assembly - Unable to understand a disassembling of a function -
i've disassembled following simple function , i'm failing understand few things. i'd glad if people me out
this function i'm disassembling:
int foo(int a, int b, int c){ int t = 4; int t2 = 5; int t6 = 6; t = b; t2 = c; return (a *= t6); }
i invoked main function following parameters:
foo(2,3,4);
and function has been disassembled into:
.text:004013be ; _dword __cdecl foo(int, int, int) .text:004013be public __z3fooiii .text:004013be __z3fooiii proc near ; code xref: _main+2dp .text:004013be ; _main+5cp .text:004013be .text:004013be var_c = dword ptr -0ch .text:004013be var_8 = dword ptr -8 .text:004013be var_4 = dword ptr -4 .text:004013be arg_0 = dword ptr 8 .text:004013be arg_4 = dword ptr 0ch .text:004013be arg_8 = dword ptr 10h .text:004013be .text:004013be push ebp .text:004013bf mov ebp, esp .text:004013c1 sub esp, 10h .text:004013c4 mov [ebp+var_4], 4 .text:004013cb mov [ebp+var_8], 5 .text:004013d2 mov [ebp+var_c], 6 .text:004013d9 mov eax, [ebp+arg_4] .text:004013dc mov [ebp+var_4], eax .text:004013df mov eax, [ebp+arg_8] .text:004013e2 mov [ebp+var_8], eax .text:004013e5 mov eax, [ebp+arg_0] .text:004013e8 imul eax, [ebp+var_c] .text:004013ec mov [ebp+arg_0], eax .text:004013ef mov eax, [ebp+arg_0] .text:004013f2 leave .text:004013f3 retn .text:004013f3 __z3fooiii endp
- when loading local variables of function (var_c, var_8, var_4) esp pointer substracted 10h, 16 in decimal, every variable within our stack memory four bytes, , have 3 local variables - hence esp pointer should substracted 12 ( 0ch ), why substracted 16?
( .text:004013c1 sub esp, 10h )
- in point return address of procedure saved?, old esp?, when saved?
sub esp, 10h
i wouldn't worry this. though 12 bytes needed these local variables, compiler might have reason allocate in steps of 16 bytes.
in point return address of procedure saved?
this resides @ [ebp+4]
also old esp?, when saved?
the leave
instruction mov ebp
esp
, restoring stack pointer.
mov [ebp+arg_0], eax mov eax, [ebp+arg_0]
i more worried these superfluous codes. result in eax
. why move around that?
Comments
Post a Comment