How to inline x64 asm in vs2017 ?

[Insid3Code]

Hi Vic,
Are you already tested your snippets ?
Attached, both snippets (allocate/align) and binaries (one crash the other works fine)

I don't know if you can download the attachment from this topic, here external link:

PHP Code:

http://www.mediafire.com/file/s9dd88iel47s7h8/poc.rar 


Compiled and tested (MSVC 2017 15.7.3)

[ionioni]

Originally Posted by vic4key

ADD RSP, 40 ; Cleanup the stack... ; Not needed. The LEAVE instruction did it.

Originally Posted by Insid3Code

Hi Vic,
Are you already tested your snippets ?
Attached, both snippets (allocate/align) and binaries (one crash the other works fine)

I don't know if you can download the attachment from this topic, here external link:

PHP Code:

http://www.mediafire.com/file/s9dd88iel47s7h8/poc.rar 


Compiled and tested (MSVC 2017 15.7.3)

leave is short for
mov rsp, rbp
pop rbp
lose "add rsp, ..."

[chants]

This discussion is majorly lacking a hugely important point:
Calling convention in x64 always uses the RCX, RDX, R8, R9 registers for passing the first 4 arguments (anything up to 64 bit values or pointers), while additionally to those 4 registers, RAX, R10 and R11 are considered volatile. The return value is in the RAX or possibly for a 128-bit return value would be in the RAX:RDX.

This is opposed to x86 where the prior scheme is closest to fastcall which used the ECX and EDX for argument passing before resorting to the stack with additionally the EAX volatile. However in cdecl (caller clean-up stack) calling convention, arguments are all passed on the stack, EAX, ECX and EDX are considered volatile, and the return value in EAX or EAX:EDX. syscall is the same except without the 3 registers being considered volatile. stdcall is also almost the same except the callee cleans up the stack.

If mixing C with external asm, it would be extremely wise to be familiar with all these details.

For more details which are too lengthly to include, refer to:

https://en.wikipedia.org/wiki/X86_calling_conventions

[vic4key]

Yes, right. In x64 arch, we always need to allocate the space for which called "shadow space". So, the above code should be:

F1 PROC
  PUSH RBP
  MOV RBP, RSP
  SUB RSP, 0x30 ; Just need to add this instruction.
  LEA RCX, TXT_F1
  CALL puts
  LEAVE
  RET
F1 ENDP

Thank you, guys.

[chants]

It should be:

F1 PROC
  PUSH RBP
  MOV RBP, RSP
  SUB RSP, 32 ; Allocate space on the stack 32 for shadow space 
  AND RSP, -16 ; Align on 16 bytes
  LEA RCX, TXT_F1
  CALL puts
  LEAVE
  RET
F1 ENDP