- Notifications
You must be signed in to change notification settings - Fork 186
Open
Description
An instruction when pushing potentially non DWORD-aligned strings to the stack can potentially cause the SP to become a value non-divisible by 4. Aside from the serious performance hit from a misaligned stack, NT Kernel calls rightfully fail to execute in non-apparent ways.
ie running "MoveFileA" after misaligning the stack fails with GetErrorCode ERROR_NOACCESS = 998 (0x3E6)
Which deceptively is unrelated to file permissions/access
Line 73 in 0f4a395
| first_instructions.append("push ax;") |
Metadata
Metadata
Assignees
Labels
No labels