jackall
June 22nd, 2008, 03:52
This request is related to the Stack frame.
It is in continuation to my endeavor to acquire at least a basic level of that elusive reverenced skill aka reversing.
#include<stdio.h>
int test (int h)
{
if (h==3)
{
return 1;
}}
void main (int argc, char *argv [] )
{
int j, i=3;
j=test (i); //-------> Line 12
}
A function is called from line-12 and the argument (int h) is pushed on the stack frame (please correct me !). Then EBP value is saved on the stack (Seen in asm as PUSH EBP)...Return address is saved on the stack. So,EBP+4 is the return address.
Now, EBP is given a new value . Then, ESP makes room to accommodate local variable (i and j).
In the Assembly below, it can be seen that an 8-byte space is allotted for the two local variables present,
00401220 > $ 55 PUSH EBP
00401221 . 89E5 MOV EBP, ESP
00401223 . 83EC 08 SUB ESP, 8
00401226 . C70424 010000> MOV DWORD PTR SS: [ESP], 1
0040122D . FF15 D0504000 CALL DWORD PTR DS:[<&msvcrt.__set_app_type>] ; msvcrt.__set_app_type
00401233 . E8 C8FEFFFF CALL Return.00401100
What i fail to see in asm is the:
(1) Code that pushed the arguments to the stack Frame and the
(2) Instruction that saved the return address on the stack frame.
It may be right there gawping at my blindness, but right now iam opaque.
The executable is attached for your helpful glance if ever needed.
Regards…
It is in continuation to my endeavor to acquire at least a basic level of that elusive reverenced skill aka reversing.
#include<stdio.h>
int test (int h)
{
if (h==3)
{
return 1;
}}
void main (int argc, char *argv [] )
{
int j, i=3;
j=test (i); //-------> Line 12
}
Code:
“When a function is called, its arguments are pushed on the stack.”
A function is called from line-12 and the argument (int h) is pushed on the stack frame (please correct me !). Then EBP value is saved on the stack (Seen in asm as PUSH EBP)...Return address is saved on the stack. So,EBP+4 is the return address.
Now, EBP is given a new value . Then, ESP makes room to accommodate local variable (i and j).
In the Assembly below, it can be seen that an 8-byte space is allotted for the two local variables present,
00401220 > $ 55 PUSH EBP
00401221 . 89E5 MOV EBP, ESP
00401223 . 83EC 08 SUB ESP, 8
00401226 . C70424 010000> MOV DWORD PTR SS: [ESP], 1
0040122D . FF15 D0504000 CALL DWORD PTR DS:[<&msvcrt.__set_app_type>] ; msvcrt.__set_app_type
00401233 . E8 C8FEFFFF CALL Return.00401100
What i fail to see in asm is the:
(1) Code that pushed the arguments to the stack Frame and the
(2) Instruction that saved the return address on the stack frame.
It may be right there gawping at my blindness, but right now iam opaque.
The executable is attached for your helpful glance if ever needed.
Regards…