I'm studying x86 architecture and assembly in order to have the bases for studying reversing and exploit development. I'm following a course on opensecuritytraining.info.
I see a Hello World example:
push ebp mov ebp, esp push offset aHelloWorld; "Hello world\n" call ds:__imp__printf add esp, 4 mov eax, 1234h pop ebp retn
This code was generated by Windows Visual C++ 2005 with buffer overflow protection turned off and disassembled with IDA Pro 4.9 Free Version.
I'm trying to understand what each line does.
the first line is
ebp stands for base pointer. What is its function?
I see that in the second line the value in
esp is moved into
ebp and searching online I see that there first 2 instructions are very common at the beginning of an assembly program.
esp empty at the beginning? I'm new to assembly. Is
ebp used for stack frames, so when we have a function in our code and is it optional for a simple program?
push offset aHelloWorld; "Hello world\n"
The part after
; is a comment so it doesn't get executed right? The first part instead adds the address containing the string Hello World to the stack, right? But where is the string declared? I'm not sure I understand.
it seems it's a call to a function, anyway
printf is a builtin function right?
ds stand for data segment register? Is it used because we are trying to access a memory operand that isn't on the stack?
add esp, 4
do we add 4 bytes to esp? Why?
move eax, 1234h what is 1234h here?
pop ebx..it was pushed at the beginning. is it necessary to pop it at the end?
retn ( i knew about
ret for returning a value after calling a function). I read that the n in retn refers to the number of pushed arguments by the caller. It isn't very clear for me.
Can you help me to understand?