Practical Malware Analysis

Differences in x64 Architecture

The following are the most important differences between Windows 64-bit and 32-bit architecture:

• All addresses and pointers are 64 bits.

• All general-purpose registers—including RAX, RBX, RCX, and so on—have increased in size, although the 32-bit versions can still be accessed. For example, the RAX register is the 64-bit version of the EAX register.

• Some of the general-purpose registers (RDI, RSI, RBP, and RSP) have been extended to support byte accesses, by adding an L suffix to the 16-bit version. For example, BP normally accesses the lower 16 bits of RBP; now, BPL accesses the lowest 8 bits of RBP.

• The special-purpose registers are 64-bits and have been renamed. For example, RIP is the 64-bit instruction pointer. ...