Reverse › Module 2 › Lesson 2
Registers
General-purpose and instruction-pointer registers hold RE state — read them in gdb on $RE_LAB, not on unauthorized live systems.
Visual · re_registers
Register literacy. $RE_LAB only. Original Cyberlium.
Opening
Registers are the CPU's scratchpad — every branch and compare leaves clues.
x86-64 names include RAX–RDX for values, RSI/RDI for string ops, RBP/RSP for stack frame, and RIP for the next instruction. ARM64 uses X0–X30 and PC. Debuggers display registers after each step — comparing register values to expected inputs unlocks crackme checks on $RE_LAB. Cyberlium teaches register literacy for tracing YOUR toy binaries. You will NOT use register knowledge to inject into unauthorized processes. Next: Stack/Heap.
1. General-purpose registers (named)
RAX often holds return values; RCX/RDX/R8/R9 carry arguments in Microsoft x64 calling convention. RFLAGS stores comparison results — zero flag after CMP drives conditional jumps.
On $RE_LAB, break before compare instructions and inspect RAX/RDI against your guessed password — document findings in chmod 600 notes.
Command guide
Try these commands — General-purpose registers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
x86-64 ABI — https://refspecs.linuxfoundation.org/elf/x86_64-abi-0.99.pdf (register literacy) nm(1) — https://man7.org/linux/man-pages/man1/nm.1.html (symbol names for registers context) GNU GDB registers — https://sourceware.org/gdb/current/onlinedocs/gdb.html/Registers.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install binutils
macOS: Built-in (Xcode CLI) or brew install binutils Built-in or brew install binutils
Windows: Use WSL binutils
═══ LINUX / macOS ═══
Optional command
sudo apt install binutils gdb # objdump nm gdb
Command — copy this
export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
objdump -d "$LAB_RE/bin/hello" | grep -E '<main>|call|ret' | head -12
nm "$LAB_RE/bin/hello" | grep -E ' main| puts' | head -6Primary tools to practice this lesson: objdump, nm. Reference sites: x86-64 ABI (https://refspecs.linuxfoundation.org/elf/x86_64-abi-0.99.pdf); nm(1) (https://man7.org/linux/man-pages/man1/nm.1.html); GNU GDB registers (https://sourceware.org/gdb/current/onlinedocs/gdb.html/Registers.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. RIP, RSP, and RBP
RIP points to the current instruction — disassembly view centers here. RSP is the stack pointer; RBP often anchors the stack frame for local variables.
Stack overflows are exploit-topic territory — here you only read frame layout to follow local buffers in toy crackmes.
3. Register hygiene in RE notes
Log register snapshots at key addresses with timestamp and binary sha256. Screenshots from $RE_LAB gdb sessions beat guessing from stale forum posts.
Ship: register cheat sheet — eight registers, role, one crackme observation each on YOUR toy binary. Next: Stack/Heap.
4. What you ship: register cheat sheet for $RE_LAB
Eight registers with roles + one observation from YOUR toy binary trace. $RE_LAB named. chmod 600.
5. What you record before the next lesson
Date. Register sheet. $RE_LAB named. File t23-m02-l02-registers.txt chmod 600.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Inject into neighbor's process 'to read registers.' Skip logging RIP at branch points.
Right
Write register cheat sheet from $RE_LAB trace. Next: Stack/Heap.
Mission: build YOUR register cheat sheet
1) List RAX, RCX, RDX, RDI, RSI, RBP, RSP, RIP with one-line roles. 2) Note one value observed at a compare in YOUR toy binary. 3) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Compare instructions connect registers to control flow.
Knowledge Check
APPLY: Register literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: RIP points to the current instruction address.
True or False
Knowledge Check
APPLY: After CMP, conditional jumps often consult:
Multiple choice