2

Reversing an application that crashes at the last line of the following instructions:

sub rsp,68
mov qword ptr ss:[rsp+B0],rcx
mov qword ptr ss:[rsp+B8],rdx
mov qword ptr ss:[rsp+C0],r8
mov qword ptr ss:[rsp+C8],r9
movdqa xmmword ptr ss:[rsp+20],xmm0

I'm new to reverse engineering and trying to figure out how it is possible that this is crashing.

The memory protection of rsp+20 should be the same as rsp+B0 for example ...

X64DBG: EXCEPTION_ACCESS_VIOLATION

Edit: all numbers in the instructions are in hex! (68, 20, ...)

Improve this question

1 Answer 1

Reset to default
3

According to definition of the assembly command movdqathe memory operand should be aligned by 16 (see Intel SDM at Vol. 2B 4-63):

When the source or destination operand is a memory operand, the operand must be aligned on a 16 (EVEX.128)/32(EVEX.256)/64(EVEX.512)-byte boundary or a general-protection exception (#GP) will be generated. To move integer data to and from unaligned memory locations, use the VMOVDQU instruction.

If 20 is not hexadecimal here, it would probably be the cause. In addition if 20 here is hexadecimal, rsp still may not be aligned as needed.

Improve this answer
5
  • Thanks, that is correct. The 20 is hexdecimal though, which makes it aligned ...
    – Whosdatdev
    Commented Oct 18, 2016 at 12:12
  • 3
    The question is what was the initial value of rsp. 0x20 is aligned by 16, but (rsp + 0x20) may be not aligned.
    – w s
    Commented Oct 18, 2016 at 13:25
  • Logically if +b0,b8 etc doesnt raise alignment issues then 0x20 shouldn't too imho
    – blabb
    Commented Oct 18, 2016 at 17:05
  • Logically b0 and b8 should be aligned by 8 and not by 16
    – w s
    Commented Oct 18, 2016 at 17:13
  • it's the sub rsp,68 that is causing a stack misalignment. If you must have an aligned stack and can't predict its value beforehand, you'll need to store rsp somewhere other than on the stack itself, and then "and rsp,-0x10" as the next instruction, before any other register stores.
    – peter ferrie
    Commented Oct 21, 2016 at 20:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.