5

I have de-assembled a x86 application use ida, it generates the following code

.text:1084FF10                 push    ebp
.text:1084FF11                 mov     ebp, esp
.text:1084FF13                 and     esp, 0FFFFFFF8h
.text:1084FF16                 sub     esp, 0D4h
.text:1084FF1C                 mov     eax, ___security_cookie
.text:1084FF21                 xor     eax, esp

What does the instruction "and esp, 0FFFFFFF8h" do here?

11

This aligns the stack pointer to 8 byte boundary. This is done by the compiler to improve performance, as reads from non-aligned addresses results in performance degradation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.