x86 vs. ARM Architectures

The RE fundamentals lesson covered assembly using x86 examples throughout. This lesson explains why that choice needs revisiting for a growing share of real-world reverse engineering work — directly connecting to Path 13's mobile-security path, since every mobile device you'll ever analyze runs on the architecture this lesson introduces.

Why architecture matters before a single instruction is read

A disassembler translates machine code into assembly, but the actual instruction set — the vocabulary of what a CPU can execute — differs fundamentally between architectures. Opening a binary in Ghidra (from the previous lesson) without knowing which architecture it targets means potentially misreading the disassembly entirely, since x86 and ARM use structurally different instruction encodings, register naming, and calling conventions.

x86: the traditional PC and server architecture

x86 (and its 64-bit extension, x86-64) is a CISC (Complex Instruction Set Computer) architecture — individual instructions can be relatively complex, sometimes performing multiple operations (a memory read, an arithmetic operation, and a memory write) in a single instruction. This is the architecture the previous lesson's mov/add/cmp examples used, and it remains dominant on Windows and Linux desktop/server systems.

ARM: the mobile and increasingly everywhere architecture

ARM is a RISC (Reduced Instruction Set Computer) architecture — instructions are deliberately simpler and more uniform, generally each doing exactly one thing, with more instructions typically needed to accomplish the same task compared to x86's denser instruction encoding. ARM dominates mobile devices (every iOS and the overwhelming majority of Android devices, directly connecting to Path 13's mobile security coverage) and has increasingly expanded into laptops and cloud servers due to its power efficiency advantages.

; x86 example — a single instruction, memory operand allowed directly
add eax, [ebx+4]

; ARM equivalent — loads to a register first, then adds (two instructions)
ldr r1, [r0, #4]
add r0, r0, r1

Recognizing which architecture you're looking at

  • Register names — x86 uses eax/ebx/rax/rbx; ARM uses r0-r15 (32-bit) or x0-x30 (64-bit, ARM64/AArch64)
  • Instruction density — ARM assembly tends to be noticeably longer for equivalent logic, since RISC instructions each do less
  • Load/store pattern — ARM strictly separates memory access (ldr/str) from computation; x86 frequently combines both in one instruction, exactly as the example above shows

Why this matters specifically for mobile malware analysis

Directly connecting to Path 13's mobile app security path: analyzing a malicious Android app's native code (compiled C/C++ libraries bundled inside an APK, rather than the Java/Kotlin application layer) means reading ARM assembly, not x86 — the exact same Ghidra tooling from the previous lesson supports ARM disassembly directly, but an analyst who's only ever practiced reading x86 will need deliberate additional practice recognizing ARM's different patterns before mobile malware analysis feels comfortable.

Why does ARM assembly typically require more instructions than x86 to accomplish the same logical operation?

Show answerx86 is a CISC architecture, deliberately designed to let a single instruction perform multiple operations at once — the example in this lesson shows add eax, [ebx+4] reading a value directly from memory and adding it to a register in one instruction. ARM is a RISC architecture built on the opposite design philosophy: instructions are kept deliberately simple and uniform, with memory access strictly separated from computation (the "load/store" architecture referenced in this lesson) — meaning the equivalent operation requires one instruction to load the memory value into a register (ldr) and a separate instruction to perform the actual addition (add). This tradeoff isn't a design flaw on either side — RISC's simpler, more uniform instructions are generally easier to execute quickly and efficiently in hardware, which is a significant part of why ARM's power efficiency advantage over x86 matters so much for battery-powered mobile devices, even though it means ARM assembly reads as comparatively more verbose for equivalent logic.

Key terms

  • CISC — Complex Instruction Set Computer; x86's design philosophy, favoring fewer, more powerful instructions.
  • RISC — Reduced Instruction Set Computer; ARM's design philosophy, favoring simpler, more uniform instructions.
  • Load/store architecture — ARM's strict separation of memory access instructions from computation instructions.

Recap

  • x86 (CISC) and ARM (RISC) use fundamentally different instruction philosophies, requiring different reading habits when disassembling each.
  • ARM dominates mobile devices, making it essential for analyzing native code inside malicious mobile apps.
  • Register naming and instruction density are the fastest visual cues for identifying which architecture a disassembly listing targets.
  • The same Ghidra tooling from the previous lesson supports both architectures directly, but reading fluency requires separate, deliberate practice.

Next up → Malware Families Deep Dive