flat assembler
Message board for the users of flat assembler.

Index > Windows > 64 bit not understood sub rsp,8 !

Goto page 1, 2, 3, 4, 5, 6, 7, 8, 9  Next
Author
Thread Post new topic Reply to topic
Roman



Joined: 21 Apr 2012
Posts: 1251
Roman
I not understood why only sub rsp,8 work ! And why we must write sub rsp,8 on start program ?
Code:
Start: sub rsp,8
    


Why not work sub rsp,32 or sub rsp,64 or sub rsp,80 ?

I read program get 1 megabytes stack.
And sub rsp,8 confused this information(program get 1 megabytes stack.) !
Post 13 Dec 2020, 12:58
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 18846
Location: In your JS exploiting you and your system
revolution
Unaligned stack.

Stack must be aligned to 16 else it is likely to crash when you call the OS API.
Post 13 Dec 2020, 13:33
View user's profile Send private message Visit poster's website Reply with quote
Furs



Joined: 04 Mar 2016
Posts: 1888
Furs
revolution wrote:
Unaligned stack.

Stack must be aligned to 16 else it is likely to crash when you call the OS API.
Given the hacks Wine does to realign the stack for "broken" apps that misalign the stack, looks like Windows is kinda permissive. Razz
Post 13 Dec 2020, 15:31
View user's profile Send private message Reply with quote
Roman



Joined: 21 Apr 2012
Posts: 1251
Roman
64 bit its pain.

this crash. Ye. Stack not aligned. But somtime hard in code check stack align.
Code:
Start:
sub rsp,8
mov rax,SomeTextInfo
push rax
invoke MessageBox,0,'some text',"Msg:",0
pop rax    


This is simple example. But happens more difficult code.
I mean many pushs some registers.
Post 21 Dec 2020, 14:18
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 18846
Location: In your JS exploiting you and your system
revolution
You didn't show all the code so we don't know what you have done.

But if we assume that "Start" is the first instruction then you definitely have an unaligned stack.
Code:
Start:
sub rsp, 8 ;stack is now aligned
push rax ;stack is now unaligned
invoke ... ; BOOM!    
Also you didn't make the shadow space as required by the calling convention.
Code:
;...
Start ; is this really the first instruction? the normal fasm header does a sub rsp, 8 so make sure
push rbp ;stack is now aligned
sub rsp, 0x20 ; allocate the shadow space, stack is still aligned
invoke ...
add rsp, 0x20
;...    
BTW: the normal fasm header does a sub rsp,8 before jumping to the start label, so you need to check if that is happening. That is why when you post only fragments of code we have trouble to answer your questions, you leave out important information.
Post 21 Dec 2020, 14:31
View user's profile Send private message Visit poster's website Reply with quote
Roman



Joined: 21 Apr 2012
Posts: 1251
Roman
Code:
proc ProcA
     ret
endp
Start:
sub rsp,8
... BOOM ! some 230 line code
mov rax,SomeTextInfo
push rax
Call ProcA ;this work fine
pop rax 
    
Post 21 Dec 2020, 14:48
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 18846
Location: In your JS exploiting you and your system
revolution
Still not complete code. We can't see how you get to Start.

Post a minimal version that we can compile showing the problem. Don't post 230 lines of unnecessary code.
Post 21 Dec 2020, 14:51
View user's profile Send private message Visit poster's website Reply with quote
Roman



Joined: 21 Apr 2012
Posts: 1251
Roman
No problem.
I just understood what problems with the stack could be.
And need very caution watch the stack align.

Second moment.
Invoke always do automatic sub and add rsp.
Some time this not handful.
Code:
Start:
sub rsp,8
mov rax,SomeTextInfo
push rax
invoke MessageBox,0,'some text',"Msg:",0 ;crash
pop rax 

No crash:
Start:
sub rsp,8
mov rax,SomeTextInfo
push rax
sub  rsp,8
xor rcx,rcx
mov rdx,text
xor r8,r8
xor r9,r9
Call [MessageBox]
add rsp,8
pop rax 
    


Last edited by Roman on 22 Dec 2020, 07:20; edited 1 time in total
Post 21 Dec 2020, 15:36
View user's profile Send private message Reply with quote
Roman



Joined: 21 Apr 2012
Posts: 1251
Roman
My opineon good do mov [tmpBuf],rax
and not do push rax

Profit one less pop rax and less problem with stack:
invoke MessageBox,0,qword [tmpBuf],"Msg:",0
Post 21 Dec 2020, 15:54
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 18846
Location: In your JS exploiting you and your system
revolution
Roman: If you want help into your problem then post code that we can compile.

