1

i'm newbie to all the subject of RE so this question may sound easy. on OllyDbg i see a lot of references to EBP & i can not understand to which stack frame does EBP belongs to, since there are many pointers to SS:

enter image description here

3
  • When ebp is referenced, it usually belongs to the stack frame of the current function. At the beginning of the function, you usually will see a push ebp and a mov esp, ebp to set up the stack frame for the current function. – Shane Reilly Oct 3 '20 at 16:51
  • so in the image i posted the EBP belongs to the function i'm in & that function calls to more multiple functions? – daniel benisti Oct 3 '20 at 16:54
  • Most likely, yes. Inside those functions, they will also push ebp and mov esp, ebp to set up their own stack frames. – Shane Reilly Oct 3 '20 at 21:22
1

The Current ebp points to the previous ebp
and by inference the call that setup the previous ebp

in windbg with a 32 bit binary this script will walk the stack you can use follow in dump in ollydbg to do the same

r $t0 = @eip
r $t1 = @ebp
.while (@$t1 !=0) 
{
    .printf "eip = %08x\tebp = %08x\t callee = %y\n" , @$t0 ,@$t1,poi(@$t1+4)
    r $t0 = poi(@$t1+4)
    r $t1 = poi(@$t1)
}

executing the script

0:000> $$>a< e:\stackwalk.wds
eip = 006a163a  ebp = 0023fa54   callee = calc!_initterm_e+0x1a1 (006b219a)
eip = 006b219a  ebp = 0023fae4   callee = kernel32!BaseThreadInitThunk+0xe (7659ed6c)
eip = 7659ed6c  ebp = 0023faf0   callee = ntdll!__RtlUserThreadStart+0x70 (77d237eb)
eip = 77d237eb  ebp = 0023fb30   callee = ntdll!_RtlUserThreadStart+0x1b (77d237be)
eip = 77d237be  ebp = 0023fb48   callee = 00000000
0:000> k
ChildEBP RetAddr
0023fa54 006b219a calc!WinMain+0x5
0023fae4 7659ed6c calc!_initterm_e+0x1a1
0023faf0 77d237eb kernel32!BaseThreadInitThunk+0xe
0023fb30 77d237be ntdll!__RtlUserThreadStart+0x70
0023fb48 00000000 ntdll!_RtlUserThreadStart+0x1b
0:000>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.