64 bit not understood sub rsp,8 !

Index > Windows > 64 bit not understood sub rsp,8 !

Goto page 1, 2, 3, 4, 5, 6, 7, 8, 9 Next

Author

Thread

Roman

Joined: 21 Apr 2012
Posts: 1821

Roman 13 Dec 2020, 12:58

I not understood why only sub rsp,8 work ! And why we must write sub rsp,8 on start program ?

Code:

Start: sub rsp,8

Why not work sub rsp,32 or sub rsp,64 or sub rsp,80 ?

I read program get 1 megabytes stack.
And sub rsp,8 confused this information(program get 1 megabytes stack.) !

13 Dec 2020, 12:58

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20404
Location: In your JS exploiting you and your system

revolution 13 Dec 2020, 13:33

Unaligned stack.

Stack must be aligned to 16 else it is likely to crash when you call the OS API.

13 Dec 2020, 13:33

Furs

Joined: 04 Mar 2016
Posts: 2541

Furs 13 Dec 2020, 15:31

revolution wrote:

Unaligned stack.

Stack must be aligned to 16 else it is likely to crash when you call the OS API.

Given the hacks Wine does to realign the stack for "broken" apps that misalign the stack, looks like Windows is kinda permissive. Razz

13 Dec 2020, 15:31

Roman

Joined: 21 Apr 2012
Posts: 1821

Roman 21 Dec 2020, 14:18

64 bit its pain.

this crash. Ye. Stack not aligned. But somtime hard in code check stack align.

Code:

Start:
sub rsp,8
mov rax,SomeTextInfo
push rax
invoke MessageBox,0,'some text',"Msg:",0
pop rax

This is simple example. But happens more difficult code.
I mean many pushs some registers.

21 Dec 2020, 14:18

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20404
Location: In your JS exploiting you and your system

revolution 21 Dec 2020, 14:31

You didn't show all the code so we don't know what you have done.

But if we assume that "Start" is the first instruction then you definitely have an unaligned stack.

Code:

Start:
sub rsp, 8 ;stack is now aligned
push rax ;stack is now unaligned
invoke ... ; BOOM!

Also you didn't make the shadow space as required by the calling convention.

Code:

;...
Start ; is this really the first instruction? the normal fasm header does a sub rsp, 8 so make sure
push rbp ;stack is now aligned
sub rsp, 0x20 ; allocate the shadow space, stack is still aligned
invoke ...
add rsp, 0x20
;...

BTW: the normal fasm header does a sub rsp,8 before jumping to the start label, so you need to check if that is happening. That is why when you post only fragments of code we have trouble to answer your questions, you leave out important information.

21 Dec 2020, 14:31

Roman

Joined: 21 Apr 2012
Posts: 1821

Roman 21 Dec 2020, 14:48

Code:

proc ProcA
     ret
endp
Start:
sub rsp,8
... BOOM ! some 230 line code
mov rax,SomeTextInfo
push rax
Call ProcA ;this work fine
pop rax

21 Dec 2020, 14:48

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20404
Location: In your JS exploiting you and your system

revolution 21 Dec 2020, 14:51

Still not complete code. We can't see how you get to Start.

Post a minimal version that we can compile showing the problem. Don't post 230 lines of unnecessary code.

21 Dec 2020, 14:51

Roman

Joined: 21 Apr 2012
Posts: 1821

Roman 21 Dec 2020, 15:36

No problem.
I just understood what problems with the stack could be.
And need very caution watch the stack align.

Second moment.
Invoke always do automatic sub and add rsp.
Some time this not handful.

Code:

Start:
sub rsp,8
mov rax,SomeTextInfo
push rax
invoke MessageBox,0,'some text',"Msg:",0 ;crash
pop rax 

No crash:
Start:
sub rsp,8
mov rax,SomeTextInfo
push rax
sub  rsp,8
xor rcx,rcx
mov rdx,text
xor r8,r8
xor r9,r9
Call [MessageBox]
add rsp,8
pop rax

Last edited by Roman on 22 Dec 2020, 07:20; edited 1 time in total

21 Dec 2020, 15:36

Roman

Joined: 21 Apr 2012
Posts: 1821

Roman 21 Dec 2020, 15:54

My opineon good do mov [tmpBuf],rax
and not do push rax

Profit one less pop rax and less problem with stack:
invoke MessageBox,0,qword [tmpBuf],"Msg:",0

21 Dec 2020, 15:54

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20404
Location: In your JS exploiting you and your system

revolution 21 Dec 2020, 22:43

Roman: If you want help into your problem then post code that we can compile.

