Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 07-19-2018, 01:45
Insid3Code's Avatar
Insid3Code Insid3Code is offline
Family
 
Join Date: May 2013
Location: Algeria
Posts: 84
Rept. Given: 47
Rept. Rcvd 60 Times in 30 Posts
Thanks Given: 24
Thanks Rcvd at 108 Times in 56 Posts
Insid3Code Reputation: 60
@vic4key
To avoid the application crash you need to allocate/align the stack...
Compiled and tested (MSVC 2017 15.7.3)

PHP Code:
F1 PROC
  SUB RSP
40 Allocate space on the stack (for alignment and 32 for shadow space)...
  
PUSH RBP
  MOV RBP
RSP
  LEA RCX
TXT_F1
  CALL puts
  LEAVE
  ADD RSP
40 Cleanup the stack...
  
RET
F1 ENDP

F2 PROC
  SUB RSP
40 Allocate space on the stack (for alignment and 32 for shadow space)...
  
PUSH RBP
  MOV RBP
RSP
  LEA RCX
TXT_F2
  CALL puts
  LEAVE
  ADD RSP
40 Cleanup the stack...
  
RET
F2 ENDP 
__________________
Computer Forensics
Reply With Quote
The Following User Says Thank You to Insid3Code For This Useful Post:
niculaita (07-19-2018)
  #2  
Old 07-20-2018, 12:56
vic4key's Avatar
vic4key vic4key is offline
Family
 
Join Date: Apr 2010
Posts: 62
Rept. Given: 5
Rept. Rcvd 24 Times in 10 Posts
Thanks Given: 63
Thanks Rcvd at 98 Times in 23 Posts
vic4key Reputation: 24
Hi Insid3Code. Not used any local variables inside. So the allocation is unnecessary I think. Even it can be shorter. Eg.

F1 PROC
PUSHAD
LEA RCX, TXT_F1
CALL puts
POPAD
F1 ENDP

More, your edited code should be:

F1 PROC
PUSH RBP
MOV RBP, RSP
SUB RSP, 40 ; Allocate space on the stack (8 for alignment and 32 for shadow space); Below of MOV RBP, RSP, this instruction already saved RSP to RBP.
LEA RCX, TXT_F1
CALL puts
LEAVE
ADD RSP, 40 ; Cleanup the stack... ; Not needed. The LEAVE instruction did it.
RET
F1 ENDP
Reply With Quote
The Following User Says Thank You to vic4key For This Useful Post:
niculaita (07-21-2018)
  #3  
Old 07-21-2018, 07:01
chants chants is offline
VIP
 
Join Date: Jul 2016
Posts: 826
Rept. Given: 47
Rept. Rcvd 50 Times in 31 Posts
Thanks Given: 737
Thanks Rcvd at 1,140 Times in 529 Posts
chants Reputation: 51
Microsoft x64 calling convention

Quote:
Stack aligned on 16 bytes. 32 bytes shadow space on stack.
Therefore code given here is all non-standards compliant with arbitrary calling convention (compiler will have return address of 8 bytes so an extra 8 indeed is needed but if called from assembler directly, etc assumption may not hold). If not calling back into C code which has been externed for use by the asm code (like puts is for sure), this should obviously not be necessary - neither alignment or shadow space.

PHP Code:
  SUB RSP32 Allocate space on the stack 32 for shadow space
  
AND RSP, -16 Align on 16 bytes

  LEAVE 
That pattern is needed for both F1 and F2 and its straightforward.

Last edited by chants; 07-22-2018 at 01:08.
Reply With Quote
The Following 2 Users Say Thank You to chants For This Useful Post:
niculaita (07-21-2018), vic4key (07-21-2018)
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
inline patche hp3 Source Code 3 06-04-2021 14:48
X64 inline asm Fyyre x64 OS 48 08-10-2014 16:50
Inline Patching MaRKuS-DJM General Discussion 1 01-24-2004 23:03


All times are GMT +8. The time now is 23:53.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )