Episode
Course 33 - Static Analysis for Reverse Engineering | Episode 5: Register Fundamentals, Graphical Analysis, and the Easy Peasy Solution
- Podcast
- CyberCode Academy
- Published
- May 17, 2026
- Duration seconds
- 1205
- Processing state
not_requested
Actions
POST https://stenobird.com/v1/public/podcasts/cybercode-academy-7578615/episodes/course-33-static-analysis-for-reverse-engineering-episode-5-register-fundamentals-graphical-analysis-and-the-easy-peasy-solution/transcription-requests
Idempotently request low-priority transcript generation for this episode.GET https://stenobird.com/podcast/cybercode-academy-7578615/course-33-static-analysis-for-reverse-engineering-episode-5-register-fundamentals-graphical-analysis-and-the-easy-peasy-solution.md
Read the agent-friendly Markdown representation of this episode resource.
Summary
In this lesson, you’ll learn about: cracking 64-bit software and understanding architectural differences1. Transition from 32-bit to 64-bit🔹 Register Naming Changes 32-bit: EAX, EBX, ECX 64-bit: RAX, RBX, RCX 🔹 New Registers Additional registers introduced: R8 → R15 👉 These give you: More space for data handling More efficient execution 2. Key Difference: Parameter Passing🔹 32-bit Systems Arguments passed via: Stack 🔹 64-bit Systems Arguments passed via: Registers (faster & cleaner) 🔹 Common Calling Convention (Important) First parameters usually go into: RCX RDX R8 R9 👉 This changes how you: Trace function calls Identify input comparisons 3. Identifying a 64-bit Binary Use tools like: Detect It Easy Look for: PE64 format 4. Practical Analysis WorkflowUsing: x64dbg 🔹 Step 1: Find Key Strings Search for: “Wrong password” “Access denied” 👉 Leads you to: Validation functions 🔹 Step 2: Use Graph View (CFG)** Press: G This shows: Decision branches Logic flow 🔹 Step 3: Locate Decision Points Identify: Comparisons (CMP) Conditional jumps (JE, JNE, etc.) 🔹 Step 4: Trace Credentials** Follow: Register values (NOT stack like before) 👉 Look inside: RCX / RDX / R8 / R9 5. “Fishing” for Credentials Track how input is compared against: Hardcoded values Stored strings 👉 Often you’ll find: Correct username/password directly in registers 6. Essential x64dbg Graph Shortcuts🔹 Navigation & Simulation Enter Follow a branch - (Minus) Go back 🔹 Synchronization S key Return to origin of graph 🔹 Trace Recording Highlights: Actual execution path 👉 Helps you see: What REALLY happens during runtime Key Takeaways 64-bit = new registers + new workflow Parameters are passed via registers, not stack CFG makes logic easier to understand Credential checks are still: Comparisons + jumps Core cra…