2

I am playing around with windbg on a 64-bit machine and noticed something interesting:

nt!ExAllocatePool:
    ...
    sub rsp, 0xd0
    ...
    mov qword ptr [rsp+0xf8], rbx

Windows only allocated 0xd0 bytes for locals but then it decides to step on the callers stack since 0xf8 is > 0xd0! What am I missing here? This HAS to be a bug in Windows.

Improve this question
4
  • 1
    Hi and welcome to RE.SE. This is lacking a little information. So you're saying this was built with frame pointer omission active? What exact build? I'd like to have a look myself.
    – 0xC0000022L ♦
    Aug 4, 2022 at 16:43
  • This is Windows, I didn't build anything, I just attached a kernel debugger and looked at ntoskrnl
    – Yolo41251263
    Aug 4, 2022 at 16:51
  • 2
    At what point did I write anything about you built anything? Thing is, you don't provide enough context, so I was asking a very pointed question. And I was also asking about what exact build you are looking at. In my version of ntoskrnl.exe ExAllocatePool() encompasses 5 instructions including a sub rsp, 28h which clearly doesn't match whatever you have. The ExAllocatePoolWithTag() it calls takes merely one more argument, meaning everything fits into registers anyway and stack is used only for locals. But none of what I see matches what you got. So what exact version of ntoskrnl?
    – 0xC0000022L ♦
    Aug 4, 2022 at 21:39
  • What are the instructions before sub rsp? and does the rsp change afterwards? Please post a longer snippet or tell us where to find this code.
    – Igor Skochinsky ♦
    Aug 7, 2022 at 11:47

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.