I'm studying x86 architecture and assembly in order to have the bases for studying reversing and exploit development. I'm following a course on opensecuritytraining.info.
I see a Hello World example:
push ebp
mov ebp, esp
push offset aHelloWorld; "Hello world\n"
call ds:__imp__printf
add esp, 4
mov eax, 1234h
pop ebp
retn
This code was generated by Windows Visual C++ 2005 with buffer overflow protection turned off and disassembled with IDA Pro 4.9 Free Version.
I'm trying to understand what each line does.
the first line is push ebp
.
I know ebp
stands for base pointer. What is its function?
I see that in the second line the value in esp
is moved into ebp
and searching online I see that there first 2 instructions are very common at the beginning of an assembly program.
Though are ebp
and esp
empty at the beginning? I'm new to assembly. Is ebp
used for stack frames, so when we have a function in our code and is it optional for a simple program?
Then push offset aHelloWorld; "Hello world\n"
The part after ;
is a comment so it doesn't get executed right? The first part instead adds the address containing the string Hello World to the stack, right? But where is the string declared? I'm not sure I understand.
Then call ds:__imp__printf
it seems it's a call to a function, anyway printf
is a builtin function right?
And does ds
stand for data segment register? Is it used because we are trying to access a memory operand that isn't on the stack?
then add esp, 4
do we add 4 bytes to esp? Why?
then move eax, 1234h
what is 1234h here?
then pop ebx
..it was pushed at the beginning. is it necessary to pop it at the end?
then retn
( i knew about ret
for returning a value after calling a function). I read that the n in retn refers to the number of pushed arguments by the caller. It isn't very clear for me.
Can you help me to understand?