Behavior of ebp and esp in packages using function with parameter

Question

I want to know more about the stack. Especially what happens when a function is called with a parameter. To do this, I will write the following code:

#include <stdio.h> int sum(int d, int e, int f){ int result = d + e + f; return result; } int main(void){ int a = 5; int b = 4; int c = 2; int erg = sum(a,b,c); printf("Result is: %d", erg); } 

and I get the following Assembly-Code (I will add only part of the main function because I want to understand this section first):

  push ebp, mov ebp, esp and esp, -16 sub esp, 32 mov DWORD PTR[esp+28], 5 mov DWORD PTR[esp+24], 4 mov DWORD PTR[esp+20], 2 mov eax, DWORD PTR[esp+20] mov DWORD PTR[esp+8], eax mov eax, DWORD PTR[esp+24] mov DWORTD PTR[esp+4], eax mov eax, DWORD PTR[esp+28] mov DWORD PTR[esp], eax call sum ........ ........ 

So, for this part, I draw a little sketch for myself. Take a look, please :) My question is: Where is my ebp at this moment? Due to line 2 of my assembler code, it should be in the same place as [esp] , right?

Now, the part of the sum function that follows my second question.

so here is the assembler code:

  push ebp mov ebp, esp sub esp, 16 mov eax, DWORD PTR[ebp+12] mov edx, DWORD PTR[ebp+8] mov edx, eax ------------ 

So, I found out that we can always find our parameters in [eb+12] and [ebp+8] . (I skipped the third parameter because I want to keep it simple) So my question is: If I assume that esp = ebp and I look at my sketch, I see that in [esp+12] or now [ebp+12] there is nothing. But, nevertheless, it is used. How can I imagine this?

Can someone help me? I read so many papers, but no one seems to have sketched these things. Because of this, it is very difficult to understand this.

Thanks!

Here is my sketch:

Answer 1

During execution of the first function, esp and ebp have the same value only immediately after the instruction mov ebp, esp . After that, and esp, -16 resets the lower 4 bits (the lowest nibble) of esp , and esp and ebp diverge, unless the least significant bits of esp already zeros. Then sub esp, 32 subtracts 32 from esp , and here esp and ebp course.

 push ebp ; esp = esp - 4; [esp] = ebp. mov ebp, esp ; ebp = esp. create the stack frame. and esp, -16 ; make lowest 4 bits of esp zeros, for alignment. sub esp, 32 ; esp = esp - 32. make space for local variables. mov DWORD PTR[esp+28], 5 ; a = 5 mov DWORD PTR[esp+24], 4 ; b = 4 mov DWORD PTR[esp+20], 2 ; c = 2 mov eax, DWORD PTR[esp+20] ; eax = c (eax = 2) mov DWORD PTR[esp+8], eax ; [esp+8] = dword 2 mov eax, DWORD PTR[esp+24] ; eax = b (eax = 4) mov DWORTD PTR[esp+4], eax ; [esp+4] = dword 4 mov eax, DWORD PTR[esp+28] ; eax = a (eax = 5) mov DWORD PTR[esp], eax ; [esp] = dword 5 call sum ; the above lines define the parameters for the ; function sum, that is called now. 

Then regarding your second question:

 push ebp ; esp = esp - 4; [esp] = ebp. mov ebp, esp ; ebp = esp. sub esp, 16 ; esp = esp - 16. create space for local variables. ; at this point: ; [ebp] == old value of ebp. ; [ebp+4] == return address pushed by call, ; to be used by the next ret. ; [ebp+8] == dword 5 (a) ; [ebp+12] == dword 4 (b) ; [ebp+16] == dword 2 (c) mov eax, DWORD PTR[ebp+12] ; eax = 4 mov edx, DWORD PTR[ebp+8] ; edx = 5. gets overwritten by the next instruction. mov edx, eax ; edx = eax = 4 

Do not accept esp == ebp . In this second function, too, esp and ebp diverge when running the sub esp,16 command. Learn to use a debugger such as GDB and one-step code, and follow the values ​​of the registers (especially esp ) and memory after each instruction. You can also debug the code in your head, as I said above, but if you are new to the assembly, using a debugger is usually much simpler and much less error prone.

Answer 2

The following is a pretty decent explanation of what happens to the stack, stack frame, ebp and esp when calling the routine with parameters. Hope this is helpful. What is a frame stack in an assembly?