Addition Function Parameter Location in Assembly Stack Memory

Question

So my C program looks like:

int main()
{
    int a = 5;
    int b = 1;
    int c = add(a, b);
    printf("%d", c);
    return 0;
}

int add(int a, int b){
    return a + b;
}

And I am trying to understand the behaviour of how parameters are passed into the stack. In order to do the same, I reversed the code to disassembly:

Now esp is being copied into ebp in the add function, then why add 8 and 12 to access the values 5 and 1 in the next lines - shouldn't it be [ebp] and [ebp + 4h]? I am really confused here.

Thanks.

Answer 1

On x86, the stack is used not only for passing the arguments. It can store other things as well, for example the return address of the function or the registers which need to be saved temporarily, as well as for local variables. In your example, the push ebp adjusts esp by 4 bytes, so after esp is copied to ebp in the next instruction, the stack frame looks like this:

 [ebp+0] old ebp value (pushed by "push ebp")
 [ebp+4] return address from the call (originally at [esp+0])
 [ebp+8] first argument (a)
 [ebp+C] second argument (b)

Answer 2

ebp is an address likewise esp ia an address like 0x12345678

esp is not copied

it is assigned so after mov ebp,esp
both will be same address

in high level language it would be like ebp = esp

now since ebp is an address it can hold a value

that is ebp can hold 0x12345678 ( ebp ,xxx is a pointer to the underlying data )

so ebp = 0x12345678 a pointer points to data 0x12345678 a data variable ( like your 5 and 1 )

ebp 12345678 holds 1 ebp +4 1234567c holds x evp+8 12345680 holds y

since ebp and esp are same esp+8 will also be holding y

this part is called prologue in the function construct and creates a frame in the stack

the square brackets denotes access to the underlying data

so if you want to access ebp +c you may need

mov somereg ebp add samereg 0xc now this register will hold 0x12345680

what if you want to access y

the you need the square bracket around ox12345680

like get me what is dereferenced by [0x12345680]

that is mov somereg [ebp + c]