First, what's a register?
A register is a tiny piece of storage that lives inside the CPU itself, not in RAM. There are only a handful of them, but the CPU can read or write them at full clock speed (orders of magnitude faster than RAM). Every instruction you'll see in disassembly is shuffling values between registers, between registers and memory, or doing math on register values.
x86_64 has 16 main general-purpose registers: RAX, RBX, RCX, RDX, RSI, RDI, RBP, RSP, and R8 through R15. Each one is 64 bits wide. But for historical compatibility (x86 has been around since 1978), you can also access pieces of these registers under different names. That's what the next section explains.
The size pyramid: RAX contains EAX contains AX contains AL
A 64-bit register isn't just a 64-bit register. You can also name its lower 32 bits, its lower 16 bits, and even its individual bytes. Writes to a smaller alias don't change the high bits (with one exception, noted below). Here's the layout for RAX:
Two important rules:
- Writing to a 32-bit alias (like
mov eax, 5) zero-extends the value into the full 64-bit register, clearing the upper 32 bits. This is x86_64-specific behavior. - Writing to a 16-bit or 8-bit alias does NOT clear the higher bits; the unaffected bits keep their previous value. This is the source of many subtle bugs.
The same nesting works for the other registers, with these naming conventions:
The 16 registers
Each card below shows one register's aliases, its historical role, and what real code uses it for. The "Linux" and "Windows" rows refer to the two main calling conventions you'll meet: System V x86_64 (Linux, macOS, BSD) and Microsoft x64 (Windows). They use registers differently for function arguments and have different rules about which registers a function is allowed to clobber.
Calling convention cheatsheet
When function A calls function B, which registers hold the arguments? Which can B safely overwrite? The "calling convention" is the contract between caller and callee. Linux/macOS use the System V ABI; Windows uses its own. Here are the cliff notes:
Caller-saved (volatile): the caller is responsible for saving these if it needs their values preserved across the call. The callee can freely clobber them.
Callee-saved (non-volatile): the callee must preserve these. If it wants to use them, it must save and restore them.