1

I'm trying to understand call conventions and such. I created a function with the source code

#include <stdio.h>
int main() {
  int x = 9;
  printf("%d\n", x);
}

and the output in gdb was the following screenshot:

The above screenshot is its disassembly.

I have two questions:

  1. Where does the 0x405044 come from?
  2. Why does it store the contents of 0x405044 in the memory address of esp?
1

0x405044 is the address of your format string. You can print the string with x/s 0x405044 It stores this address at esp cause its your first argument.

0

Apart from what defragger said, there are few things to note (as you are learning about calling conventions). This is an example of 32 bit x86 calling convention (C).

  • Before a subroutine call, caller saves caller-saved registers on stack (registers eax, ecx, edx - "if required")
  • Then it pushes subroutine parameters on stack in inverted order (in your case, 9 and address of "%d\n")
  • Then calls the subroutine (return address is pushed on top of stack)
  • After return (return value goes in eax), caller removes the parameters, restores the stack and also restores caller-saved registers.

Now the I believe you got confused because of "42a" and "42e" instructions (mov). you must be familiar with "push" instruction - which is nearly equivalent to (sub esp, 4; mov [esp], reg32 - (this also affect flags unlike push))

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.