We don't know what you have done. We don't know what is in your invoke macro. We don't know how you get to Start. etc.

Here is what I see when I compile the most recent code fragment you posted.
Code:
flat assembler  version 1.73.08  (4052884 kilobytes memory)
Roman.asm [2]:
sub rsp,8
processed: sub rsp,8
error: illegal instruction.    
Post 21 Dec 2020, 22:43
View user's profile Send private message Visit poster's website Reply with quote
Roman



Joined: 21 Apr 2012
Posts: 1251
Roman
Quote:
processed: sub rsp,8
error: illegal instruction.

What is mean?
Post 22 Dec 2020, 06:02
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 18846
Location: In your JS exploiting you and your system
revolution
It means you haven't posted a working example of your problem.
Post 22 Dec 2020, 06:25
View user's profile Send private message Visit poster's website Reply with quote
Roman



Joined: 21 Apr 2012
Posts: 1251
Roman
Main proble MessageBox and maybe somthing els functions crash if rsp not aligned !
Code:
;This work fine
proc vv
       ret
endp

proc vv2
       push rbx       
       ret
       pop rbx
endp

Code:
push rax
call vv ;This work fine
pop rax
push rdx
call vv2 ;This work fine
pop rdx
    

Code:
;This crash. Remember in proc exist push rbp !
proc vv
       invoke MessageBoxA,0,"test",0,0 ;this crash place
       ret
endp
push rax
call vv
pop rax
    

How I said its creates difficulties.
And in some place code i do:
push rax
call vv
pop rax
I get crash and some time I will be surprised. Then search what is problem happens.
Post 22 Dec 2020, 07:23
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 18846
Location: In your JS exploiting you and your system
revolution
Roman: That code doesn't compile.

We don't know what you have done.

Post something we can compile.
Post 22 Dec 2020, 07:43
View user's profile Send private message Visit poster's website Reply with quote
Roman



Joined: 21 Apr 2012
Posts: 1251
Roman
Compile this:
Code:
format PE64 GUI 5.0 on 'nul'
include 'include\win64a.inc'
section '.code' code readable writeable executable
        proc vv
             invoke MessageBox,0,'Lets write code !','',0
             ret
        endp

Start:
     sub     rsp,8
     push rax ;this get crash. comment and get MessageBox
     call vv
     pop rax      ;and comment this
    


Code:
;This work fine
format PE64 GUI 5.0 on 'nul'
include 'include\win64a.inc'
section '.code' code readable writeable executable
        proc vv
             mov edx,12
             ret
        endp

Start:
     sub     rsp,8
     push rax  
     call vv
     pop rax     
    


Last edited by Roman on 22 Dec 2020, 08:08; edited 1 time in total
Post 22 Dec 2020, 08:01
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 18846
Location: In your JS exploiting you and your system
revolution
Code:
flat assembler  version 1.73.08  (4031824 kilobytes memory)
Roman.asm [5]:
             Msg 'f'
processed: Msg 'f'
error: illegal instruction.    
Post 22 Dec 2020, 08:06
View user's profile Send private message Visit poster's website Reply with quote
Roman



Joined: 21 Apr 2012
Posts: 1251
Roman
Code:
macro Msg txt { invoke MessageBox,0,txt,'',0 }    
Post 22 Dec 2020, 08:07
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 18846
Location: In your JS exploiting you and your system
revolution
Please test before posting:
Code:
flat assembler  version 1.73.08  (4040884 kilobytes memory)
Roman.asm [5]:
             invoke MessageBox,0,'Lets write code !','',0
.../macro/proc64.inc [5] invoke [0]:
 { common fastcall [proc],arg }
.../macro/proc64.inc [300] fastcall [292]:
    call proc
processed: call[MessageBox]
error: undefined symbol 'MessageBox'.    
Post 22 Dec 2020, 08:09
View user's profile Send private message Visit poster's website Reply with quote
Roman



Joined: 21 Apr 2012
Posts: 1251
Roman
Use User32.dll and
import User32, MessageBox,'MessageBoxA'
Post 22 Dec 2020, 08:21
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 18846
Location: In your JS exploiting you and your system
revolution
Show us how you do it. In the code. Post new fully complete code for us to compile.

We need to see how you get to Start, and exactly all the code.
Post 22 Dec 2020, 08:23
View user's profile Send private message Visit poster's website Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  
Goto page 1, 2, 3, 4, 5, 6, 7, 8, 9  Next

< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.

Website powered by rwasa.