Who does construct the stack on process creation in Windows?

Question

When I start notepad.exe with ollydbg in Windows XP, the initial register was esp:7FFC4 and ebp:7FFF0.

stack

...
0007FFC4  7C817067  kernel32.7C817067 <--- ESP
0007FFC8  7C940208  ntdll.7C940208
0007FFCC  FFFFFFFF
0007FFD0  7FFDB000
0007FFD4  80546BFD
0007FFD8  0007FFC8
0007FFDC  81D22DA8
0007FFE0  FFFFFFFF                    <--- EBP
0007FFE4  7C839AC0  kernel32.7C839AC0
0007FFE8  7C817070  kernel32.7C817070
0007FFEC  00000000
0007FFF0  00000000
0007FFF4  00000000
0007FFF8  0100739D notepad.<ModuleEntryPoint>
0007FFFC  00000000
...

I first guessed the initial stack was empty, but by the process argument (e.g., argc, argv), I thought it can have some values.

1. what is meaning of the initial stack between EBP and ESP?
2. the stack ESP can be lower than 7FFE0 (over than as value) while notepad.exe is running ? In other words, can esp point at 0007FFF8?

Answer 1

Visit these two webpages for information about stack and stack frames

what is meaning of the initial stack between EBP and ESP?

EBP and ESP are used in conjunction to create a stack frame. To allow for many unknowns in the execution environment, functions are frequently set up with a "stack frame" to allow access to both function parameters, and automatic function variables. The idea behind a stack frame is that each subroutine can act independently of its location on the stack, and each subroutine can act as if it is the top of the stack.

the stack ESP can be lower than 7FFE0 (over than as value) while notepad.exe running? in other words, can esp point at 0007FFF8?

ESP is a simple x86 register just like any other. So it can be modified in the same ways like other. If you write a command like sub esp, 100 then ESP will be modified and it is true that ESP can have a lower value than 7FFE0. The value of ESP shown in Ollydbg is when the application is at its entry point. Before that considerable operations takes place which modify the stack. So definitely, ESP can have a lower value than that.

Answer 2

RtlCreateUserStack() creates the stack on thread creation (And every process has the main thread). Or more generally: The Windows PE loader. What is the PE loader? That thing that creates a process out of an executable file on disk (or adds that executable file to a process in case of DLLs)

Your other question is why, by the time Olly breaks, there already are values on the stack.
That is because your main() entrypoint is not the first thing that will be executed in the process. Before main() there is a lot of internal CRT setup, maybe even setting up global classes, ...

But even before any code of your executable is executed the DLLs still need to do some initalization of their own.

As you use OllyDbg, go to Options->Debugging->Start and play around with that to get a feeling about what needs to be done before your code runs.