An interesting semi-abandonware static disassembler that was really good is Sourcer 8.01 from V-Communications. I think it supports Pentium II/Pro/III at most, which would include real, protected mode and long mode DOS/DOS extended/Win16/Win32 EXEs and COMs IIRC. It did a lot of memory typing and clever analysis long before IDA existed, and still interesting for retro computing.
https://www.vetusware.com/download/Sourcer%208.01%208.01/?id...
It's worth learning the Ghidra Scripting API because you can write ad-hoc scripts with Jython syntax to automate tasks/do custom analysis.
Thanks to the better RTTI Analyzer
I’ve never seen this name before. Where does it come from?
AMD call it AMD64. Intel call it Intel 64.
Why do we need even more names for the same thing beyond these two?!
x86_64, x86-64, x64, AMD64, amd64, Intel 64, EM64T, all mean the same thing!
When Intel was developing Itanium they named the new architecture IA-64 and retroactively named their 32-bit x86 line IA-32.
After AMD released "AMD64" Intel started copying the AMD 64-bit extensions. IA-32e was a short lived name and Intel started using "Intel 64" to refer to the 64-bit extension of x86 and continued using IA-64 for the Itanium VLIW CPU line.
https://en.wikipedia.org/wiki/X86-64#History_2
After several years of denying its existence, Intel announced at the February 2004 IDF that the project was indeed underway. Intel's chairman at the time, Craig Barrett, admitted that this was one of their worst-kept secrets.
Intel's name for this instruction set has changed several times. The name used at the IDF was CT (presumably[original research?] for Clackamas Technology, another codename from an Oregon river); within weeks they began referring to it as IA-32e (for IA-32 extensions) and in March 2004 unveiled the "official" name EM64T (Extended Memory 64 Technology). In late 2006 Intel began instead using the name Intel 64 for its implementation, paralleling AMD's use of the name AMD64.
I think we should call it AMD64, since that's what the people who actually designed it wanted it to be called.
The "x86-64" name is the original one, and came from AMD themselves: https://web.archive.org/web/20000817071303/http://www.amd.co... (and "x86_64" is obviously an alias for where a hyphen is not an allowed character, like identifiers on many programming languages).
The "x64" name came from Microsoft, probably due to file name length limitations (this was before Windows XP unified the Windows 9x and Windows NT lines).
IIRC, the "AMD64" name came later, probably to distinguish it better from Intel's IA-64 (Itanium).
Intel didn't want the x86 to be 64bit.. they wanted the world to switch to Itanium for that. I figure a lot of the naming mess can be traced back to Intel's marketing.
IA-32e/AMD64 is basically an extension of IA-32/x86. What you're looking for is to understand the difference between real mode, 386 protected mode, PAE, paging and long mode because the registers, instructions, addressing and sizes of structures differ.
You can learn all of this by reading the Intel software manuals and digging into it yourself.
Tools you need (for non-Windows):
- gdb/lldb
- assemblers: yasm, nasm, binutils (contains "as")
Optional tools:
- IDA Pro
- Virtualization/emulation such as VMware Fusion/Workstation (because it supports being a gdbserver), VirtualBox or QEMU
- Intel's CPUID app
You also need good references like:
- the Intel manual set (a giant PDF or a collection of several) https://software.intel.com/en-us/articles/intel-sdm
- https://sandpile.org (fairly current)
- https://ref.x86asm.net (outdated by useful)
Another helpful exercise is writing a toy operating system in Rust or only assembly. https://osdev.org has many resources and guides.