We don't know what you have done. We don't know what is in your invoke macro. We don't know how you get to Start. etc.

Here is what I see when I compile the most recent code fragment you posted.

Code:

flat assembler  version 1.73.08  (4052884 kilobytes memory)
Roman.asm [2]:
sub rsp,8
processed: sub rsp,8
error: illegal instruction.

21 Dec 2020, 22:43

Roman

Joined: 21 Apr 2012
Posts: 1821

Roman 22 Dec 2020, 06:02

Quote:

processed: sub rsp,8
error: illegal instruction.

What is mean?

22 Dec 2020, 06:02

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20404
Location: In your JS exploiting you and your system

revolution 22 Dec 2020, 06:25

It means you haven't posted a working example of your problem.

22 Dec 2020, 06:25

Roman

Joined: 21 Apr 2012
Posts: 1821

Roman 22 Dec 2020, 07:23

Main proble MessageBox and maybe somthing els functions crash if rsp not aligned !

Code:

;This work fine
proc vv
       ret
endp

proc vv2
       push rbx       
       ret
       pop rbx
endp

Code:
push rax
call vv ;This work fine
pop rax
push rdx
call vv2 ;This work fine
pop rdx

Code:

;This crash. Remember in proc exist push rbp !
proc vv
       invoke MessageBoxA,0,"test",0,0 ;this crash place
       ret
endp
push rax
call vv
pop rax

How I said its creates difficulties.
And in some place code i do:
push rax
call vv
pop rax
I get crash and some time I will be surprised. Then search what is problem happens.

22 Dec 2020, 07:23

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20404
Location: In your JS exploiting you and your system

revolution 22 Dec 2020, 07:43

Roman: That code doesn't compile.

We don't know what you have done.

Post something we can compile.

22 Dec 2020, 07:43

Roman

Joined: 21 Apr 2012
Posts: 1821

Roman 22 Dec 2020, 08:01

Compile this:

Code:

format PE64 GUI 5.0 on 'nul'
include 'include\win64a.inc'
section '.code' code readable writeable executable
        proc vv
             invoke MessageBox,0,'Lets write code !','',0
             ret
        endp

Start:
     sub     rsp,8
     push rax ;this get crash. comment and get MessageBox
     call vv
     pop rax      ;and comment this

Code:

;This work fine
format PE64 GUI 5.0 on 'nul'
include 'include\win64a.inc'
section '.code' code readable writeable executable
        proc vv
             mov edx,12
             ret
        endp

Start:
     sub     rsp,8
     push rax  
     call vv
     pop rax

Last edited by Roman on 22 Dec 2020, 08:08; edited 1 time in total

22 Dec 2020, 08:01

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20404
Location: In your JS exploiting you and your system

revolution 22 Dec 2020, 08:06

Code:

flat assembler  version 1.73.08  (4031824 kilobytes memory)
Roman.asm [5]:
             Msg 'f'
processed: Msg 'f'
error: illegal instruction.

22 Dec 2020, 08:06

Roman

Joined: 21 Apr 2012
Posts: 1821

Roman 22 Dec 2020, 08:07

Code:

macro Msg txt { invoke MessageBox,0,txt,'',0 }

22 Dec 2020, 08:07

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20404
Location: In your JS exploiting you and your system

revolution 22 Dec 2020, 08:09

Please test before posting:

Code:

flat assembler  version 1.73.08  (4040884 kilobytes memory)
Roman.asm [5]:
             invoke MessageBox,0,'Lets write code !','',0
.../macro/proc64.inc [5] invoke [0]:
 { common fastcall [proc],arg }
.../macro/proc64.inc [300] fastcall [292]:
    call proc
processed: call[MessageBox]
error: undefined symbol 'MessageBox'.

22 Dec 2020, 08:09

Roman

Joined: 21 Apr 2012
Posts: 1821

Roman 22 Dec 2020, 08:21

Use User32.dll and
import User32, MessageBox,'MessageBoxA'

22 Dec 2020, 08:21

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20404
Location: In your JS exploiting you and your system

revolution 22 Dec 2020, 08:23

Show us how you do it. In the code. Post new fully complete code for us to compile.

We need to see how you get to Start, and exactly all the code.

22 Dec 2020, 08:23

Goto page 1, 2, 3, 4, 5, 6, 7, 8, 9 Next

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum