Call without Parameter Value Transfer What are involved? ESP Stack Pointer Register Grows by 4 for EIP (return address) storage Stack -- Memory which holds register contents Will keep the EIP of the next address after the call EIP Instruction Pointer Register call Push EIP (for keep the return to the main) New EIP value indicates the address of the Procedure Procedure is executed Result is stored in a register (e.g., EAX) ret Pop EIP (to restore the return address) ESP restored to the original value Stack Empty 70
Call without Parameter Value Transfer 71
Procedures with Value Parameters Main program call(s) a procedure Main Program transfers the parameter values push parameters Procedure receives (retrieves) them Read parameters from Stack (by the EBP reference) Procedure may do a task or it may return a value Value return is done via a Register (e.g., EAX) value-returning procedure is sometimes called a function 72
Procedure protocols for Stack Clean-Up 2 Protocols for Procedure handling Cdecl ( C Declaration ) --- Caller Clean-Up Stdcall ( Standard Call ) --- Callee Clean-Up Clean-up means move Stack Pointer back to the original position 73
Cdecl ( C Declaration ) Caller Clean-up convention used by many C systems for the x86 architecture. Default in Visual Studio Function parameters are pushed on the stack. Function return values are returned in the EAX register Registers EAX, ECX, and EDX are available for use in the function. The calling program cleans the stack after the function call returns 74
Stdcall --- we use this in class Callee Clean-up Convention A variation on the Pascal calling convention Callee is responsible for cleaning up the stack Ret N N is added to ESP Parameters are pushed to the stack Registers EAX, ECX, and EDX are designated for use within the function. Return values are stored in the EAX register. Standard calling convention for the Microsoft Win32 API. 75
Call with Parameter Value Transfer What are involved? EBP (base pointer) stored ESP is copied to EBP (Keep ESP): reference for parameters value Parameter values are pushed call Push EIP (for keep the return to the main) Procedure: parameters are popped EBP Restored ret n Pop EIP (to restore the return address) Clean the Stack by ESP + n (Dword) 76
Implementing Value Parameters Parameter values normally passed on the stack Pushed in reverse order from argument list Example Design or high-level code: sum := add2(value1, value2) 80x86 implementation: Caller push ECX ; value2 in ECX push value1 ; dword value1 in memory call add2 ; call procedure add2 mov sum, EAX ; sum in memory 77
Procedure Code Since the stack pointer ESP may change, a procedure starts to store (push) the base pointer EBP in the stack This location is fixed until the procedure code restores EBP right before returning ESP is now copied (mov) to EBP In the procedure body, parameters are located relative to EBP Procedure code also saves contents of registers if they are used locally within the procedure body procedure code restores these registers before exit (ret) 78
Example Procedure add2 PROC ; add two words passed on the stack ; return the sum in the EAX register push EBP ; save EBP mov EBP,ESP ; establish stack frame mov EAX,[EBP+8] ; copy first parameter value add EAX,[EBP+12] ; add second parameter value pop EBP ; restore EBP ret 8 ; return with ESP+8 add2 ENDP 79
Stack Frame Upon Entry to Procedure add2 and After EBP Established in Entry Code 80
Structure of Procedure in Coding (Stdcall) 81
Procedure Example CallAddTwo.asm ( Stdcall ) 82
83
push EAX ;for word1 84
push EAX ;for word2 85
call AddTwo Note that EIP (for return address) is stored in the stack 86
push EBP 87
mov EBP, ESP ;to save ESP 88
mov EAX,[EBP+12] 89
add EAX, [EBP+8] 90
pop EBP 91
ret 8 ;Add 8 to ESP 92
Manual Tracking of Stack, EIP, and ESP 93
Summary for Stdcall MAIN CODE 1. Parameter values passed on the stack 2. Call a procedure (this pushes the return address in EIP to the stack) PROCEDURE 1. Push EBP and Copy ESP to EBP (EBP becomes the reference for retrieving the parameter values) fixed location on the stack while ESP may vary. 2. Push Register(s) if necessary 3. Retrieve Parameter values referenced to EBP 4. Do the functions 5. Pop the Register(s) if pushed 6. Pop EBP 7. Ret N (First, this pops the return address to EIP. And, second, N, which is the number of bytes pushed in the MAIN CODE, is added to ESP) MAIN CODE 1. Continue for the next step. 95