Tiny PE in win64

Index > Windows > Tiny PE in win64

Goto page Previous 1, 2, 3, 4

Author

Thread

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 21009
Location: In your JS exploiting you and your system

revolution 19 Jul 2026, 17:59

The stack is not in the text section. "sub rsp,8" aligns the stack, not the code.

19 Jul 2026, 17:59

Calendos

Joined: 20 Jan 2021
Posts: 17
Location: France

Calendos 19 Jul 2026, 18:04

Thanks again. I'll think about your explanation.

19 Jul 2026, 18:04

bitRAKE

Joined: 21 Jul 2003
Posts: 4545
Location: vpcmpistri

bitRAKE 19 Jul 2026, 19:24

There are two concepts being overlayed: load-time alignment and runtime alignment. At load-time the OS aligns the section, but the entry-point address need not be aligned - the loader can CALL an odd address.

At runtime the ABI requires RSP alignment prior to CALL'ing an ABI function -- the loader assumes the entry-point is such a function. This means that on the application side a return address has been pushed on an aligned stack. In general, at entry to any ABI function the stack is unaligned by the return address.

It is important to become familiar with this ABI execution model: the CALL'er perspective (aligned) and the CALL'ee perspective (unaligned). Therefor, if a CALL'ee wished to execute an ABI function that CALL'ee would need to align the stack and create shadow-space -- otherwise there is potential for various crashes.

_________________
¯\(°_o)/¯ AI may [not] have aided with the above reply.

19 Jul 2026, 19:24

Calendos

Joined: 20 Jan 2021
Posts: 17
Location: France

Calendos 20 Jul 2026, 17:44

Thank you for your contributions, which have helped me to better understand this alignment issue. Thank you also, bitRAKE, for clarifying the concepts involved. Consulting Microsoft's online documentation, I found an interesting reference in the article "Overview of x64 ABI conventions," the relevant section of which I've reproduced at the end of this message. This confirms that the stack is aligned to 4 bytes instead of 8. Hence, the corresponding action on RSP.

However, I still don't understand the alignment method that involves subtracting 8 from the RSP register (or the `push rbp` suggested by revolution). Personally, I would have preferred an instruction like:

AND RSP,0FFFFFFFFFFFFFFF0
By doing so, we would truly align RSP to a QWord.

From what I recall, I've never seen this kind of alignment practice in 64-bit MASM. But I have very little 64-bit programming experience. Could you recommend some reading material that would help me progress, if needed?

Thank you in advance!

Quote:

Overview of x64 ABI conventions
…
Conflicts with the x86 compiler
Data types that are larger than 4 bytes aren't automatically aligned on the stack when you use the x86 compiler to compile an application. Because the architecture for the x86 compiler is a 4 byte aligned stack, anything larger than 4 bytes, for example, a 64-bit integer, can't be automatically aligned to an 8-byte address.
Working with unaligned data has two implications.
• It may take longer to access unaligned locations than it takes to access aligned locations.
• Unaligned locations can't be used in interlocked operations.
If you require more strict alignment, use __declspec(align(N)) on your variable declarations. This causes the compiler to dynamically align the stack to meet your specifications. However, dynamically adjusting the stack at run time may cause slower execution of your application.
…

The text above is available at https://learn.microsoft.com/en-us/cpp/build/x64-software-conventions?view=msvc-170

20 Jul 2026, 17:44

alCoPaUL

Joined: 20 Jun 2023
Posts: 12
Location: NYC

alCoPaUL 20 Jul 2026, 18:36

instead of messagebox, you can use printf and pass the output string through stdout & finally silently save it to a binary file, script or some kind of file format...

and still maintaining less than 1k byte size...

_________________
Assembly Language Quines
https://bitbucket.org/alcopavl/ia-64_quine/src/main/
https://bitbucket.org/alcopavl/x86x64/src/main/
https://github.com/alcopaul/beth_GviLLErMo_GIMO

20 Jul 2026, 18:36

bitRAKE

Joined: 21 Jul 2003
Posts: 4545
Location: vpcmpistri

bitRAKE 20 Jul 2026, 20:13

Calendos wrote:

AND RSP,0FFFFFFFFFFFFFFF0

There are several ways to perform the alignment, but we also should ask ourselves, "Will this function return?"; "Does the code need to preserve the state provided by the caller?"

ExitProcess does not return. If that's the termination route of your application then the code doesn't even need to preserve non-volatile registers! The code can do POP REG -- not using the return and reuse caller's shadow-space.

I like to use ENTER .frame, 0 -- just to save on code bytes, it's slower execution wise.

AND RSP,-16 is only more valid when the stack value is unknown - like dynamic stack buffers. Let me know if you'd like an example - searching the board will no doubt return many from me.

_________________
¯\(°_o)/¯ AI may [not] have aided with the above reply.

20 Jul 2026, 20:13

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 21009
Location: In your JS exploiting you and your system

revolution 20 Jul 2026, 23:41

Calendos wrote:

However, I still don't understand the alignment method that involves subtracting 8 from the RSP register (or the `push rbp` suggested by revolution). Personally, I would have preferred an instruction like:

AND RSP,0FFFFFFFFFFFFFFF0
By doing so, we would truly align RSP to a QWord.

Consider the flow of instructions just before the program executes its first instruction.

Code:

; Inside the OS loader, that puts the program in memory
; here RSP is always aligned to 0 mod 16, as per the FASTCALL convention

    call [program_entry_point] ; address is in the PE header
; here RSP is now 8 mod 16, the return address was pushed onto the stack

; --------------------------------------------------------

; now inside the program, the first instruction
entry:
    push rbp                        ; (or sub rsp, 8 if preferred)
; here RSP is now 0 mod 16 again, proper alignment is guaranteed

; program does its thing here

20 Jul 2026, 23:41

AsmGuru62

Joined: 28 Jan 2004
Posts: 1816
Location: Toronto, Canada

AsmGuru62 24 Jul 2026, 00:32

The issue is that when Windows starts your program --- your aligned entry point is CALL-ed by Windows Loader.
Obviously a CALL instruction will put the return code into stack, misaligning it.
'text' section is aligned, of course.

24 Jul 2026, 00:32

Goto page Previous 1, 2, 3, 4

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum