¿Es decir que RSP tiene que estar alineado? Eso no lo sabia pero tiene sentido
Si. "The stack will always be maintained 16-byte aligned, except within the prolog (for example, after the return address is pushed), and except where indicated in Function Types for a certain class of frame functions."
https://docs.microsoft.com/en-us/cpp/build/stack-usage?view=msvc-170
Y es basicamente lo mismo para AMD64 System V ABI (https://coderedirect.com/questions/51914/why-does-the-x86-64-amd64-system-v-abi-mandate-a-16-byte-stack-alignment).
Por cierto asi provoque el mismo error, en cuanto hace un syscall se detecta el problema:
Código
entry: push dx ;;;;;;;;;;;;; mov qword ptr [rsp + 030h], 0 mov dword ptr [rsp + 028h], 80 mov dword ptr [rsp + 020h], 2 mov r9d, 0 mov r8d, 0 mov edx, 040000000h lea rcx, offset msg call CreateFileA int 3
(299c.368c): Break instruction exception - code 80000003 (first chance)
cfe!entry+0x43:
00007ff7`74391043 cc int 3
0:000> r eax
eax=ffffffff
0:000> !gle
LastErrorValue: (Win32) 0x3e6 (998) - Invalid access to memory location.
LastStatusValue: (NTSTATUS) 0x80000002 - {EXCEPTION} Alignment Fault A datatype misalignment was detected in a load or store instruction.