Why [ebp - 8] ?

This is a discussion on Why [ebp - 8] ? within the Tech Board forums, part of the Community Boards category; I don't understand this. I was fiddling with accessing local variables without using their "names", purely in the interests of ...

  1. #1
    Supermassive black hole cboard_member's Avatar
    Join Date
    Jul 2005
    Posts
    1,709

    Why [ebp - 8] ?

    I don't understand this. I was fiddling with accessing local variables without using their "names", purely in the interests of education. I got this far:

    Code:
    __declspec(naked) long aFunc()
    {
        long var;
    
        __asm
        {
            push ebp
            mov ebp, esp
            sub esp, 4
    
            mov [ebp - 2], 1
            mov eax, [ebp - 2]
    
            mov esp, ebp
            pop ebp
            ret
        }
    }
    I made it naked so the output assembly code is a little more legible (to me at least). Anyways, in the MSDN docs, it says that "The locals area begins at ebp-2. To access local variables, calculate an offset from ebp by subtracting the appropriate value from ebp."

    So here's me subtracting 2 from ebp with no avail.
    "Ok" I thought. A long is 4 bytes, right? So I try to subtract 4, also with no desired results.

    So I give up, replace it with 'var' and view the compiler's assembly output with the symbol names switched off.

    8 is the number I'm looking for and I can't figure out why.
    Why 8? What else is on the stack? The return address is out of the way right? I thought that's why it starts at ebp-2?
    Good class architecture is not like a Swiss Army Knife; it should be more like a well balanced throwing knife.

    - Mike McShaffry

  2. #2
    Dump Truck Internet valis's Avatar
    Join Date
    Jul 2005
    Posts
    357
    stack:
    stuff
    params
    return address (for ret, it's not out of the way unless msvc is crazy)
    ebp (that was pushed upon entrance)

    Both topmost values are dwords.

  3. #3
    Supermassive black hole cboard_member's Avatar
    Join Date
    Jul 2005
    Posts
    1,709
    I think I understand. Maybe.
    Good class architecture is not like a Swiss Army Knife; it should be more like a well balanced throwing knife.

    - Mike McShaffry

  4. #4
    Super Moderator VirtualAce's Avatar
    Join Date
    Aug 2001
    Posts
    9,598
    EBP-8 is where the first parameter being passed to the function is at. This is due to what valis posted.

  5. #5
    Registered User
    Join Date
    May 2006
    Posts
    20
    I've been researching similiar ideas. And I'm having trouble understanding alot of the assembly code. I've been using gdb to disassemble a couple of little programs, but I never know exactly what I'm looking at.

    Is there a good resource for this?

    Thanks,
    Michael

  6. #6
    (?<!re)tired Mario F.'s Avatar
    Join Date
    May 2006
    Location
    Portugal
    Posts
    7,577
    Maybe start with http://www.acm.uiuc.edu/sigmil/RevEng/ch06.html

    And then move on to http://www.osdata.com/topic/language/asm/asmintro.htm

    Pay attention to the book recommendations. You will need one or two of those
    The programmer’s wife tells him: “Run to the store and pick up a loaf of bread. If they have eggs, get a dozen.”
    The programmer comes home with 12 loaves of bread.


    Originally Posted by brewbuck:
    Reimplementing a large system in another language to get a 25% performance boost is nonsense. It would be cheaper to just get a computer which is 25% faster.

  7. #7
    Dump Truck Internet valis's Avatar
    Join Date
    Jul 2005
    Posts
    357
    yeah, I wouldn't start out reverse engineering because there are very large amounts of wierd tricks that are commonly performed that obfuscate the code (but are there to increase performance).
    The art of assembly language is good
    Assembly language for intel based computers is also (provides less info than the art)

    After you get the basics down I would recommend getting intel's system manuals and info on extensions like mmx, sse, and the cpuid instruction.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. Replies: 11
    Last Post: 03-25-2003, 05:13 PM

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21