base pointer (stack frame)
  • RIP — instruction pointer

Function Call Convention (x64 Linux)

Arguments passed in registers (System V AMD64 ABI):

  1. RDI
  2. RSI
  3. RDX
  4. RCX
  5. R8
  6. R9

Return value in RAX. Additional args pushed on stack.

Essential Instructions

Core instructions to recognize:

mov rax, rbx    ; copy rbx to rax
push rax        ; push rax onto stack
pop rbx         ; pop top of stack into rbx
add rax, 8      ; rax = rax + 8
sub rsp, 0x20   ; allocate 32 bytes on stack
call 0x401234   ; call function at address
ret             ; return to caller
lea rax, [rbp-0x10] ; load address of local var

Conditional Jumps

Comparisons and branches:

cmp rax, 0      ; set flags based on rax - 0
test rax, rax   ; test rax & rax (check if zero)
jz  0x401234    ; jump if zero
jnz 0x401234    ; jump if not zero
jl  0x401234    ; jump if less (signed)
jge 0x401234    ; jump if >= (signed)
je  0x401234    ; jump if equal

Reading a Simple Function

Recognizing common patterns:

; if (x == 0) return 1;
mov eax, [rbp-4]    ; load x
test eax, eax       ; x == 0?
jnz .notZero        ; if not zero, skip
mov eax, 1          ; return value = 1
ret
.notZero:
...

Recognizing String Operations

Common string/memory operations:

; memcpy(dest, src, n):
; rdi=dest, rsi=src, rdx=n
rep movsb           ; copy RCX bytes from RSI to RDI

; strlen-like loop:
.loop:
  cmp byte [rsi], 0 ; check for null terminator
  je  .done
  inc rsi
  jmp .loop

Stack Frame Setup/Teardown

Every function begins and ends with:

; Prologue:
push rbp            ; save caller frame
mov  rbp, rsp       ; set up new frame
sub  rsp, 0x30      ; allocate local vars

; Epilogue:
leave               ; mov rsp, rbp; pop rbp
ret

Identifying Loops

Loops in disassembly:

  • A backward jump (lower address) indicates a loop
  • Counter in a register decremented with dec/sub
  • loop instruction decrements RCX and jumps if non-zero

Reading Switch Statements

Switch statements often compile to jump tables:

; Jump table pattern:
cmp eax, 5          ; check if case > max
ja  .default        ; jump to default
lea rcx, [jump_table]
mov rax, [rcx + rax*8]  ; index into table
jmp rax              ; jump to case handler

SIMD and Crypto Constants

Look for numeric constants that identify algorithms:

  • AES S-box: first bytes 63 7C 77 7B...
  • SHA-256 initial hash: 0x6a09e667, 0xbb67ae85...
  • MD5: 0xd76aa478

Recognizing these constants instantly identifies cryptographic functions.

Quick Check: x64 Assembly

In the x86-64 System V ABI, which register holds the first argument to a function call?

Lesson Recap

x86-64 reversing requires knowing key registers (RAX, RDI, RSI, RSP, RIP), function calling conventions (args in RDI/RSI/RDX...), and common patterns (prologues, loops, comparisons, jump tables). You don't need to write assembly — just read it. Crypto constants in code identify algorithms without running the binary.

Frequently asked questions

Is the “x86/x64 Assembly Essentials for Reversers” lesson free?

Yes — the full text of “x86/x64 Assembly Essentials for Reversers” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “x86/x64 Assembly Essentials for Reversers”?

Read MOV, CMP, JNE, CALL, RET and follow data flow through registers and the stack. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “x86/x64 Assembly Essentials for Reversers” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Ghidra: Navigating and Annotating Binaries
  2. x86/x64 Assembly Essentials for Reversers
  3. Dynamic Analysis with GDB and pwndbg
  4. Deobfuscation and Anti-Analysis Tricks
← Back to Cyber Security Academy