So my C program looks like:

int main()
    int a = 5;
    int b = 1;
    int c = add(a, b);
    printf("%d", c);
    return 0;

int add(int a, int b){
    return a + b;

And I am trying to understand the behaviour of how parameters are passed into the stack. In order to do the same, I reversed the code to disassembly:

enter image description here


Now esp is being copied into ebp in the add function, then why add 8 and 12 to access the values 5 and 1 in the next lines - shouldn't it be [ebp] and [ebp + 4h]? I am really confused here.


  • 3
    "I am not posting it in the Reverse Engineering Stack Exchange site." and then you proceed doing just that :) – Igor Skochinsky Jul 15 '18 at 10:04
  • 1
    Probably a stackexchange-nazi-purist closed its question... In these days every question get downvoted.. – realtebo Jul 15 '18 at 10:48
  • @IgorSkochinsky Opps, I just thought I was gonna post it at SO and realized it will get way too many negative votes. The artefact remained - cleaned it now~ – Jishan Jul 15 '18 at 12:30

On x86, the stack is used not only for passing the arguments. It can store other things as well, for example the return address of the function or the registers which need to be saved temporarily, as well as for local variables. In your example, the push ebp adjusts esp by 4 bytes, so after esp is copied to ebp in the next instruction, the stack frame looks like this:

 [ebp+0] old ebp value (pushed by "push ebp")
 [ebp+4] return address from the call (originally at [esp+0])
 [ebp+8] first argument (a)
 [ebp+C] second argument (b)
  • +1 for a clear and easy to grasp answer! – Jishan Jul 15 '18 at 12:41

ebp is an address likewise esp ia an address like 0x12345678

esp is not copied

it is assigned so after mov ebp,esp
both will be same address

in high level language it would be like ebp = esp

now since ebp is an address it can hold a value

that is ebp can hold 0x12345678 ( ebp ,xxx is a pointer to the underlying data )

so ebp = 0x12345678 a pointer points to data 0x12345678 a data variable ( like your 5 and 1 )

ebp 12345678 holds 1 ebp +4 1234567c holds x evp+8 12345680 holds y

since ebp and esp are same esp+8 will also be holding y

this part is called prologue in the function construct and creates a frame in the stack

the square brackets denotes access to the underlying data

so if you want to access ebp +c you may need

mov somereg ebp add samereg 0xc now this register will hold 0x12345680

what if you want to access y

the you need the square bracket around ox12345680

like get me what is dereferenced by [0x12345680]

that is mov somereg [ebp + c]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.