1

After PE loads into memory, sections are mapped depending on IMAGE_BASE value (assume there is no ASLR and it is always the same) and sections table.

My question, how EBP value is determined (I assume ESP can be found of EBP). Can it be any valid memory address, or is it calculated depending on some rules?

  • 1
    See here – 0xec May 29 '15 at 15:57
3

The stack is allocated as part of the loading procedure, after the process is mapped into memory. Its reserve size plays a part in where it can be placed in memory. The location of the stack is not fixed, but ends up with a common value when the stack size and process image base is the default size. It's simply the result of a memory allocation function, which finds the lowest location in memory that can satisfy the request.

Since the stack grows downwards, ESP initially points to the top of the stack. When the process starts, EBP is saved on the stack, ESP is moved into EBP, and then some space is allocated for variables which are stored on the stack. Thus, ESP is set to the new value of EBP less some bytes. The number of bytes depends on how many variables Windows needs to store. The number is essentially fixed, depending on the version of Windows (different versions of Windows require a different number of variables for process loading), but can be changed at any time by a patch, if ever additional information is needed to be used to start the process.

| improve this answer | |
  • One more question, image there is A.exe and B.exe, does always ESP of A.exe stays in the same place (ASLR ignored) and ESP of B.exe also fixed, but different from A.exe? – ST3 Jun 1 '15 at 6:35
  • Yes, the location of the stack doesn't change once it is set. – peter ferrie Jun 3 '15 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.