Search code examples
assemblyx86stack-frame

about esp stack balance


I saw a piece of code like this in asm:

.text:787924E0 testcall        proc near             
.text:787924E0
.text:787924E0 var_F0          = dword ptr -0F0h
.text:787924E0 var_34          = byte ptr -34h
.text:787924E0 retValue        = std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> > ptr -24h
.text:787924E0 var_4           = dword ptr -4
.text:787924E0 result          = dword ptr  8
.text:787924E0 agr1            = std::basic_string<char,std::char_traits<char>,std::allocator<char> > ptr  0Ch
.text:787924E0
.text:787924E0                 push    ebp
.text:787924E1                 mov     ebp, esp
.text:787924E3                 sub     esp, 0F4h
.text:787924E9                 push    ebx
.text:787924EA                 push    esi
.text:787924EB                 push    edi

.text:78792555                 mov     eax, [ebp+result]
.text:78792558                 push    edx
                               ...
.text:78792567                 pop     eax
.text:78792568                 pop     edx
.text:78792569                 pop     edi
.text:7879256A                 pop     esi
.text:7879256B                 pop     ebx
.text:78792576                 add     esp, 0F4h
.text:78792583                 mov     esp, ebp
.text:78792585                 pop     ebp
.text:78792586                 retn

enter image description here

I want to know the basic knowledge questions:

sub esp, 0F4h

why is 0xF4, how is it calculated ?


Solution

  • In old days people used ebp to point top of the old stack position. nowadays compilers can manually count and allocate enough space end then return the old stack position without ebp. also stack is top to bottom not bottom the top so when you subtract esp you allocate new space in stack.