Re: why MASM generated this code

From: Frank Kotler (fbkotler_at_comcast.net)
Date: 12/31/03

  • Next message: Randall Hyde: "Re: would this approach make it faster..."
    Date: Wed, 31 Dec 2003 02:26:56 GMT
    
    

    Madhur wrote:

    > Why this code is generated by the MASM.
    > The procedure accepts 4 bytes of arguments but it pushes
    > 6 bytes onto stack.
    >
    > anyproc ptoro arg:dword
    >
    > a1 db "sdfdf",0
    >
    > invoke anyproc,a1

    I'm Nasmist, and I may be misunderstanding Masm's syntax, but wouldn't
    you want "invoke anyproc, offset a1" to get a dword parameter? If I'm
    correct, the invocation doesn't match the prototype (I assume you
    spelled that correctly in the "real" code...). I would expect Masm to
    complain about this, but I don't know what Masm does...

    > * push 000h ;4 bytes pushed

    Is it possible we're only pushing 2 bytes here? (it would be preceeded
    by a "66h" size override prefix, assuming that this is 32-bit code) If
    that were the case, it would serve to keep the stack 4-byte aligned...

    > * mov al, a1
    > * movzx ax, al
    > * push ax ;2 bytes pushed

    These three lines are more-or-less what I'd expect if you were asking
    for a byte parameter... Try "offset" and see if it generates what you
    expect.

    This isn't intended as "Masm-bashing" (although it may sound the same),
    but if you want complete control over the code that's emitted, don't
    *use* the "compiler-like" features that your assembler may provide.

    > 2nd question
    > ========
    > I have seen this code to be used in local variables.
    > lea eax,[ebp-4]
    >
    > What is meaning of lea in the context of registers?
    > Registers dont have addresses?
    > Shouldn't lea be used only with program variables.
    > What is the meaning of this statement.

    That's pretty much where you *do* need lea. I see a lot of code that
    uses "lea eax, myvar" ("lea eax, [myvar]" in Nasm syntax). This
    essentially says, "calculate the address of the variable whose address
    is myvar". This works, but is pointless - "mov eax, offset myvar" would
    do the same thing, but shorter. Some versions of Masm actually changed
    your "lea eax, myvar" to "mov eax, offset myvar", but I understand it
    doesn't do that anymore - haven't tried it...

    When you've got a local variable on the stack, "offset" won't work. You
    could "mov eax, ebp"/"sub eax, 4" (or "add eax, -4" which is closer to
    what lea actually does) - lea just does the calculation in a single
    instruction. (it's not using the address "of" ebp - as you observe, ebp
    doesn't have an address - but the address "in" ebp)

    I hope that doesn't make things *more* confusing...

    Best,
    Frank


  • Next message: Randall Hyde: "Re: would this approach make it faster..."

    Relevant Pages

    • Re: LPC900/80C51 Compiler Toolchain
      ... Although the fixed-size frame optimization is orthogonal to removing ... storing stack arguments is less important in such cases. ... storing data at (SP + offset) takes exactly the same time ... up and uses up another 2 registers. ...
      (comp.arch.embedded)
    • Re: LPC900/80C51 Compiler Toolchain
      ... This also makes it easier to track stack variables in debuggers ... If you remove the frame pointer and don't change anything else, ... addressing mode only if the offset is small enough. ... store them rather than push. ...
      (comp.arch.embedded)
    • Re: Patch 4/6 randomize the stack pointer
      ... >> need to start a program at a random offset, not the stack! ... > a "dirty payload and then also overwriting the return address to point ... > back into that buffer. ...
      (Linux-Kernel)
    • Re: Apache Vulnerability through a Proxy?
      ... if the chunk handling vulnerability carries through ... does explain how the expected SEGV from overrunning the stack is ... if you arrange for the negative offset of the buffer to point at ... at this point, we've decided to go backwards, edi is dest, esi is source ...
      (Bugtraq)
    • Re: IE6 started to crash randomly
      ... find the last instance of FAULT -> prefixing a line which seems ... related to your crash signature's Offset. ... Then scroll down some more to find that task's Stack Back Trace. ...
      (microsoft.public.windows.inetexplorer.ie6.browser)