I'm completely new to Assembly and looking to confirm where, in the following statements, I have a misunderstanding and need to be corrected.
The stack pointer (ESP
) refers to the top (lowest memory address) of the stack.
The base Pointer (EBP
) is used for temporarily storing various memory addresses when building a stack frame. It normally holds the highest memory address of the current stack frame.
The instruction pointer (EIP
) refers to the memory address of a line of code in the text (code) segment of memory
Once something has been pushed to the stack, it can't be changed in-place. ie. If we PUSH EBP
to the stack, we are pushing the current value of EBP
, not some kind of reference or pointer to it. We can't then change that value in-place.
Arguments being passed into a function are generally moved into an address space which is an offset of the stack pointer. ie. [ESP-12]
.
When a function is called (using CALL
), the following occurs:
- The return address is added to the stack (the memory of the address immediately following the current
EIP
so we know where to return to after the called function has completed - The saved frame pointer is added to the stack, which is normally the stack pointer of the stack frame of the calling function
- We would then move into the prologue of the called function
Thanks. I'm trying to get my head around this stuff.
Often arguments are pushed on the stack, before the call.
This leads to the following stack content:
Since the return address (pushed by the
call
) is 4 bytes, the parameters for the function are at[ESP+4]
and[ESP+8]
.If your function adds a stack frame, usually you do
Now the stack looks like this:
and the parameters are at
[EBP+8]
and[EBP+12]
, even if you push more values (or add some place for local variables) sinceEBP
is not changing anymore:The local variables are at
[EBP-4]
,[EBP-8]
,[EBP-12]
etc.The return Address is at
[EBP+4]
Note: As you can see, it is possible
ESP
(then you do not need a frame-pointer, but then you need to keep track of how much data you pushed, to "find" the parameters and variables )EBP
(which ofc adds some overhead). In many functions, the frame pointer is not needed at all, and optimized away by compilers.Sure you can. Stack is ordinary computer memory, there's nothing special about it, except that 99% of code expects valid (read+write access) memory address in
esp
and some reserved space, so it can push some local things to it, as needed.Is almost equivalent to:
(but the second variant will also modify flags and it is somewhat less atomic)
Now you can overwrite it with anything else, like:
Well, there's no way to have some kind of reference or pointer to the
ebp
register, it's a register in CPU, only 32 bits (32x 0 or 1 value) and it has no address, you can work with it only by its nameebp
in instructions, which allow usage of it in their encoding.Upon
push ebp
those 32 bits (and no other info) are copied into memory (which is then holding those 0/1 values copied in its own 32 bits = 4 bytes). There's no information where the value in memory was written from, when and by what instruction, only value bits are stored.