3

I have the following disassembly of a function prologue with comments. I'm unclear on what the author means in this line of disassembly "lea edi,[ebp-0xcc] ; getting the lowest address of stack frame". Dumping the headers of the executable I see the following in the OPTIONAL HEADER VALUES: 100000 size of stack reserve 1000. Windows Threads default stack size is 1MB so I'm believe the values from dumpbin are in units of Kilo.

Can you please clarify this statement: lea edi,[ebp-0xcc] ; getting the lowest address of stack frame

push ebp            ; establishing stack frame 
mov ebp,esp         ; save stack pointer in ebp
sub esp,0xcc        ; creating stack frame for local variables
push ebx            ; saving registers that might be used
push esi            ; outside
push edi            ;                                     
lea edi,[ebp-0xcc]  ; getting the lowest address of stack frame 
mov ecx,0x33        ; filling stack frame with 0xCC
mov eax,0xcccccccc  ; 
rep stosd           ;
1
  • After looking further at the disassemble I see where that sub esp,0xcc establishes space on the stack for locals. Hence the lea edi, ebp-0xcc. Saves the lowest stack address in edi.
    – dcrearer
    May 17, 2016 at 15:37

1 Answer 1

1

this doesnt have anything to do with stack size in pe header

assume  esp = 1200cc 
so ebp will also be 1200cc
sub esp,0xcc  will make esp 120000   
the three pushes will alter esp but not ebp   
so  edi will be 120000   after that operation   
ecx = counter == 33  eax = 0xcccccccc 
so rep stosd will fill the space from 120000 to 1200cc with 0xcccccccc

simply put it is memset(&ebp,0xcc,0xcc);

1
  • thanks for the feedback. After looking at the disassembly in further depth. I was able to understand the sequence of instruction. I appreciate your input on this question.
    – dcrearer
    May 17, 2016 at 18:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.