Stack shift under win64 confused

flat assembler
Message board for the users of flat assembler.

Index > Windows > Stack shift under win64 confused

Author

Thread

Wztml

Joined: 08 Mar 2012
Posts: 6
Location: China

Wztml 09 Mar 2012, 12:43

Here is the code:

Code:

format PE64 GUI
entry start

include 'win64ax.inc'

section '.text' code readable executable

        start:
                sub     rsp,8*5
                mov     r9d,0
                lea     r8,[_caption]
                lea     rdx,[_text]
                mov     rcx,0
                call    [MessageBoxA]
                add     rsp,8*5

                nop
                nop
                nop
                nop

                sub     rsp,8*5
                invoke  MessageBoxA,0,_text,_caption,0,MB_OK
                invoke  ExitProcess,0

section '.data' data readable writeable

        _caption        db  'Test',0
        _text           db  'Hello World',0

section '.idata' import data readable writeable

        library kernel32,'KERNEL32.DLL',\
                user32,'USER32.DLL'

        import kernel32,\
               ExitProcess,'ExitProcess'

        import user32,\
               MessageBoxA,'MessageBoxA'

What's wrong with macro 'invoke'? Why there is an additional shift?

I will show the screenshot in IDA

Description:	sub rsp,28h+30h ????????????
Filesize:	20.58 KB
Viewed:	3683 Time(s)

_________________
O_O

09 Mar 2012, 12:43

LocoDelAssembly
Your code has a bug

Joined: 06 May 2005
Posts: 4624
Location: Argentina

LocoDelAssembly 09 Mar 2012, 17:34

invoke macro takes care of allocating stack space on each call, to avoid that, use frame/endf ( http://flatassembler.net/docs.php?article=win32#1.4 )

09 Mar 2012, 17:34

shutdownall

Joined: 02 Apr 2010
Posts: 517
Location: Munich

shutdownall 09 Mar 2012, 18:31

I didn't know that invoke is a macro, thought it was an instruction inside fasm.
Wink

09 Mar 2012, 18:31

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20423
Location: In your JS exploiting you and your system

revolution 09 Mar 2012, 20:40

Wztml wrote:

Code:

                invoke  MessageBoxA,0,_text,_caption,0,MB_OK

You have one too many parameters there. MessageBox only takes four parameters.

09 Mar 2012, 20:40

Wztml

Joined: 08 Mar 2012
Posts: 6
Location: China

Wztml 10 Mar 2012, 04:58

@Rev
If I give 4 parameters, the code will be
sub rsp,28h
sub rsp,20h
..
..

SO WHAT'S WRONG?

10 Mar 2012, 04:58

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20423
Location: In your JS exploiting you and your system

revolution 10 Mar 2012, 05:02

Nothing is wrong. You have manually specified the sub rsp,28h, and the invoke macro has generated the sub rsp,20h. Your rsp adjustment is aligning the stack (with an extra 20h bytes for unknown purpose). If you do not want invoke to allocate stack space then follow LocoDelAssembly's suggestion.

10 Mar 2012, 05:02

Wztml

Joined: 08 Mar 2012
Posts: 6
Location: China

Wztml 10 Mar 2012, 08:00

@Rev @LocoDelAssembly
Thank you guys

10 Mar 2012, 08:00

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum