A register name is not a meaning.
Start with a deliberately boring function:
int five_ints(int a, int b, int c, int d, int e);And a deliberately boring call:
five_ints(1, 2, 3, 4, 5);Nothing about the source is clever. Every argument is visible. The return value is a plain int. There is no hidden structure return, no C++ receiver, no varargs, no virtual dispatch, and no interesting object model problem. That is why the example is useful. If the generated call differs across targets, the difference is the ABI packet.
The concrete artifact is the ecx trap:
; Windows x64
mov ecx, 1 ; a; System V AMD64 mov ecx, 4 ; d
The same physical register carries different semantic fields under different ABIs. On Windows x64, integer arguments in the leftmost four positions use RCX, RDX, R8, and R9; the fifth argument goes on the stack after the caller-provided home area. On System V AMD64, the integer register sequence begins RDI, RSI, RDX, RCX, R8, R9. On AArch64 Linux, this all-integer call maps cleanly to w0 through w4.
The claim is small but important: a source-level call does not carry a universal register schema. The ABI gives locations meaning. Without that schema, rcx is just a register.
This is where reverse-engineering, tracing, hooking, and FFI code go wrong. A tool that labels rcx as “argument 1” has already made a platform claim. That claim is correct in one context and wrong in another. The machine may still execute the instruction stream. The failure is not necessarily an illegal instruction or an immediate crash. It may be a valid instruction stream in the wrong language.
The boundary is also important. A compiler listing is a receipt, not the authority. Optimizers can inline, fold, tail-call, spill, or reshape a wrapper while still respecting the ABI at the real boundary. The ABI document defines the contract; the assembly gives you a microscope for one controlled source shape.
Read the full essay on lospino.so: Same Function, Three Realities
Original essay published on lospino.so on 2026-06-01. This Substack dispatch is an adapted pointer to the canonical version, not a mirrored copy.