Hahah .. I am now posting the basic for the function local variable in assembly. Local varible is a variable where only be used just within the function and its operation. Lets see an example C code below
Then we can load the exe to IDA. We can jump straight to the check function that as follow
We can see the above picture. After the function prologue there is additional assembly code that is sub esp, 10h this code actually creating the stack space as much as 16 bytes or 10h to contain all the variables int = 4 bytes, sinve we have 2 local variable then we need at least 2 x 4 bytes = 8. But since we compile it in debug mode then compiler spare some space to it
We can see from the above ilustration EBP is the reference point for accessing the variable in the stack.
The convension is for local variable must be assigned to lower memory address or from the picture above is local variable is at the top of EBP where to access it will be EBP-XX where XX is the number of bytes required.
So for example we want to access height variable then we need to do EBP+(-8) or accessing width using EBP+(-4)
but usually if you load to IDA then it will help creating like macro to change the instructio more readble
so to access the variable EBP will be added by the macro then it will use EBP+width or EBP+height
we can see on the above assembly code that the we are assigning value to heigh and width using below code
I will post the explanation for variable that is passed to the function in the next post
Today I am going to explain about function call in assembly. We should understand it because function call is part of the essential things to understand because it has alot of next sub material such as memory stack, return value and also the application flow.
To make it easier, let start our assembly tutorial by coding an application in C as follow
in the above code that the application will call a function called check where the function does nothing but return 5 to the main function. Let see how it is in the assembly after it is compiled into binary
we can see that in the above picture that the main fucntion will call _check. A function will always be initilized by at least 2 instructions
the above 2 instructions are called function prologue where it will save the value of old ebp from the previous frameand following instruction is to make the ebp to become equal to esp. why this operation is crucial because ebp will become the base pointer for the stack and as the reference to access local variable and passed variable where esp will always change because it will mark as the top of stack
the first push ebp is intended to save the main function ebp pointer or caller ebp address.
the second instruction is mov ebp, esp means it is to initiate the stack frame base address where ebp usually never change after it is initiated and esp will wander as the compiler want it to go
So the next is when the function finish its execution, the function shall return to the caller. it is called as function epilog
.text:00401358 pop ebp .text:00401359 retn
functon epilog is the sequence to return to the previous execution in the caller function that stored in retn. the sequece is pop ebp and next to return to address in retn
we will later talk about the stack in detail in the next post because it is very interesting and crucial to undertand it correctly