assembly - Unable to understand a disassembling of a function -


i've disassembled following simple function , i'm failing understand few things. i'd glad if people me out

this function i'm disassembling:

int foo(int a, int b, int c){      int t = 4;     int t2 = 5;     int t6 = 6;      t = b;     t2 = c;       return (a *= t6);    } 

i invoked main function following parameters:

foo(2,3,4); 

and function has been disassembled into:

.text:004013be ; _dword __cdecl foo(int, int, int) .text:004013be                 public __z3fooiii .text:004013be __z3fooiii      proc near               ; code xref: _main+2dp .text:004013be                                         ; _main+5cp .text:004013be .text:004013be var_c           = dword ptr -0ch .text:004013be var_8           = dword ptr -8 .text:004013be var_4           = dword ptr -4 .text:004013be arg_0           = dword ptr  8 .text:004013be arg_4           = dword ptr  0ch .text:004013be arg_8           = dword ptr  10h .text:004013be .text:004013be                 push    ebp .text:004013bf                 mov     ebp, esp .text:004013c1                 sub     esp, 10h .text:004013c4                 mov     [ebp+var_4], 4 .text:004013cb                 mov     [ebp+var_8], 5 .text:004013d2                 mov     [ebp+var_c], 6 .text:004013d9                 mov     eax, [ebp+arg_4] .text:004013dc                 mov     [ebp+var_4], eax .text:004013df                 mov     eax, [ebp+arg_8] .text:004013e2                 mov     [ebp+var_8], eax .text:004013e5                 mov     eax, [ebp+arg_0] .text:004013e8                 imul    eax, [ebp+var_c] .text:004013ec                 mov     [ebp+arg_0], eax .text:004013ef                 mov     eax, [ebp+arg_0] .text:004013f2                 leave .text:004013f3                 retn .text:004013f3 __z3fooiii      endp 
  • when loading local variables of function (var_c, var_8, var_4) esp pointer substracted 10h, 16 in decimal, every variable within our stack memory four bytes, , have 3 local variables - hence esp pointer should substracted 12 ( 0ch ), why substracted 16?

( .text:004013c1 sub esp, 10h )

  • in point return address of procedure saved?, old esp?, when saved?

sub     esp, 10h 

i wouldn't worry this. though 12 bytes needed these local variables, compiler might have reason allocate in steps of 16 bytes.

in point return address of procedure saved?

this resides @ [ebp+4]

also old esp?, when saved?

the leave instruction mov ebp esp, restoring stack pointer.


mov     [ebp+arg_0], eax mov     eax, [ebp+arg_0] 

i more worried these superfluous codes. result in eax. why move around that?


Comments

Popular posts from this blog

sublimetext3 - what keyboard shortcut is to comment/uncomment for this script tag in sublime -

java - No use of nillable="0" in SOAP Webservice -

ubuntu - Laravel 5.2 quickstart guide gives Not Found Error -