Setup

• CPU that supports x86-64, with Windows 10 installed
• Visual Studio Community/Enterprise Edition, with C++ toolchain installed
  • Microsoft Macro Assembler (x64), ml64.exe
  • Microsoft Incremental Linker, link.exe
  • Windows 64-bit Application Programming Interface, kernel32.Lib
• Place a copy of ...\um\x64\kernel32.Lib in this directory.
• Change the PATH variable to also point to the MASM and linker folders, or edit %pathToMASMFolder% in run.bat to point to the correct folder.

Run

Run run.bat and select an example file.

x86-64 Registers in Windows 10

Register	Hardware	Software: x64 Calling Convention
RAX	Default accumulator	Return value, volatile
RBX	Index	Nonvolatile
RCX	Loop counter	1st integer argument, volatile, usually exit status code
RDX		2nd integer argument, volatile
RSI	Source index	Nonvolatile
RDI	Destination index	Nonvolatile
RBP	Base pointer	Nonvolatile
RSP	Stack pointer	Nonvolatile
R8, R9		3rd/4th integer argument, volatile
R10, R11		Volatile
R12-R15		Nonvolatile

Application Binary Interface

Shadow spaces in x64

Called procedure assumes:

• stack contains room for storing four 64-bit registers,
• RSP stack pointer is aligned on a 128-bit address boundary, And since, CALL instruction pushes its return address (8 bytes) onto the stack, so a shadow space of 40 bytes is typically reserved on the stack before procedure calls