flat assembler
Message board for the users of flat assembler.
Index
> Windows > Tiny PE in win64Goto page Previous 1, 2, 3, 4 |
| Author |
|
|
revolution 19 Jul 2026, 17:59
The stack is not in the text section. "sub rsp,8" aligns the stack, not the code.
|
|||
|
|
Calendos 19 Jul 2026, 18:04
Thanks again. I'll think about your explanation.
|
|||
|
|
Calendos 20 Jul 2026, 17:44
Thank you for your contributions, which have helped me to better understand this alignment issue. Thank you also, bitRAKE, for clarifying the concepts involved. Consulting Microsoft's online documentation, I found an interesting reference in the article "Overview of x64 ABI conventions," the relevant section of which I've reproduced at the end of this message. This confirms that the stack is aligned to 4 bytes instead of 8. Hence, the corresponding action on RSP.
However, I still don't understand the alignment method that involves subtracting 8 from the RSP register (or the `push rbp` suggested by revolution). Personally, I would have preferred an instruction like: AND RSP,0FFFFFFFFFFFFFFF0 By doing so, we would truly align RSP to a QWord. From what I recall, I've never seen this kind of alignment practice in 64-bit MASM. But I have very little 64-bit programming experience. Could you recommend some reading material that would help me progress, if needed? Thank you in advance! Quote: Overview of x64 ABI conventions The text above is available at https://learn.microsoft.com/en-us/cpp/build/x64-software-conventions?view=msvc-170 |
|||
|
|
alCoPaUL 20 Jul 2026, 18:36
instead of messagebox, you can use printf and pass the output string through stdout & finally silently save it to a binary file, script or some kind of file format...
and still maintaining less than 1k byte size... _________________ Assembly Language Quines https://bitbucket.org/alcopavl/ia-64_quine/src/main/ https://bitbucket.org/alcopavl/x86x64/src/main/ https://github.com/alcopaul/beth_GviLLErMo_GIMO |
|||
|
|
bitRAKE 20 Jul 2026, 20:13
Calendos wrote: AND RSP,0FFFFFFFFFFFFFFF0 ExitProcess does not return. If that's the termination route of your application then the code doesn't even need to preserve non-volatile registers! The code can do POP REG -- not using the return and reuse caller's shadow-space. I like to use ENTER .frame, 0 -- just to save on code bytes, it's slower execution wise. AND RSP,-16 is only more valid when the stack value is unknown - like dynamic stack buffers. Let me know if you'd like an example - searching the board will no doubt return many from me. _________________ ¯\(°_o)/¯ AI may [not] have aided with the above reply. |
|||
|
|
revolution 20 Jul 2026, 23:41
Calendos wrote: However, I still don't understand the alignment method that involves subtracting 8 from the RSP register (or the `push rbp` suggested by revolution). Personally, I would have preferred an instruction like: Code: ; Inside the OS loader, that puts the program in memory ; here RSP is always aligned to 0 mod 16, as per the FASTCALL convention call [program_entry_point] ; address is in the PE header ; here RSP is now 8 mod 16, the return address was pushed onto the stack ; -------------------------------------------------------- ; now inside the program, the first instruction entry: push rbp ; (or sub rsp, 8 if preferred) ; here RSP is now 0 mod 16 again, proper alignment is guaranteed ; program does its thing here |
|||
|
|
AsmGuru62 24 Jul 2026, 00:32
The issue is that when Windows starts your program --- your aligned entry point is CALL-ed by Windows Loader.
Obviously a CALL instruction will put the return code into stack, misaligning it. 'text' section is aligned, of course. |
|||
|
|
Calendos 03 Aug 2026, 14:02
RSP alignment at the entry point of 64-bit programs
Revolution, bitRake, and AsmGuru62—thanks again for your contributions. I wanted to implement them in a simple 64-bit program designed to display the hexadecimal value of the RSP register at the entry point (see the end of this post). RSP value obtained with this program: 00000000-0009FF58 The program crashes if I remove the first line containing `sub rsp,8`, which confirms your observations. However, if I place that instruction immediately after `loop Loop4` rather than at the beginning, the program works again. I infer—perhaps incorrectly—that it is the Windows functions that do not support this misalignment. What do you think? Code: ; Viewing the contents of the RSP register at ; the entry point of a Windows 64-bit program. format PE64 GUI 5.0 entry start include 'win64a.inc' section '.text' code readable executable start: sub rsp,8 ; alignment of the RSP register mov rax,rsp add rax,8 ; actual value of RSP at program entry cld mov rdi,_RegContent mov rcx,16 ;==== Converting 64-bit binary value to asciiz string ==== Loop4: rol rax,4 push rax and al,0Fh cmp al,10 jb @F add al,7 @@: add al,30h stosb cmp rcx,9 jne @F mov al,'-' stosb @@: pop rax loop Loop4 ;===== Dispalying in a Message Box and Exit invoke MessageBox,NULL,_RegContent,_title,MB_ICONERROR+MB_OK invoke ExitProcess,NULL section '.data' data readable writeable _RegContent DB 32 dup(0) _title DB 'ESP register content when starting',0 section '.idata' import data readable writeable library kernel32,'KERNEL32.DLL',\ user32,'USER32.DLL' include 'api\kernel32.inc' include 'api\user32.inc' |
|||
|
|
revolution 03 Aug 2026, 14:35
Calendos wrote: I infer—perhaps incorrectly—that it is the Windows functions that do not support this misalignment. What do you think? Programs are free to use any alignment for RSP, or even use RSP for arithmetic, as long as the usage is purely internal and no API calls to external libraries or system calls are made. Mentioned in a previous post is Windows uses movapd (or maybe movdqa, maybe both) to copy register values to the shadow space in the stack. It is these instructions, and only these instructions that require alignment of the destination address. For "speed" of course. So calling an API function with a misaligned stack creates the problem for movdqa/movapd. BTW: Use push rbp instead of "sub rsp,8". |
|||
|
|
Calendos 04 Aug 2026, 05:37
Finally, I get it!!!!!
Have a great day, everyone. |
|||
|
| Goto page Previous 1, 2, 3, 4 < Last Thread | Next Thread > |
Forum Rules:
|
Copyright © 1999-2026, Tomasz Grysztar. Also on GitHub, YouTube.
Website powered by rwasa.