Section 8: x86/x64 Architecture

The Big Picture: The Language Your CPU Speaks

Different CPU families speak different "languages" of instructions. Almost every Windows PC speaks one language family: x86, in its 64-bit form x64. This section explains where it came from and what it looks like.

8.1 What Is x86?

What it is: x86 is a family of instruction sets (the full list of commands a CPU understands). Intel started it with the 8086 processor in 1978. It is still the instruction set almost every Windows PC CPU speaks today, in extended form.

"x86" usually means the 32-bit era of this design (also called IA-32), which dominated through the 1990s. It defines:

• The instructions the CPU understands (MOV, ADD, JMP, CALL, hundreds more)
• The registers those instructions can use
• How memory addresses are worked out
• How the CPU handles privilege levels, interrupts and more

A 32-bit design means registers and memory addresses are 32 bits wide. That limits one process to at most 4 GB of memory (2³² bytes). This ceiling became a real problem as RAM sizes grew.

8.2 What Is x64?

What it is: x64 (also called x86-64 or AMD64) is a 64-bit extension of x86. AMD introduced it first, in 2003, and Intel adopted it later. It keeps full backward compatibility with 32-bit x86 code and adds a 64-bit mode next to it.

Why it matters:

• 64-bit registers and addresses mean a process can in theory address up to 16 exabytes of memory (2⁶⁴ bytes). In practice current Windows and hardware allow much less, but it is far beyond the old 4 GB limit.
• It doubles the number of general-purpose registers (from 8 to 16). That alone measurably speeds up compiled code.
• It is why 64-bit Windows can use more than 4 GB of RAM, and why 32-bit apps are getting rare.

Almost every Windows PC sold since the mid-2000s runs in x64 mode. The CPU can still run older 32-bit x86 code, which is how many old apps still work today.

8.3 Registers in x86/x64

Registers are the tiny, ultra-fast storage spots inside the CPU core (see Section 3.1) that instructions work on directly. The names show the architecture's long history:

(The stack is a pile of temporary values in memory, like a stack of plates: you add to the top and take from the top.)

Spot the pattern. The same physical register can be used in its full 64-bit form (RAX) or as its lower 32-bit part (EAX). This is the backward-compatibility trick that lets 64-bit CPUs run 32-bit instructions correctly. Think of one big drawer where you can use the whole drawer or just the front half.

x64 also adds eight brand-new general-purpose registers (R8–R15) that do not exist in 32-bit mode at all.

8.4 Common Instructions

A tiny sample of the instruction types that make up most of all code that runs:

Every line of high-level code you have ever seen (a for loop, an if, a function call) is compiled (translated by a program called a compiler) into sequences of instructions like these.

8.5 Assembly Language Overview

What it is: Assembly language is the human-readable text form of raw machine instructions. It maps one-to-one (or nearly) onto the actual bits the CPU runs.

// High-level C code:
int total = a + b;

compiles down to something like:

MOV EAX, [a]      ; load the value of 'a' into register EAX
ADD EAX, [b]      ; add the value of 'b' to EAX
MOV [total], EAX  ; store the result into 'total'

Why this matters even if you never write assembly:

• It is the ground truth of what a CPU does. C, Python, Java and .NET all exist so you do not have to write this by hand.
• Debugging tools (like WinDbg, covered in Chapter 13) often show assembly when they diagnose crashes at the deepest level.
• An IF/ELSE becomes a CMP plus a conditional JMP. That is exactly why branch prediction (Section 5.2) matters so much: every conditional in every program you have ever run is, underneath, one of these jumps.

Summary