Preface

Acceptance said today Function Stack Frame Details (1) To talk specifically about things inside the MyAdd() function.

Sample Code

int MyAdd(int a, int b)
{
	int c = 0
	c = a + b;
	return c;
}

int main()
{
	int x = 0xA;
	int y = 0xB;
	int z = 0;

	z = MyAdd(x, y);
	printf("z = %d\n", z);
	return 0;
}

Today's assembly language

int MyAdd(int a, int b)
{
001E2EC0  push        ebp  
001E2EC1  mov         ebp,esp  
001E2EC3  sub         esp,0CCh  
001E2EC9  push        ebx  
001E2ECA  push        esi  
001E2ECB  push        edi  
001E2ECC  lea         edi,[ebp-0Ch]  
001E2ECF  mov         ecx,3  
001E2ED4  mov         eax,0CCCCCCCCh  
001E2ED9  rep stos    dword ptr es:[edi]  
001E2EDB  mov         ecx,1EC003h  
001E2EE0  call        001E130C  
	int c = 0;
001E2EE5  mov         dword ptr [ebp-8],0  
	c =a + b;
001E2EEC  mov         eax,dword ptr [ebp+8]  
001E2EEF  add         eax,dword ptr [ebp+0Ch]  
001E2EF2  mov         dword ptr [ebp-8],eax  
	return c;
001E2EF5  mov         eax,dword ptr [ebp-8]  
}
001E2EF8  pop         edi  
001E2EF9  pop         esi  
001E2EFA  pop         ebx  
001E2EFB  add         esp,0CCh  
001E2F01  cmp         ebp,esp  
001E2F03  call        001E1235  
001E2F08  mov         esp,ebp  
001E2F0A  pop         ebp  
001E2F0B  ret 

Our Stack Frame Graph

Formation of MyAdd Function Stack Frame

Step One

00821740  push        ebp  

This command pushes the contents of the ebp (that is, the bottom of the stack) into the stack, and the top of the stack changes as well.

Step 2

mov: Data transfer instructions

00821741  mov         ebp,esp 

This command means to overwrite the contents of esp to ebp

• The content of the esp directly overwrites the content of the ebp
• The process passes directly through the CPU without passing through memory
• 

Then we may be confused, what to do at the bottom of the stack, can't we find it back? Actually not. Last step we did not save the bottom of the stack!!!

Step 3

sub: subtraction command

00821743  sub         esp,0CCh
                      //The size of 0CCh depends on the size of the function you define

This command means esp minus a certain value and places the result in esp

Here we have nearly formed the stack frame for MyAdd()

Step 4

int c = 0;
001E2EE5  mov         dword ptr [ebp-8],0  
                      //Create a space at ebp-8 to put the value of c in

This is the same as main's variable development

Step 5

c =a + b;
001E2EEC  mov         eax,dword ptr [ebp+8]  
001E2EEF  add         eax,dword ptr [ebp+0Ch]  
001E2EF2  mov         dword ptr [ebp-8],eax 

One-by-one analysis

001E2EEC  mov         eax,dword ptr [ebp+8]  

Place ebp+8 in eax
So what is ebp+8? The answer is a copy of our x-value

Same as

001E2EEF  add         eax,dword ptr [ebp+0Ch] 

This command adds ebp+0Ch's content and eax to eax
ebp+0Ch is a copy of the y value

001E2EF2  mov         dword ptr [ebp-8],eax 

This command writes eax to ebp-8, or c

Ready to return

Step One

001E2EF5  mov         eax,dword ptr [ebp-8]  

Save Return Value

Step 2

001E2F08  mov         esp,ebp  

Overwrite ebp to esp
This step can also be called Release Stack Frame

Step 3

pop: data pops up to the specified location and the esp stack top register changes

001E2F0A  pop         ebp

"Bullet Stack"
Place the base of main function in ebp, esp content changes

Step 4

ret: restore return address, press eip, similar to pop eip command

001E2F0B  ret 

Put the next address of the previous call in eip, esp content changes

Step 5

A variable that releases a temporary copy

001E1E87  add         esp,8

Means esp+8 in ESP

Now we're back before MyAdd executes

Step 6

001E1E8A  mov         dword ptr [ebp-20h],eax 

Receive Return Value
Put the eax value in ebp-20 (z)

The essence of return

• Return to main stack frame
• Return to the corresponding code

summary

• The stack frame of a function is determined by the compiler
• The space of the variable push enters is continuous
• The size of 0CCh depends on the size of the function you define

Why is the stack frame of a function determined by the compiler?
There are many data types in our C language, which is the compiler's ability to know the size of all types of variables.

I'll see if I need to add some knowledge later.