i'm newbie to all the subject of RE so this question may sound easy. on OllyDbg i see a lot of references to EBP & i can not understand to which stack frame does EBP belongs to, since there are many pointers to SS:
1 Answer
The Current ebp points to the previous ebp
and by inference the call that setup the previous ebp
in windbg with a 32 bit binary this script will walk the stack you can use follow in dump in ollydbg to do the same
r $t0 = @eip
r $t1 = @ebp
.while (@$t1 !=0)
{
.printf "eip = %08x\tebp = %08x\t callee = %y\n" , @$t0 ,@$t1,poi(@$t1+4)
r $t0 = poi(@$t1+4)
r $t1 = poi(@$t1)
}
executing the script
0:000> $$>a< e:\stackwalk.wds
eip = 006a163a ebp = 0023fa54 callee = calc!_initterm_e+0x1a1 (006b219a)
eip = 006b219a ebp = 0023fae4 callee = kernel32!BaseThreadInitThunk+0xe (7659ed6c)
eip = 7659ed6c ebp = 0023faf0 callee = ntdll!__RtlUserThreadStart+0x70 (77d237eb)
eip = 77d237eb ebp = 0023fb30 callee = ntdll!_RtlUserThreadStart+0x1b (77d237be)
eip = 77d237be ebp = 0023fb48 callee = 00000000
0:000> k
ChildEBP RetAddr
0023fa54 006b219a calc!WinMain+0x5
0023fae4 7659ed6c calc!_initterm_e+0x1a1
0023faf0 77d237eb kernel32!BaseThreadInitThunk+0xe
0023fb30 77d237be ntdll!__RtlUserThreadStart+0x70
0023fb48 00000000 ntdll!_RtlUserThreadStart+0x1b
0:000>
ebpis referenced, it usually belongs to the stack frame of the current function. At the beginning of the function, you usually will see apush ebpand amov esp, ebpto set up the stack frame for the current function.push ebpandmov esp, ebpto set up their own stack frames.