What is the state of the stack in the entry function?

Question

I have an ELF binary and in the entry function the first two instructions are:

XOR EBP, EBP
POP ESI

I'm curious what the state of the stack is at the start of the entry function in ELF and PE binaries (and others if possible). I had thought it was empty but presumably there is something there to be poped.

Answer 1

In the _start function, argc, argv and envp are contained on the stack.

A good read on this is the Linux x86 Program Start Up or - How the heck do we get to main()?

When you run a program, the shell or gui calls execve() which executes the linux system call execve(). If you want more information about execve() then you can simply type man execve from your shell. It will come from section 2 of man where all the system calls are. To summarize, it will set up a stack for you, and push onto it argc, argv, and envp. The file descriptions 0, 1, and 2, (stdin, stdout, stderr), are left to whatever the shell set them to. The loader does much work for you setting up your relocations, and as we'll see much later, calling your preinitializers. When everything is ready, control is handed to your program by calling _start().

Answer 2

The stack layout at the entry point for 32-bit Linux executables is described in the System V Intel386 Architecture ABI Supplement.

It looks like following:

So pop edi copies the argc value into edi and the following code probably builds the argv array for the main function.