Reputation: 171
I am learning x64 assembly with MASM64. I have read that the first 4 parameters are passed to the procedure by registers: RCX
, RDX
, R9
and R8
. If there are more parameters we pass them by stack.
But there is something confusing.
Why this code does not work:
sub rsp, 40h
push 0
push FILE_ATTRIBUTE_NORMAL
push CREATE_ALWAYS
xor r8, r8
xor r9, r9
mov rdx, GENERIC_READ or GENERIC_WRITE
mov rcx, offset szSavePath
call CreateFileA
add rsp, 40h
but this code works:
sub rsp, 40h
mov qword ptr [rsp+30h], 0
mov qword ptr [rsp+28h], FILE_ATTRIBUTE_NORMAL
mov qword ptr [rsp+20h], CREATE_ALWAYS
xor r8, r8
xor r9, r9
mov rdx, GENERIC_READ or GENERIC_WRITE
mov rcx, offset szSavePath
call CreateFileA
add rsp, 40h
Please help me by explaining this.
Regards, David
Upvotes: 2
Views: 658
Reputation: 9899
sub rsp, 40h push 0 push FILE_ATTRIBUTE_NORMAL push CREATE_ALWAYS
Here you're putting 3 pieces of info below the reserved space on the stack.
sub rsp, 40h
mov qword ptr [rsp+30h], 0
mov qword ptr [rsp+28h], FILE_ATTRIBUTE_NORMAL
mov qword ptr [rsp+20h], CREATE_ALWAYS
But here you're putting these data within the reserved space on the stack.
What happens then is that you end up with an unbalanced stack in the first snippet since you only release the reserved quantity using add rsp, 40h
.
Same code but using pushes:
push 0
push FILE_ATTRIBUTE_NORMAL
push CREATE_ALWAYS
sub rsp, 20h
xor r8, r8
xor r9, r9
mov rdx, GENERIC_READ or GENERIC_WRITE
mov rcx, offset szSavePath
call CreateFileA
add rsp, 20h + 18h
Upvotes: 2