Systems Programming Glossary — 56 Must-Know Terms for Assembly, Compilers & Low-Level Development

Your Complete Systems Programming Glossary

This systems programming glossary is your definitive quick-reference for low-level development terminology. Whether you are writing assembly, studying compiler internals, or reverse-engineering an ELF binary, the 56 terms below will ground your understanding of how software meets hardware.

Every entry in this systems programming glossary includes a concise, expert-written definition and a Deep dive → link to a full tutorial on CoderMusings. Use the alphabetical navigation or the search bar to jump straight to the term you need.

For authoritative references beyond this systems programming glossary, see the System V AMD64 ABI Specification and the LLVM Language Reference Manual.

0-9

AAPCS64: ARM Architecture Procedure Call Standard for 64-bit. The calling convention used by ARM64/AArch64 on Linux, macOS, and most embedded environments. Defines X0–X7 for integer arguments and X19–X29 as callee-saved registers (X29 is the frame pointer, also preserved across calls). Deep dive →

ARM64 / AArch64: The 64-bit execution state of the ARM architecture (ARMv8-A and later). Uses 31 general-purpose 64-bit registers (X0–X30), a zero register (XZR), and fixed-width 32-bit instructions. Note: register encoding 31 maps to either XZR or SP depending on instruction context. Dominant in mobile and increasingly in servers and desktops (Apple Silicon). Deep dive →

ASLR (Address Space Layout Randomization): A security technique that randomizes the base addresses of the stack, heap, shared libraries, and executable segments each time a process is loaded, making it harder for attackers to predict memory locations. Deep dive →

AST (Abstract Syntax Tree): A tree representation of the syntactic structure of source code. Each node represents a construct (e.g., binary expression, function declaration, if-statement). The parser builds the AST from tokens, and subsequent compiler phases traverse it for semantic analysis and IR generation. Deep dive →

AT&T Syntax: The assembly syntax style used by the GNU Assembler (GAS) and default in GCC/Clang output on Unix systems. Distinguished by source-first operand order, % register prefixes, and $ immediate prefixes. Contrast with Intel syntax. Deep dive →

Basic Block: A straight-line sequence of instructions with no branches except at the entry and exit. Control flow enters at the top and exits at the bottom. Basic blocks are the fundamental units of control-flow graphs and SSA-form IR. Deep dive →

Breakpoint (Software / Hardware): A debugging mechanism that pauses program execution at a specific address. Software breakpoints work by replacing an instruction with a trap (int3 on x86-64, brk #0 on ARM64). Hardware breakpoints use CPU debug registers and don’t modify code. Deep dive →

BSS Section (.bss): The Block Started by Symbol section in an executable. Holds uninitialized global and static variables. Takes no space in the file on disk — the OS zero-fills the memory at load time. This is why uninitialized globals default to zero in C. Deep dive →

Callee-Saved Register: A register whose value must be preserved across function calls. If a function (the callee) wants to use it, it must save and restore it (typically via push/pop). Also called non-volatile registers. On System V x86-64: RBX, RBP, R12–R15. Deep dive →

Caller-Saved Register: A register that may be overwritten by any function call. The caller must save it before calling if it needs the value afterward. Also called volatile registers. On System V x86-64: RAX, RCX, RDX, RSI, RDI, R8–R11. Deep dive →

Calling Convention: A set of rules defining how functions receive parameters, return values, and which registers must be preserved. Different platforms use different conventions: System V AMD64 ABI (Linux/macOS x86-64), Microsoft x64 (Windows), and AAPCS64 (ARM64). Deep dive →

Constant Folding: A compiler optimization that evaluates constant expressions at compile time instead of generating code to compute them at runtime. For example, 3 + 4 * 2 is replaced by 11 in the compiled output. Deep dive →

Data Section (.data): The section of an executable that contains initialized global and static variables. Unlike .bss, these values occupy space in the file on disk because they have non-zero initial values that must be loaded into memory. Deep dive →

Dead Code Elimination: A compiler optimization that removes code which can never be executed or whose results are never used. This includes unreachable branches after constant folding, unused variable assignments, and functions that are never called (with LTO). Deep dive →

Dynamic Linker (ld.so / dyld): The runtime component that loads shared libraries (.so on Linux, .dylib on macOS) and resolves external symbols when a program starts or lazily at first call. On Linux it is ld-linux-x86-64.so.2; on macOS it is dyld. Windows uses a different model: ntdll.dll’s PE loader handles DLL loading and import resolution rather than a standalone dynamic linker. Deep dive →

Dynamic Linking: The process of deferring symbol resolution to load time or runtime, allowing multiple programs to share a single copy of a library in memory. Reduces executable size and enables library updates without recompilation, at the cost of slightly slower startup. Deep dive →

ELF (Executable and Linkable Format): The standard binary format on Linux and most Unix-like systems. Contains a file header, program headers (for loading), and section headers (for linking). Supports executables, shared objects (.so), relocatable objects (.o), and core dumps. Deep dive →

Function Epilogue: The sequence of instructions at the end of a function that tears down the stack frame and returns control to the caller. Typically restores the frame pointer and stack pointer, then executes a return instruction (ret on x86-64; ret on ARM64, which returns to the address in X30/LR). Deep dive →

Function Prologue: The sequence of instructions at the start of a function that sets up the stack frame. Typically saves the old frame pointer, establishes a new frame pointer, and allocates space for local variables on the stack. Deep dive →

GAS (GNU Assembler): The assembler in the GNU Binutils toolchain. Default on Linux. Uses AT&T syntax by default (switchable to Intel with .intel_syntax). Invoked as as or through GCC. Supports x86, ARM, MIPS, RISC-V, and many other architectures. Deep dive →

GOT (Global Offset Table): A table of pointers in position-independent code used to access global variables and functions from shared libraries. The dynamic linker fills GOT entries with actual runtime addresses. Each shared library and the executable have their own GOT. Deep dive →

Graph Coloring: The algorithm used by most production compilers for register allocation. Models registers as colors and variables as graph nodes. Two variables live at the same time share an interference edge. The goal: color the graph with K colors (K = physical registers) so no adjacent nodes share a color. Deep dive →

Instruction Selection: The compiler backend phase that maps target-independent IR operations to actual machine instructions. LLVM uses SelectionDAG and GlobalISel for this stage, pattern-matching IR nodes to architecture-specific instruction definitions. Deep dive →

Instruction Set Architecture (ISA): The abstract specification of a processor’s machine language: its instructions, registers, memory model, and encoding format. x86-64 and ARM64 are ISAs. A program compiled for one ISA cannot run natively on another. Deep dive →

Intel Syntax: The assembly syntax style originated by Intel. Uses destination-first operand order, no register prefixes, and square-bracket memory references. Used by NASM, MASM, and optionally by GAS with .intel_syntax noprefix. Deep dive →

Intermediate Representation (IR): A compiler’s internal representation of a program, sitting between the source language and target machine code. Designed to be language-independent and target-independent, making it ideal for optimization. LLVM IR is the most well-known example. Deep dive →

Lazy Binding: A dynamic linking strategy where external function addresses are resolved on first call rather than at program startup. The PLT stub initially jumps to the dynamic linker’s resolver, which patches the GOT entry for subsequent direct calls. Deep dive →

Lexer / Tokenizer: The first phase of a compiler frontend that reads raw source text and produces a stream of tokens — classified chunks like identifiers, keywords, operators, and literals. Discards whitespace and comments, feeding structured tokens to the parser. Deep dive →

LLVM IR: LLVM’s typed, SSA-form intermediate representation. Uses an infinite set of virtual registers, explicit types on every operation, and a human-readable text format (.ll files). Serves as the universal interface between LLVM frontends (Clang, Rust, Swift) and the target-specific backend. Deep dive →

Loader: The operating system component responsible for reading an executable file from disk, mapping its segments into virtual memory, setting up the stack and initial register state, and transferring control to the entry point (or the dynamic linker). Deep dive →

Loop Unrolling: A compiler optimization that replicates the body of a loop multiple times to reduce branch overhead and enable further optimizations like vectorization. Trades code size for speed. Behavior is compiler-dependent: LLVM/Clang enables it at -O2 (more aggressive at -O3), while GCC generally requires the explicit -funroll-loops flag. Deep dive →

LTO (Link-Time Optimization): An optimization technique where the compiler defers optimization until link time, enabling cross-module inlining, dead code elimination, and whole-program analysis. The compiler emits IR into object files, and the linker runs optimization passes on the combined IR. Deep dive →

Mach-O: The executable file format used by macOS, iOS, and other Apple platforms. Contains a header, load commands, and segments/sections. Supports fat/universal binaries bundling multiple architectures (x86-64 + ARM64) in one file. Deep dive →

MASM (Microsoft Macro Assembler): Microsoft’s assembler for x86/x64, using Intel syntax with unique directives (PROC, ENDP, INVOKE). Part of the Visual Studio toolchain as ml64.exe. Supports powerful macro facilities and structured programming constructs. Deep dive →

NASM (Netwide Assembler): A popular open-source x86/x64 assembler using Intel syntax. Widely used for learning assembly due to its clean, consistent syntax. Cross-platform (Linux, macOS, Windows). Produces ELF, Mach-O, PE, and raw binary output. Deep dive →

Optimization Pass: A single transformation applied to the IR during compilation. Each pass performs one specific optimization (constant folding, loop unrolling, DCE, etc.). Passes are chained in a pipeline; -O2 enables over 70 passes in LLVM. Deep dive →

Parser: The compiler phase that takes a token stream from the lexer and builds an Abstract Syntax Tree (AST) according to the language grammar. Validates syntactic correctness — mismatched braces, invalid expressions. Most modern C/C++ compilers (GCC, Clang) use hand-written recursive descent parsers, though parser-generator approaches (Bison, ANTLR) remain common in other compilers and DSLs. Deep dive →

PE (Portable Executable): The executable file format used by Windows for .exe, .dll, .sys files. Contains a DOS stub, PE signature, COFF headers, optional header with entry point and image base, and sections (.text, .data, .rdata, .reloc). Supports both x86-64 and ARM64. Deep dive →

PHI Node: An SSA construct that selects a value based on which predecessor basic block control flow came from. Necessary because in SSA form each variable has exactly one definition, so when two paths merge (e.g., after if/else), a PHI node chooses the correct version. Deep dive →

PLT (Procedure Linkage Table): A table of small code stubs used for calling dynamically-linked functions. On first call, the PLT stub invokes the dynamic linker to resolve the function address and patch the GOT. Subsequent calls jump directly through the patched GOT entry. Deep dive →

Process Loading: The sequence of steps the OS performs to launch a program: reading the executable header, mapping segments into virtual memory, initializing the stack, loading the dynamic linker (if needed), and jumping to the entry point. Triggered by execve() on Unix. Deep dive →

ptrace: A Unix system call that allows one process to observe and control the execution of another. The foundation of debuggers like GDB and LLDB. Supports reading/writing memory and registers, single-stepping, and intercepting signals and system calls. Deep dive →

Register: A small, fast storage location inside the CPU. x86-64 has 16 general-purpose 64-bit registers (RAX–R15); ARM64 has 31 (X0–X30) plus the zero register XZR. Registers are the fastest level of the memory hierarchy and the primary operands for instructions. Deep dive →

Register Allocation: The compiler backend phase that maps an unlimited number of virtual registers (from the IR) to the finite set of physical CPU registers. When there aren’t enough registers, some values must be spilled to stack memory. Most compilers use graph coloring. Deep dive →

Register Spilling: When the register allocator runs out of physical registers, it spills a value to a stack slot (memory) and reloads it when needed. Spilling is expensive because memory access is much slower than register access. Compilers use heuristics to choose which values to spill. Deep dive →

Relocation: A record in an object file that tells the linker to patch an instruction or data reference with the correct address once the final layout is known. Needed because the compiler doesn’t know where code and data will end up in the final binary. Deep dive →

SSA (Static Single Assignment): An IR property where every variable is assigned exactly once. When a variable would be reassigned, a new version is created (x1, x2, x3…). This simplifies many optimizations because def-use chains are trivially computed. PHI nodes handle control-flow merges. Deep dive →

Stack Frame: The region of the call stack allocated for a single function invocation. Contains the return address, saved frame pointer, callee-saved registers, local variables, and sometimes function arguments. Created by the prologue and destroyed by the epilogue. Deep dive →

Static Linking: Combining all object files and library code into a single self-contained executable at build time. The resulting binary has no runtime dependencies on shared libraries. Produces larger executables but avoids DLL hell and dynamic linker overhead. Deep dive →

Symbol Table: A data structure in object files and executables that maps symbol names (functions, global variables) to their addresses, sizes, and binding information (local, global, weak). The linker uses symbol tables to resolve cross-module references. Deep dive →

System Call (syscall / svc): The interface between user-space programs and the OS kernel. Transitions the CPU from user mode to kernel mode to request OS services (file I/O, memory allocation, process control). On x86-64 Linux: syscall; on ARM64: svc #0. Deep dive →

System V ABI: The calling convention used on Linux and macOS for x86-64. Arguments passed in RDI, RSI, RDX, RCX, R8, R9 (integers) and XMM0–XMM7 (floats). Return values in RAX/RDX. Includes a 128-byte red zone below RSP for leaf functions. Deep dive →

Text Section (.text): The section of an executable that contains the machine code instructions. Typically mapped as read-only and executable in memory. This is where your compiled functions live. Deep dive →

Virtual Memory: An abstraction that gives each process its own private, contiguous address space, mapped to physical memory by the CPU’s MMU via page tables. Enables process isolation, memory protection, demand paging, and shared libraries. Deep dive →

Windows x64 ABI: Microsoft’s calling convention for 64-bit Windows. Arguments in RCX, RDX, R8, R9 (integers) and XMM0–XMM3 (floats). Caller must always allocate 32 bytes of shadow space on the stack. No red zone. RDI and RSI are callee-saved (unlike System V). Deep dive →

x86-64: AMD’s 64-bit extension of the x86 instruction set (also called AMD64 or x64). A CISC architecture with variable-length instructions, 16 general-purpose 64-bit registers, and backwards compatibility with 32-bit x86. The dominant desktop and server architecture. Deep dive →