0

Today I've written the assembly code that is used for printing the debug string in this pattern:

"rax = 1 rbx = -2 rcx = 3 rdx = -4 rsi = 5 rdi = -6 r8 = 7 r9 = -8 r10 = 9 r11 = 0 r12 = 11 r13 = -12 r14 = 13 r15 = -14"

But to test this code I just wrote it repeatedly like this:

    call _getDebugString
    mov r9, debugString
    call _printTextSafe
    call _getDebugString
    mov r9, debugString
    call _printTextSafe
    mov r11, -24
    call _getDebugString
    mov r9, debugString
    call _printTextSafe
    call _getDebugString
    mov r9, debugString
    call _printTextSafe
    call _exit

In my subroutine _getDebugString I push all used registers to safe them. But there's problem with register r11. After a subroutine completed its always 582.

You can check this out, here's the respond:

rax = 1 rbx = -2 rcx = 3 rdx = -4 rsi = 5 rdi = -6 r8 = 7 r9 = -8 r10 = 9 r11 = 0 r12 = 11 r13 = -12 r14 = 13 r15 = -14

rax = 1 rbx = -2 rcx = 3 rdx = -4 rsi = 5 rdi = -6 r8 = 7 r9 = 4202678r10 = 9 r11 = 582 r12 = 11 r13 = -12 r14 = 13 r15 = -14

rax = 1 rbx = -2 rcx = 3 rdx = -4 rsi = 5 rdi = -6 r8 = 7 r9 = 4202678r10 = 9 r11 = -24 r12 = 11 r13 = -12 r14 = 13 r15 = -14

rax = 1 rbx = -2 rcx = 3 rdx = -4 rsi = 5 rdi = -6 r8 = 7 r9 = 4202678r10 = 9 r11 = 582 r12 = 11 r13 = -12 r14 = 13 r15 = -14

Insights what would it be? Maybe I don't know smth about this register and there's a mystery about number 582?

MindW1n
  • 11
  • 4
  • Let's see the code for `_printTextSafe` and `_getDebugString`. Make this a [mcve]. One special thing about r11 is that's it's overwritten by the `syscall` instruction, so if some part of your code makes a system call without saving and restoring r11, that could explain it. – Nate Eldredge Jan 04 '23 at 21:50
  • 3
    Specifically, `syscall` overwrites r11 with the contents of `rflags`, and 582 = 0x246 is a plausible value for `rflags`. The bits set are bit 9 (IF), bit 6 (ZF), bit 2 (PF), and bit 1 (reserved, always 1). – Nate Eldredge Jan 04 '23 at 21:53
  • Oh shit. Right! In print function I push everything but that. You're genius! Thanks! – MindW1n Jan 04 '23 at 21:55
  • Now it works properly! – MindW1n Jan 04 '23 at 21:55

0 Answers0