flat assembler
Message board for the users of flat assembler.

Home Search Register
Log in to check your private messages Log in

Index > Windows > Align fix
Author
Thread Post new topic Reply to topic
AE



Joined: 07 Apr 2022
Posts: 72
AE 20 Jan 2023, 09:44
An incomprehensible situation
When I access memory with
Code:
[reg+struct.member]

I am accessing unaligned data even though the start address in the register is always aligned and the structure contains an aligned macro like this
Code:
struct m
    Ptr1                            dq ?
    Ptr2                            dq ?
    WinX                            dd ?
    WinY                            dd ?
    NtBuildNumber                   dd ?
    Align 16
    CurPath                         UNICODE_STRING
    NtFileName                      UNICODE_STRING
    ...
    Align 8
    OA                              OBJECT_ATTRIBUTES
    Align 8
    IO                              IO_STATUS_BLOCK
    PageSize                        dd ?
    Granularity                     dd ?
    ...
ends


Why is that and how to fix it?

It seems like there used to be a "bug" with the inability to make the alignment greater than that of the section, but I can't add alignment to the section because I always got an error
Code:
processed: section '.data' data readable writeable align 16
error: extra characters on line


Last edited by AE on 20 Jan 2023, 12:54; edited 1 time in total
Post 20 Jan 2023, 09:44
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20627
Location: In your JS exploiting you and your system
revolution 20 Jan 2023, 10:12
The struct macro doesn't support Align. Unless you are using your own version of struct where you define Align?

Sections in Windows are always aligned to the next page, which is usually 4k. So you get that alignment for free.
Post 20 Jan 2023, 10:12
View user's profile Send private message Visit poster's website Reply with quote
Tomasz Grysztar



Joined: 16 Jun 2003
Posts: 8394
Location: Kraków, Poland
Tomasz Grysztar 20 Jan 2023, 10:18
The "struct" macro as implemented in fasm's standard headers does not support "align" statements, the way it was designed makes these statements completely ignored. ProMiNick has been working on some advanced "struct" macro variants - they might be able to solve your problem.

The re-implementation of "struct" for fasmg should be able to handle it, although it may still behave unexpectedly if whole structure is instantiated misaligned. Do you expect it to align relative to the start of the structure, or do you expect the actual address to be aligned?

AE wrote:
It seems like there used to be a "bug" with the inability to make the alignment greater than that of the section, but I can't add alignment to the section because I always got an error
Code:
processed: section '.data' data readable writeable align 16
error: extra characters on line
This setting is only available with object formats like ELF and MS COFF, where each section may be linked into a different area and therefore each may be aligned differently (and of course, if section itself is misaligned, then everything inside is too). But with PE format all sections are at fixed positions, so their alignment is known.
Post 20 Jan 2023, 10:18
View user's profile Send private message Visit poster's website Reply with quote
AE



Joined: 07 Apr 2022
Posts: 72
AE 20 Jan 2023, 11:02
Tomasz Grysztar wrote:
Do you expect it to align relative to the start of the structure, or do you expect the actual address to be aligned?
It is necessary that a member of the structure has an aligned address in memory, but since I always write the "structure itself" to memory at an aligned address, we can say that alignment is needed from the beginning of the structure.

As far as I understand, I need to align the structure with "paddings" manually or migrate to fasmg.




By the way, a question a bit off topic - is fasm automatically aligns some structures?
AFAIK both of this will work:
Code:
    struct UNICODE_STRING
        Length             dw ?
        MaximumLength      dw ?
                           dd ?  ; manual padding
        Buffer             dq ?
    ends

    struct UNICODE_STRING
        Length             dw ?
        MaximumLength      dw ?
        Buffer             dq ?
    ends
Post 20 Jan 2023, 11:02
View user's profile Send private message Reply with quote
Tomasz Grysztar



Joined: 16 Jun 2003
Posts: 8394
Location: Kraków, Poland
Tomasz Grysztar 20 Jan 2023, 11:12
AE wrote:
As far as I understand, I need to align the structure with "paddings" manually or migrate to fasmg.
I was editing my post as you were writing - please take a look at the link to ProMiNick's macros.

AE wrote:
By the way, a question a bit off topic - is fasm automatically aligns some structures?
No, it does not. Even the extensions to fasmg's implementation only warn about misaligned fields, but do not insert any padding themselves.
Post 20 Jan 2023, 11:12
View user's profile Send private message Visit poster's website Reply with quote
AE



Joined: 07 Apr 2022
Posts: 72
AE 20 Jan 2023, 11:29
Tomasz Grysztar wrote:
ProMiNick's macros

It can't handle 'union' Sad
Post 20 Jan 2023, 11:29
View user's profile Send private message Reply with quote
Tomasz Grysztar



Joined: 16 Jun 2003
Posts: 8394
Location: Kraków, Poland
Tomasz Grysztar 20 Jan 2023, 11:41
AE wrote:
Tomasz Grysztar wrote:
ProMiNick's macros

It can't handle 'union' Sad
There was a follow-up thread, might be worth a try.
Post 20 Jan 2023, 11:41
View user's profile Send private message Visit poster's website Reply with quote
AE



Joined: 07 Apr 2022
Posts: 72
AE 20 Jan 2023, 12:51
Thank you very much for the links, I tried all the solutions and only fasmg was able to do it right without changing the source.
Although I was confused by the garbage generation in code section if there is 'Align XX'.

Does it make sense to switch to fasmg (only for PE x64)?
Post 20 Jan 2023, 12:51
View user's profile Send private message Reply with quote
AE



Joined: 07 Apr 2022
Posts: 72
AE 20 Jan 2023, 13:58
Quote:
garbage generation in code section if there is 'Align XX'

Here is the code and disassembled instructions of the "strange" area
Code:
...
fastcall GetPath
; Align 16
ML: invoke  GetMessage,msg,NULL,0,0 ; msg loop start here
...
---------------------------------------------------------------------------------------
00000000004023D0 | 48:83EC 20                    | sub     rsp, 0x20
00000000004023D4 | E8 47090000                   | call    win32_.402D20
00000000004023D9 | 48:83C4 20                    | add     rsp, 0x20
---------------------------------------------------------------------------------------
00000000004023DD | 48:83EC 20                    | sub     rsp, 0x20
00000000004023E1 | 48:C7C1 20104000              | mov     rcx, win32_.401020
00000000004023E8 | 48:C7C2 00000000              | mov     rdx, 0x0
---------------------------------------------------------------------------------------
00000000004023EF | 49:C7C0 00000000              | mov     r8, 0x0
00000000004023F6 | 49:C7C1 00000000              | mov     r9, 0x0
00000000004023FD | FF15 850D0000                 | call    qword ptr ds:[<&GetMessageW>]
---------------------------------------------------------------------------------------

Code:
...
fastcall GetPath
Align 16
ML: invoke  GetMessage,msg,NULL,0,0 ; msg loop start here
...
---------------------------------------------------------------------------------------
00000000004023D0 | 48:83EC 20                    | sub     rsp, 0x20
00000000004023D4 | E8 47090000                   | call    win32_.402D20
00000000004023D9 | 48:83C4 20                    | add     rsp, 0x20
---------------------------------------------------------------------------------------
00000000004023DD | 0000                          | add     byte ptr ds:[rax], al
00000000004023DF | 0048 83                       | add     byte ptr ds:[rax - 0x7D], cl 
00000000004023E2 | EC                            | in      al, dx                       
00000000004023E3 | 2048 C7                       | and     byte ptr ds:[rax - 0x39], cl 
00000000004023E6 | C120 10                       | shl     dword ptr ds:[rax], 0x10
00000000004023E9 | 40:0048 C7                    | add     byte ptr ds:[rax - 0x39], cl 
00000000004023ED | C2 0000                       | ret     0x0
00000000004023F0 | 0000                          | add     byte ptr ds:[rax], al
---------------------------------------------------------------------------------------
00000000004023F2 | 49:C7C0 00000000              | mov     r8, 0x0
00000000004023F9 | 49:C7C1 00000000              | mov     r9, 0x0
0000000000402400 | FF15 820D0000                 | call    qword ptr ds:[<&GetMessageW>]
---------------------------------------------------------------------------------------


Pay attention to the middle section of the code, in the presence of an alignment macro, it turns into garbage
Post 20 Jan 2023, 13:58
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 20627
Location: In your JS exploiting you and your system
revolution 20 Jan 2023, 14:11
Pad with 0x90 bytes (nop).
Post 20 Jan 2023, 14:11
View user's profile Send private message Visit poster's website Reply with quote
Tomasz Grysztar



Joined: 16 Jun 2003
Posts: 8394
Location: Kraków, Poland
Tomasz Grysztar 20 Jan 2023, 14:20
With "align" macro that comes with PE formatter for fasmg you can specify the pad bytes this way:
Code:
align 16, 90h
Post 20 Jan 2023, 14:20
View user's profile Send private message Visit poster's website Reply with quote
AE



Joined: 07 Apr 2022
Posts: 72
AE 20 Jan 2023, 14:37
Tomasz Grysztar wrote:
align 16, 90h

Thx!
Post 20 Jan 2023, 14:37
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Main index Download Documentation Examples Message board

Copyright © 1999-2025, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.