5

Well first I understand (or a I think that I understand) the problems of misaligned stack.

But I know (like a definition) that pushing a 16bit value to 32bit wide stack could cause a stack misaligned.

But the thing I dont understand, is how this could happend...since PUSH and POP check the D flag at the segment descriptor (so is 1 increments/decrements 32bits and is 0 16bits).

Suppose that D flag=1, should PUSH AX do a 32bits decrement? so its like I "miss" 16bits in the stack?

I am not sure that I understand this problem

starblue
  • 55,348
  • 14
  • 97
  • 151
llazzaro
  • 3,970
  • 4
  • 33
  • 47

1 Answers1

4

While both push and pop check the D-bit in the segment descriptor to determine the default operand size (i.e. 16 or 32/64 bits), it can be overridden with an operand size override 0x66.

If the D-bit is 0, then:

ff /6 

pushes 16 bits onto the stack

and

66 ff /6 

pushes 32 bits (or 64 if it's a 64-bit segment).

If the D-bit is 1, then the opposite is true.

In any case, ESP (or RSP or just SP, depending on the address size) is incremented or decremented by 2 (for 16 bit operations), 4 (for 32 bit operations) or 8 (for 64 bit operations).

Nathan Fellman
  • 122,701
  • 101
  • 260
  • 319