Win64: Stack 16-byte alignment question

Index > Windows > Win64: Stack 16-byte alignment question

Author

Thread

yoshimitsu

Joined: 07 Jul 2011
Posts: 96

yoshimitsu 18 Dec 2011, 13:19

Hi,
I'm atm trying to get a little familiar with x64, but I'm failing with the basics..

I've read that the stack has to be aligned on a 16-byte boundary.
In the examples the stack is 16-byte aligned on an API call, but gets unaligned due to the call pushing the return address.

It gets realigned on "push rbp" inside a function, though.

Am I understanding something wrong or does EVERY API-function has a leading "push rbp" which therefore gets the stack 16-byte aligned again?

And is the value of rsp always a non-parity power of 8 at a program's entry point?
Thanks.

18 Dec 2011, 13:19

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20298
Location: In your JS exploiting you and your system

revolution 18 Dec 2011, 13:22

yoshimitsu wrote:

Am I understanding something wrong or does EVERY API-function has a leading "push rbp" which therefore gets the stack 16-byte aligned again?

And is the value of rsp always a non-parity power of 8 at a program's entry point?

You are correct. RSP is always 8 MOD 16 upon function entry. This is part of the fastcall spec.

18 Dec 2011, 13:22

yoshimitsu

Joined: 07 Jul 2011
Posts: 96

yoshimitsu 18 Dec 2011, 13:27

hehe, that was fast.

So if I'm writing my own function which should call API-functions but does not need to access via rbp and thus doesn't push it at the beginning, it's mandatory, though, that I decrease rsp by 8?
And on the other hand, if I am using rbp (by using FASM's proc-macro) I have to take it into account when allocating space for the parameters for functions and shouldn't forget that ebp already realigns the stack which is why I then must not add a nonparity power of 8, but a parity one (means 16-byte aligned)?

18 Dec 2011, 13:27

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20298
Location: In your JS exploiting you and your system

revolution 18 Dec 2011, 13:44

yoshimitsu wrote:

hehe, that was fast.

So if I'm writing my own function which should call API-functions but does not need to access via rbp and thus doesn't push it at the beginning, it's mandatory, though, that I decrease rsp by 8?
And on the other hand, if I am using rbp (by using FASM's proc-macro) I have to take it into account when allocating space for the parameters for functions and shouldn't forget that ebp already realigns the stack which is why I then must not add a nonparity power of 8, but a parity one (means 16-byte aligned)?

In your own code you can do whatever makes sense to you. It is only when you interact with the Windows API that you need to align things properly.

The most common trap with an unaligned stack is the XMM register values. If they are not saved to 0 mod 16 then you can get problems. But most other stuff is fine with the less strict 0 mod 8.

18 Dec 2011, 13:44

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum