Push byte zero-extend

Index > Main > Push byte zero-extend

Author

Thread

fwd

Joined: 13 Feb 2012
Posts: 8
Location: Canada

fwd 15 May 2012, 01:45

Hey guys, just a (hopefully) quick and easy question :

For 32-bit applications FASM seems to assemble any byte over 7Fh (i.e.: 80h and above) that follows a push instruction with a zero-extend.

For example,
push $7F
generates "6A 7F", whereas
push $F6
generates "68 F6 00 00 00" (or push 000000F6).

I would like FASM to assemble push $XX instructions (where XX is a byte value over 7Fh, I guess), using "6A" all of the time, instead of "68", or (if that's not right), so that instructions like

push $F5
push $A9

for example, generate
push $FFFFFFF5 and
push $FFFFFFA9
respectively.

Thanks in advance, and I apologize in advance too for any lack of clarity.

15 May 2012, 01:45

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20334
Location: In your JS exploiting you and your system

revolution 15 May 2012, 01:52

Did you try assembling those?

Code:

use32
push $FFFFFFF5
push $FFFFFFA9

You might be surprised at the result.

15 May 2012, 01:52

fwd

Joined: 13 Feb 2012
Posts: 8
Location: Canada

fwd 15 May 2012, 09:15

Yes, I did.

However I have a 'source' that doesn't use that format and thought perhaps someone might know of a quick solution involving FASM, rather than my having to write a script or something to convert hundreds or thousands of push (some byte) instructions.

15 May 2012, 09:15

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20334
Location: In your JS exploiting you and your system

revolution 15 May 2012, 09:18

Maybe:

Code:

macro push something {
  db 0x6a,something
}

15 May 2012, 09:18

shutdownall

Joined: 02 Apr 2010
Posts: 517
Location: Munich

shutdownall 15 May 2012, 12:14

revolution wrote:

Did you try assembling those?
Code:
use32
push $FFFFFFF5
push $FFFFFFA9    
You might be surprised at the result.

I did try and was very surprised.
Isn't that a bug ???

Code:

use32
push $100
push $1000
push $10000
push $F5
push $FFF9
push $FFFFF9
push $FFFFFFF9

The above code does always push a dword on stack except the last one which does only a byte push ?! (version 1.69.35 used)

If changed last instruction to
push dword $FFFFFFF9
it's handled correctly but I wouldn't expect to put a byte instead of the dword by default.
Shocked

15 May 2012, 12:14

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20334
Location: In your JS exploiting you and your system

revolution 15 May 2012, 12:16

shutdownall wrote:

Isn't that a bug ???

No. Perfectly normal. Try executing it in a debugger.

15 May 2012, 12:16

LostCoder

Joined: 07 Mar 2012
Posts: 22

LostCoder 15 May 2012, 20:37

push is sign-extended, not zero. And it works only if immediate value fit into -128...127 values (one byte). Also default operand size for 32bit architecture is dword. So:

Code:

use32
push $100      ; push dword $00000100 ; sign: 0 ; $100 > $7F
push $1000     ; push dword $00001000 ; sign: 0 ; $1000 > $7F
push $10000    ; push dword $00010000 ; sign: 0 ; $10000 > $7F
push $F5       ; push dword $000000F5 ; sign: 0 ; $F5 > $7F
push $FFF9     ; push dword $0000FFF9 ; sign: 0 ; $FFF9 > $7F
push $FFFFF9   ; push dword $00FFFFF9 ; sign: 0 ; $FFFFF9 > $7F
push $FFFFFFF9 ; push dword $FFFFFFF9 ; sign: 1 ; $FFFFFFF9 = -7; -128 < -7 < 127; <- sign-extended

15 May 2012, 20:37

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum