CodeCave in x64

[chessgod101]

Should I have to PUSH all registers and pop them off in x64?

Yes. PUSHAD is not supported in x64, unfortunately. However, you could simply PUSH only the registers you are using in your cave to minimize size depending on your requirements.

Intel x86/x64 assembly reference:

https://cdrdv2-public.intel.com/774494/325462-sdm-vol-1-2abcd-3abcd.pdf

[RAMPage]

Thanks @chessgod101 for your reply. So I have to try this but , reading some of intel arch manual,

PUSH RAX-R15 > PUSHAD
PUSHFQ > PUSHFD
<<Shellcode>>
POP RAX - R15
POPFQ

?

Where can I start learning Assembly and coding by practice?

And always, Thanks.

[blue_devil]

Originally Posted by RAMPage

<snipped>

Where can I start learning Assembly and coding by practice?

And always, Thanks.

RAMPage, if you are new or 0 to INTEL's x86 architecture assembly, I can suggest you this book:

http://www.egr.unlv.edu/~ed/assembly64.pdf

This is an ebook, and didn't published. And It covers 64bit architecture, pretty updated!

[RAMPage]

Originally Posted by blue_devil

RAMPage, if you are new or 0 to INTEL's x86 architecture assembly, I can suggest you this book:



This is an ebook, and didn't published. And It covers 64bit architecture, pretty updated!

Thanks for sharing, I will have fun with this when I have some free time, Im in the need of putting my knowledge at practice, and this book im seeing it has quizes , so I appreciate it.