1

I am playing around with windbg on a 64-bit machine and noticed something interesting:

nt!ExAllocatePool:
    ...
    sub rsp, 0xd0
    ...
    mov qword ptr [rsp+0xf8], rbx

Windows only allocated 0xd0 bytes for locals but then it decides to step on the callers stack since 0xf8 is > 0xd0! What am I missing here? This HAS to be a bug in Windows.

4
  • 1
    Hi and welcome to RE.SE. This is lacking a little information. So you're saying this was built with frame pointer omission active? What exact build? I'd like to have a look myself.
    – 0xC0000022L
    Aug 4 at 16:43
  • This is Windows, I didn't build anything, I just attached a kernel debugger and looked at ntoskrnl Aug 4 at 16:51
  • 2
    At what point did I write anything about you built anything? Thing is, you don't provide enough context, so I was asking a very pointed question. And I was also asking about what exact build you are looking at. In my version of ntoskrnl.exe ExAllocatePool() encompasses 5 instructions including a sub rsp, 28h which clearly doesn't match whatever you have. The ExAllocatePoolWithTag() it calls takes merely one more argument, meaning everything fits into registers anyway and stack is used only for locals. But none of what I see matches what you got. So what exact version of ntoskrnl?
    – 0xC0000022L
    Aug 4 at 21:39
  • What are the instructions before sub rsp? and does the rsp change afterwards? Please post a longer snippet or tell us where to find this code.
    – Igor Skochinsky
    Aug 7 at 11:47

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.