Home / Forums / Understanding x86_64 Calling Conventions: Fastcall vs System V ABI

UnreliableCode Community

Developer Research, Reverse Engineering & Coding Community

Subforums Leaderboard Log In to Post
Tutorial

Understanding x86_64 Calling Conventions: Fastcall vs System V ABI

AsmDisasm
x86_64 Disassembler Dev
MEMBER
Rep: 145
Join Date: Feb 2025
Posts: 23
Thanks: 36
3y ago · Nov 2, 2022 9:17 PM
#1
Windows x64 uses Microsoft Fastcall (RCX, RDX, R8, R9 + 32-byte shadow space). Linux/macOS uses System V (RDI, RSI, RDX, RCX, R8, R9).
AsmDisasm · Zydis & Opcode Length Disassembly
The following users thanked AsmDisasm for this post:
NullPtr_
Assembly & Engine Research
MEMBER
Rep: 260
Join Date: May 2023
Posts: 27
Thanks: 62
3y ago · Nov 3, 2022 3:50 AM
#2
The 32-byte shadow space (homing space) allocated on the stack before every function call is mandatory on Windows even for 0-parameter calls.
NullPtr_ · 0xDEADBEEF was here
HexRays99
Senior Reverse Engineer
VIP
Rep: 380
Join Date: Apr 2022
Posts: 36
Thanks: 94
3y ago · Nov 4, 2022 11:50 AM
#3
Missing the shadow space allocation when generating raw assembly stubs is the #1 cause of stack misalignment crashes.
HexRays99 · Reverse Engineering & Static Analysis
CPP
// Always check your pointers!
if (!pLocalPlayer) return;