1

Reversing an application that crashes at the last line of the following instructions:

sub rsp,68
mov qword ptr ss:[rsp+B0],rcx
mov qword ptr ss:[rsp+B8],rdx
mov qword ptr ss:[rsp+C0],r8
mov qword ptr ss:[rsp+C8],r9
movdqa xmmword ptr ss:[rsp+20],xmm0

I'm new to reverse engineering and trying to figure out how it is possible that this is crashing.

The memory protection of rsp+20 should be the same as rsp+B0 for example ...

X64DBG: EXCEPTION_ACCESS_VIOLATION

Edit: all numbers in the instructions are in hex! (68, 20, ...)

1

According to definition of the assembly command movdqathe memory operand should be aligned by 16 (see Intel SDM at Vol. 2B 4-63):

When the source or destination operand is a memory operand, the operand must be aligned on a 16 (EVEX.128)/32(EVEX.256)/64(EVEX.512)-byte boundary or a general-protection exception (#GP) will be generated. To move integer data to and from unaligned memory locations, use the VMOVDQU instruction.

If 20 is not hexadecimal here, it would probably be the cause. In addition if 20 here is hexadecimal, rsp still may not be aligned as needed.

| improve this answer | |
  • Thanks, that is correct. The 20 is hexdecimal though, which makes it aligned ... – Whosdatdev Oct 18 '16 at 12:12
  • 2
    The question is what was the initial value of rsp. 0x20 is aligned by 16, but (rsp + 0x20) may be not aligned. – w s Oct 18 '16 at 13:25
  • Logically if +b0,b8 etc doesnt raise alignment issues then 0x20 shouldn't too imho – blabb Oct 18 '16 at 17:05
  • Logically b0 and b8 should be aligned by 8 and not by 16 – w s Oct 18 '16 at 17:13
  • it's the sub rsp,68 that is causing a stack misalignment. If you must have an aligned stack and can't predict its value beforehand, you'll need to store rsp somewhere other than on the stack itself, and then "and rsp,-0x10" as the next instruction, before any other register stores. – peter ferrie Oct 21 '16 at 20:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.