Explanation of disassembling the simplest program (x86)

Question

Following code

int _main() {return 0;}

Compiled using the command:

gcc -s -nostdlib -nostartfiles 01-simple.c -o01-simple.exe

gcc version 4.4.1 (TDM-1 mingw32)

OllyDbg produced this result:

Can you explain what is going on here? Analysis so far:

// these two seems to be an idiom:
PUSH EBP        // places EBP on stack
MOV EBP, ESP    // overwrites EBP with ESP

MOV EAX, 0      // EAX = 0

LEAVE          // == mov esp, ebp
               //    pop ebp
               // according to 
               // http://en.wikipedia.org/wiki/X86_instruction_listings

What is the point of all this?

Answer 1

This creates a frame.

PUSH EBP      
MOV EBP, ESP  

In the calling convention used, the return value is returned via EAX(therefore 0exists because you wrote return 0;- try changing this to return 1;and see how this affects the code).

MOV EAX, 0 

( MOV ESP, EBP, POP EBP, , ):

LEAVE

Answer 2

, int _main(),

PUSH EBP
MOV EBP, ESP

, , EBP + (WORD, BYTE, LONG ..).

EAX ,

MOV EAX, 0
LEAVE

, , 0 .

, .

POP EBP

, , ( DOS), unix-, , , script.

Answer 3

MOV EAX, 0 ' . .

"LEAVE" , . , , , .