Background

Prior to diving into some of the analysis techniques that can be performed on x64 binaries, it's first necessary to learn a bit about some of the changes that were made to support the x64 architecture. This chapter will give a very brief explanation of some of the things that have been introduced, but will by no means attempt to act as an authoritative reference.

• PE32+ Image File Format
• Calling Convention
  • Stack Frame Layout
    • Parameters
    • Return Address
    • Locals
  
  
• Exception Handling on x64
  • Exception Directory
  • Unwind Information