Skip to main content
gamedev.net
🔒 Locked

About the function stack

Started by Galapaegos Jan 2, 2004 at 11:58 PM 2 replies 700+ views
Original Post
Galapaegos
Galapaegos
Hey guys, I have a question about the function stack. I was reading through the overflow tutorial here: http://www.cs.ucsb.edu/~jzhou/security/overflow.html I was doing the first example on a *nix machine and got it to work just fine, so I tried this on a windows machine but I can''t seem to get it to work. I have gotten stuck on determining what the actual addresses in the stack are. I made a really simple function that should print out the stack:
void function() 
{
	int *i;
	int *j;

        // get base pointer

	__asm {
		mov i, ebp
	}

        // get stack pointer

	__asm {
		mov j, esp
	}

	printf ("base: 0x%p\n", i);
	printf ("top: 0x%p\n", j);

	while (i <= j)
	{
		printf ("0x%p ", i); printf ("0x%p\n", *i);
		++i;
	}
}
this is the output i got from it: base: 0x0012FF78 top: 0x0012FF68 0x0012FF68 0x0050005C 0x0012FF6C 0x006F0072 0x0012FF70 0x0012FF68 0x0012FF74 0x0012FF78 0x0012FF78 0x0012FFC0 it shows the address and its contents. I don''t understand what is what though, there should be the bottom of the stack (0x0012ff68), the top (0x0012ff78) and only a return address in between them, right? Thanks for all the help! -brad
-brad
Galapaegos
Galapaegos
I got it to work! but only in debug mode. I guess everything between ebp and esp is just a bunch of garbage, the return address is the base plus one (or the address in the example 0x0012ff7C).

-brad
-brad
JuNC
JuNC
One of the most basic optimizations that would be done to that function is frame pointer elimination. The asm from no optimization and from /O2 (using VC++6) shows what happens:

(no opt)

_function PROC NEAR
; File test.c
; Line 4
push ebp
mov ebp, esp
sub esp, 8
; Line 7
mov DWORD PTR _i$[ebp], ebp
; Line 9
mov DWORD PTR _j$[ebp], esp
; Line 11
mov eax, DWORD PTR _i$[ebp]
push eax
push OFFSET FLAT:$SG772
call _printf
... more


(/O2)

_function PROC NEAR ; COMDAT
; Line 4
sub esp, 8
push esi
push edi
; Line 7
mov DWORD PTR _i$[esp+16], ebp
; Line 9
mov DWORD PTR _j$[esp+16], esp
; Line 11
mov esi, DWORD PTR _i$[esp+16]
push esi
push OFFSET FLAT:??_C@_0M@BCAN@base?3?50x?$CFp?6?$AA@ ; `string''
call _printf


So you see ebp does not point to the start of the call frame after the optimization.
LessBread
LessBread
Before I delete the duplicate thread, I thought I should repost the lone response from it.

This is from 666_1337:

You are trying to output the stack as 32 bit integers, while the stack doesn''t neccessarily have a size that is a multiple of 32 bit

"I thought what I'd do was, I'd pretend I was one of those deaf-mutes." - the Laughing Man

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.

Sign in to reply to this topic.