When I start notepad.exe
with ollydbg in Windows XP, the initial register was esp:7FFC4
and ebp:7FFF0
.
stack
...
0007FFC4 7C817067 kernel32.7C817067 <--- ESP
0007FFC8 7C940208 ntdll.7C940208
0007FFCC FFFFFFFF
0007FFD0 7FFDB000
0007FFD4 80546BFD
0007FFD8 0007FFC8
0007FFDC 81D22DA8
0007FFE0 FFFFFFFF <--- EBP
0007FFE4 7C839AC0 kernel32.7C839AC0
0007FFE8 7C817070 kernel32.7C817070
0007FFEC 00000000
0007FFF0 00000000
0007FFF4 00000000
0007FFF8 0100739D notepad.<ModuleEntryPoint>
0007FFFC 00000000
...
I first guessed the initial stack was empty,
but by the process argument (e.g., argc
, argv
), I thought it can have some values.
- what is meaning of the initial stack between
EBP
andESP
? - the stack
ESP
can be lower than7FFE0
(over than as value) whilenotepad.exe
is running ? In other words, can esp point at0007FFF8
?