# Function Stack Frame Details

Posted by Tryfan on Fri, 05 Nov 2021 17:02:22 +0100

## Preface

Acceptance said today Function Stack Frame Details (1) To talk specifically about things inside the MyAdd() function.

## Sample Code

```int MyAdd(int a, int b)
{
int c = 0
c = a + b;
return c;
}

int main()
{
int x = 0xA;
int y = 0xB;
int z = 0;

printf("z = %d\n", z);
return 0;
}
```

Today's assembly language

```int MyAdd(int a, int b)
{
001E2EC0  push        ebp
001E2EC1  mov         ebp,esp
001E2EC3  sub         esp,0CCh
001E2EC9  push        ebx
001E2ECA  push        esi
001E2ECB  push        edi
001E2ECC  lea         edi,[ebp-0Ch]
001E2ECF  mov         ecx,3
001E2ED4  mov         eax,0CCCCCCCCh
001E2ED9  rep stos    dword ptr es:[edi]
001E2EDB  mov         ecx,1EC003h
001E2EE0  call        001E130C
int c = 0;
001E2EE5  mov         dword ptr [ebp-8],0
c =a + b;
001E2EEC  mov         eax,dword ptr [ebp+8]
001E2EF2  mov         dword ptr [ebp-8],eax
return c;
001E2EF5  mov         eax,dword ptr [ebp-8]
}
001E2EF8  pop         edi
001E2EF9  pop         esi
001E2EFA  pop         ebx
001E2F01  cmp         ebp,esp
001E2F03  call        001E1235
001E2F08  mov         esp,ebp
001E2F0A  pop         ebp
001E2F0B  ret
```

Our Stack Frame Graph

## Formation of MyAdd Function Stack Frame

### Step One

```00821740  push        ebp
```

This command pushes the contents of the ebp (that is, the bottom of the stack) into the stack, and the top of the stack changes as well.

### Step 2

mov: Data transfer instructions

```00821741  mov         ebp,esp
```

This command means to overwrite the contents of esp to ebp

• The content of the esp directly overwrites the content of the ebp
• The process passes directly through the CPU without passing through memory

Then we may be confused, what to do at the bottom of the stack, can't we find it back? Actually not. Last step we did not save the bottom of the stack!!!

### Step 3

sub: subtraction command

```00821743  sub         esp,0CCh
//The size of 0CCh depends on the size of the function you define
```

This command means esp minus a certain value and places the result in esp

Here we have nearly formed the stack frame for MyAdd()

### Step 4

```int c = 0;
001E2EE5  mov         dword ptr [ebp-8],0
//Create a space at ebp-8 to put the value of c in
```

This is the same as main's variable development

### Step 5

```c =a + b;
001E2EEC  mov         eax,dword ptr [ebp+8]
001E2EF2  mov         dword ptr [ebp-8],eax
```

One-by-one analysis

```001E2EEC  mov         eax,dword ptr [ebp+8]
```

Place ebp+8 in eax
So what is ebp+8? The answer is a copy of our x-value

Same as

```001E2EEF  add         eax,dword ptr [ebp+0Ch]
```

This command adds ebp+0Ch's content and eax to eax
ebp+0Ch is a copy of the y value

```001E2EF2  mov         dword ptr [ebp-8],eax
```

This command writes eax to ebp-8, or c

### Step One

```001E2EF5  mov         eax,dword ptr [ebp-8]
```

Save Return Value

### Step 2

```001E2F08  mov         esp,ebp
```

Overwrite ebp to esp
This step can also be called Release Stack Frame

### Step 3

pop: data pops up to the specified location and the esp stack top register changes

```001E2F0A  pop         ebp
```

"Bullet Stack"
Place the base of main function in ebp, esp content changes

### Step 4

ret: restore return address, press eip, similar to pop eip command

```001E2F0B  ret
```

Put the next address of the previous call in eip, esp content changes

### Step 5

A variable that releases a temporary copy

```001E1E87  add         esp,8
```

Means esp+8 in ESP

Now we're back before MyAdd executes

### Step 6

```001E1E8A  mov         dword ptr [ebp-20h],eax
```

Put the eax value in ebp-20 (z)

The essence of return