Article by Ayman Alheraki on May 12 2026 12:58 PM
xxxxxxxxxx+--------+---------+----------+-------+--------+--------+| REX | OPCODE | ModR/M | SIB | DISP | IMM |+--------+---------+----------+-------+--------+--------+
Not all fields are always present, but this is the maximum structure.
xxxxxxxxxxMACHINE INSTRUCTION BYTES|v+-----------------------------+| REX PREFIX || 0100WRXB |+-----------------------------+| | | || | | +--> R/M or BASE extension| | +---------> INDEX extension (SIB)| +-----------------> REG extension+-------------------------> 64-bit operand size|v+-----------------------------+| OPCODE |+-----------------------------+|v+-----------------------------+| ModR/M || MOD | REG | R/M |+-----------------------------+|v+-----------------------------+| SIB || SCALE | INDEX | BASE |+-----------------------------+|v+-----------------------------+| FINAL REGISTER SELECTION || 4-bit = REX + 3-bit field |+-----------------------------+
This is the most important diagram.
xREX BYTE+------------------+| W R X B |+------------------+| | | || | | +----------------------+| | +--------------------+ || +------------------+ | || | | |v v v v+------------------------------------------------------+| ModR/M BYTE || 7 6 5 4 3 2 1 0 || MOD REG R/M |+------------------------------------------------------+| | || | || | +----------------------+| | || v v| REX.R extends REG REX.B extends R/M| (or SIB base)|v+------------------------------------------------------+| SIB BYTE || 7 6 5 4 3 2 1 0 || SCALE INDEX BASE |+------------------------------------------------------+| || |v vREX.X extends REX.B extends BASEINDEX
xxxxxxxxxxFinal Register = (REX bit << 3) + 3-bit field
So:
xxxxxxxxxx0xxx → RAX–RDI1xxx → R8–R15
xxxxxxxxxxmov r10, [r8 + r9*4]
xxxxxxxxxxREX ModR/M SIB DISP
Example breakdown:
xxxxxxxxxx4C 04 8C ...
xxxxxxxxxx4C = 01001100
Split:
xxxxxxxxxx0100 W R X B1 1 0 0
Meaning:
W = 1 → 64-bit operand
R = 1 → REG extended
X = 0 → INDEX not extended
B = 0 → BASE not extended
xxxxxxxxxx04 = 00000100
Split:
xxxxxxxxxx00 000 100MOD REG R/M
Meaning:
MOD = 00 → memory addressing
REG = 000
R/M = 100 → indicates SIB follows
xxxxxxxxxx8C = 10001100
Split:
xxxxxxxxxx10 001 100SCALE INDEX BASE
Meaning:
SCALE = 10 → multiply by 4
INDEX = 001
BASE = 100
xxxxxxxxxxREX.X = 0INDEX = 001 → RCX
xxxxxxxxxxREX.B = 0BASE = 100 → RSP
Final expression:
xxxxxxxxxx[rsp + rcx * 4]
xxxxxxxxxxMACHINE CODE4C 04 8C ...|v+------------------+| REX = 4C || W R X B = 1 1 0 0|+------------------+|v+------------------+| ModR/M = 04 || REG=000 R/M=100 |+------------------+|vR/M = SIB present|v+------------------+| SIB = 8C || SCALE=4 || INDEX=RCX || BASE=RSP |+------------------+|v+------------------+| Final Address || [rsp + rcx*4] |+------------------+
Think of decoding like stacking layers:
xxxxxxxxxxREX → extends registers (adds 4th bit)ModR/M → chooses operation + base structureSIB → enables complex memory mathDISP → adds constant offsetIMM → immediate value
REX extends register encoding, ModR/M selects operands, and SIB builds complex memory addressing like:
[base + index * scale + displacement]