Upon running info registers in gdb, we get an output similar to the following:rax            0x1c 28rbx            0x0  0rcx            0x400a60 4196960rdx            0x7fffffffde88   140737488346760rsi            0x1  1rdi            0x400932 4196658rbp            0x0  0x0rsp            0x7fffffffde68   0x7fffffffde68r8             0x400ad0 4197072r9             0x7ffff7dea560   140737351951712r10            0x7fffffffdc30   140737488346160r11            0x7ffff7732dd0   140737344908752r12            0x4007f0 4196336r13            0x7fffffffde80   140737488346752r14            0x0  0r15            0x0  0rip            0x7ffff7732dd0   0x7ffff7732dd0eflags         0x202    [ IF ]cs             0x33 51ss             0x2b 43ds             0x0  0es             0x0  0fs             0x0  0gs             0x0  0While I do understand the for rax, rcx etc, GDB is converting the value to decimal for the second column, this doesn't seem consistent. Some registers, namely rsp and rip show the same value in hex, even in the second column. eflags on the other hand shows the flags in the second column.What is the reason that gdb does this? If it is going to show the same info (in case of rsp and rip), isn't it redundant? Also, how does this generalize on other architectures? (The above output is for x86-64).Source. I re-asked this question since I thought I would find more specific answer in reverse engineering point of view.
Output of gdb `info registers`
gdb;register
In fact, in assembly you can find only three types of values:Numerical values;Memory addresses;Instructions (opcodes).General purpose registers, such as rax, rbx, ..., are used to store either numerical values (that will trigger the behavior of the program) or memory addresses (to know where to read/write or to jump).Of course, as most of human beings are used to decimal format for the values used in programs, it is important to display a decimal format when the register might contain such values.Now, it is important to know that memory addresses are usually given in hexadecimal format (mainly for compactness reasons). And, general purpose registers might also contain memory addresses. That is why gdb display both decimal and hexadecimal formats just in case one or the other is the best suitable for the current value.The registers rsp, rip (and rbp) are special cases because they are specifically used to store addresses (and only this), thus it would be of no use to translate the content of such registers into decimal format. That is why gdb is only giving an hexadecimal format for these registers.Finally, the case of the rflags/eflags is a bit special because this register has a meaning that is bit-per-bit dependent (see the following figure).Therefore, giving the decimal, hexadecimal or binary format is not really useful to the user (except if you can relate the numbers to the flags instantly). But, it is much more useful to give the list of flags that are set as 'true' (this is the [ IF ] that you see in your example). Yet, gdb gives the hexadecimal value of the eflags as it can be accessed and used as a value in programs (I have seen this for obfuscation purpose).