Intel 64 bits, strange RSP behavior

问题:

I came accross a problem with debugging a 64 bit binary in Windows using IDA. Normally, after a push RSP value should be deducted by 8. But occasionally, from IDA I saw that RSP was only deducted by 2, and then 8 for the next Push.

The codes involved are

push rax
push rbx
push rsi
push rdi

I'm quite new to x64 environment, thus could anyone explain this behavior ?

回答1:

You're probably getting mixed up by hexadecimal. Counting by 8 goes

0  8  10  18  20  28  30

Are you looking at that and thinking 10 - 8 == 2? Because it's 0x10 - 0x8 == 0x8.