Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How should the byte sequence 0x40 0x55 be interpreted by an x86-64 emulator?

I'm working with an emulator, and one of the binary executables I've run across has the following sequence in the beginning of a procedure

40 55

The 40 is a REX prefix, but none of the REX bits are actually set. Section 2.2.1.7 of the Intel software developer's manual states that instructions that implicitly reference the stack pointer will have 64-bit widths. Since 55 is the push ?bp instructions, it seems that a simple 55 would suffice to generate a push rbp. So why is the 40 prefix there?

like image 536
John Källén Avatar asked Jun 07 '15 21:06

John Källén


1 Answers

As Jongware states in his comment the 40 REX prefix is ignored. The reason why you're seeing this however isn't because of a broken compiler, but because the compiler is following the Windows x64 ABI. Functions are required to begin with an instruction that's at least two-bytes long to allow for hotpatching. You might also see other push instructions with a meaningless REX prefix.

like image 78
Ross Ridge Avatar answered Oct 08 '22 00:10

Ross Ridge