Exetools  

Go Back   Exetools > General > x64 OS

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #5  
Old 12-31-2010, 23:21
deroko's Avatar
deroko deroko is offline
cr4zyserb
 
Join Date: Nov 2005
Posts: 217
Rept. Given: 13
Rept. Rcvd 30 Times in 14 Posts
Thanks Given: 7
Thanks Rcvd at 33 Times in 16 Posts
deroko Reputation: 30
Well I would love to have those inline asm markers in the code I've tried to use instrinsic to achive same but during optimization, my macros are gone, mixed with other instructions when optimized and officially I hate to use imports as markers, as it adds extra work on my side which by default wouldn't be needed. (eg. walk import table, and remove IID which points to my fake_import_marker.dll), and also there is always chance that searching for call dword ptr[mymarker_start] can lead to wrong data, and wrong analyse

However everybody should know whom are developing using asm on x64 that you must keep stack always 16 byte aligned, as some sse instructions require memory to be 16 byte aligned when data is written to memory, otherwise you will get exception. I learnt this in hard way, after 1h debugging why application crashed when writing to existing and r/w memory from some API call (don't even remember what API this was)
__________________
http://accessroot.com

Last edited by deroko; 12-31-2010 at 23:29.
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
About .Net Packing and Introduction BackTangent General Discussion 10 06-12-2011 20:24


All times are GMT +8. The time now is 21:29.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )