Why mov [es:rbx],ax complies

flat assembler
Message board for the users of flat assembler.

Index > Compiler Internals > Why mov [es:rbx],ax complies

Author

Thread

l4m2

Joined: 15 Jan 2015
Posts: 648

l4m2

Code:

use64
mov [es:rbx],ax

3 bytes

14 Dec 2017, 07:40

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 16904
Location: In your JS exploiting you and your system

revolution

l4m2 wrote:

Why mov [es:rbx],ax complies?
Code:
use64
mov [es:rbx],ax    
3 bytes

Because it is a valid instruction?

14 Dec 2017, 07:41

l4m2

Joined: 15 Jan 2015
Posts: 648

l4m2

Document say es: is invalid in 64 bit mode. Is there a time when it still work?(like POP CS)

14 Dec 2017, 08:10

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 16904
Location: In your JS exploiting you and your system

revolution

The segment registers are still valid and must point to valid descriptors but the base and limit fields are ignored, only the access rights are used.

14 Dec 2017, 08:28

l4m2

Joined: 15 Jan 2015
Posts: 648

l4m2

Quote:

(Opcode)07 POP ES (Op/En)ZO (64b)Invalid (compat/leg)Valid (description)Pop top of stack into ES; increment stack
pointer.

Some say Invalid mean ignored and some say throw #UD, not sure which is correct

14 Dec 2017, 08:35

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 16904
Location: In your JS exploiting you and your system

revolution

You posted an ES override. That is different from POP ES. The POP ES instruction might not be valid, but the ES register is valid.

14 Dec 2017, 08:49

l4m2

Joined: 15 Jan 2015
Posts: 648

l4m2

Quote:

If an instruction uses base registers RSP/RBP and uses a segment override prefix to specify a non-SS segment, a
canonical fault generates a #GP (instead of an #SS). In 64-bit mode, only FS and GS segment-overrides are applicable
in this situation. Other segment override prefixes (CS, DS, ES and SS) are ignored. Note that this also means
that an SS segment-override applied to a “non-stack” register reference is ignored. Such a sequence still produces
a #GP for a canonical fault (and not an #SS)

So here treat ignore as allowed

Oh it seems the ES: is also not complied out

14 Dec 2017, 08:59

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 16904
Location: In your JS exploiting you and your system

revolution

That is for the stack registers RBP/RSP. For ordinary registers like RBX that paragraph does not apply.

14 Dec 2017, 09:11

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum