Skip to content

"push ax" misaligns stack from DWORD #28

@AlLongley

Description

@AlLongley

An instruction when pushing potentially non DWORD-aligned strings to the stack can potentially cause the SP to become a value non-divisible by 4. Aside from the serious performance hit from a misaligned stack, NT Kernel calls rightfully fail to execute in non-apparent ways.

ie running "MoveFileA" after misaligning the stack fails with GetErrorCode ERROR_NOACCESS = 998 (0x3E6)

Which deceptively is unrelated to file permissions/access

first_instructions.append("push ax;")

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions