1

When I start notepad.exe with ollydbg in Windows XP, the initial register was esp:7FFC4 and ebp:7FFF0.

stack

...
0007FFC4  7C817067  kernel32.7C817067 <--- ESP
0007FFC8  7C940208  ntdll.7C940208
0007FFCC  FFFFFFFF
0007FFD0  7FFDB000
0007FFD4  80546BFD
0007FFD8  0007FFC8
0007FFDC  81D22DA8
0007FFE0  FFFFFFFF                    <--- EBP
0007FFE4  7C839AC0  kernel32.7C839AC0
0007FFE8  7C817070  kernel32.7C817070
0007FFEC  00000000
0007FFF0  00000000
0007FFF4  00000000
0007FFF8  0100739D notepad.<ModuleEntryPoint>
0007FFFC  00000000
...

I first guessed the initial stack was empty, but by the process argument (e.g., argc, argv), I thought it can have some values.

  1. what is meaning of the initial stack between EBP and ESP?
  2. the stack ESP can be lower than 7FFE0 (over than as value) while notepad.exe is running ? In other words, can esp point at 0007FFF8?
3

Visit these two webpages for information about stack and stack frames

what is meaning of the initial stack between EBP and ESP?

EBP and ESP are used in conjunction to create a stack frame. To allow for many unknowns in the execution environment, functions are frequently set up with a "stack frame" to allow access to both function parameters, and automatic function variables. The idea behind a stack frame is that each subroutine can act independently of its location on the stack, and each subroutine can act as if it is the top of the stack.

the stack ESP can be lower than 7FFE0 (over than as value) while notepad.exe running? in other words, can esp point at 0007FFF8?

ESP is a simple x86 register just like any other. So it can be modified in the same ways like other. If you write a command like sub esp, 100 then ESP will be modified and it is true that ESP can have a lower value than 7FFE0. The value of ESP shown in Ollydbg is when the application is at its entry point. Before that considerable operations takes place which modify the stack. So definitely, ESP can have a lower value than that.

  • What i want to know is the meaning of 0007FFC4 ~ 0007FFE0. Why the stack is not empty on the process creation? And, i wonder that the esp is under 0007FFE0, by POP instruction. It's not SUB instruction. That's the stack underflow than start EBP(=0FFFE0). I'm afraid of it. – greenfish Jul 23 '14 at 5:27
  • Stack overflow/underflow is a completely different concept. The default value of stack size is 1 MB in x86. Error will occur only when you overcome this limit. In fact this feature has been exploited in the past to create several vulnerabilities. Nowadays, compilers emit prologue/epilogue stack check code for functions to prevent such things. – 0xec Jul 23 '14 at 7:28
1

RtlCreateUserStack() creates the stack on thread creation (And every process has the main thread). Or more generally: The Windows PE loader. What is the PE loader? That thing that creates a process out of an executable file on disk (or adds that executable file to a process in case of DLLs)

Your other question is why, by the time Olly breaks, there already are values on the stack.
That is because your main() entrypoint is not the first thing that will be executed in the process. Before main() there is a lot of internal CRT setup, maybe even setting up global classes, ...

But even before any code of your executable is executed the DLLs still need to do some initalization of their own.

As you use OllyDbg, go to Options->Debugging->Start and play around with that to get a feeling about what needs to be done before your code runs.

  • You said about internal CRT functions and global class (it may be the construction of the global class intance). Question : Are these executed before entering the PE entry point? – greenfish Jul 24 '14 at 1:02
  • No. CRT init routines take care of global objects instantiation when they run on process startup. The entry point actually points to one of those routines. PE loader doesn't know and doesn't care what sort of runtime support library the program uses and which language it was written in; the program takes care of all that init by itself. – Dmitry Yanushkevich Jul 24 '14 at 8:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.