Fasm 1.73 64 bits do sub rsp, 20h on invoke!

Index > Macroinstructions > Fasm 1.73 64 bits do sub rsp, 20h on invoke!

Author

Thread

Roman

Joined: 21 Apr 2012
Posts: 826

Roman

Ida Pro 64 bit show:
Sub rsp, 20h
Call GetProcessHeap
Add rsp, 20h

Why?
C++ exe not do sub rsp, 20h!
And fasm some win api functions crash for this reason when call

06 Oct 2019, 06:53

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 17714
Location: In your JS exploiting you and your system

revolution

It is just part of the Windows fastcall specification, and it is normal.

Some compilers will pre-allocate the stack for all calls within a function so you might only see the stack adjustment once at the beginning. Otherwise it is present for each call.

Any crashes you see will probably be your code doing something bad like not aligning the stack to a multiple of 16. You might have a rogue push or pop that is misaligning the stack.

If you showed all of the code for that function we might be able to help you.

06 Oct 2019, 07:22

Tomasz Grysztar

Joined: 16 Jun 2003
Posts: 7801
Location: Kraków, Poland

Tomasz Grysztar

revolution wrote:

Some compilers will pre-allocate the stack for all calls within a function so you might only see the stack adjustment once at the beginning. Otherwise it is present for each call.

You can also do it with the "frame"+"endf" macros in fasm.

Additionally, please check out "static_rsp_*" procedure customization macros.

06 Oct 2019, 12:24

Roman

Joined: 21 Apr 2012
Posts: 826

Roman

Thanks all!
I write Win 7 Directx12 example on Fasm 64 bit.
Crash one directx funcion.
Fasm work fine!

07 Oct 2019, 04:09

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum