I saw a piece of code like this in asm:
.text:787924E0 testcall proc near
.text:787924E0
.text:787924E0 var_F0 = dword ptr -0F0h
.text:787924E0 var_34 = byte ptr -34h
.text:787924E0 retValue = std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> > ptr -24h
.text:787924E0 var_4 = dword ptr -4
.text:787924E0 result = dword ptr 8
.text:787924E0 agr1 = std::basic_string<char,std::char_traits<char>,std::allocator<char> > ptr 0Ch
.text:787924E0
.text:787924E0 push ebp
.text:787924E1 mov ebp, esp
.text:787924E3 sub esp, 0F4h
.text:787924E9 push ebx
.text:787924EA push esi
.text:787924EB push edi
.text:78792555 mov eax, [ebp result]
.text:78792558 push edx
...
.text:78792567 pop eax
.text:78792568 pop edx
.text:78792569 pop edi
.text:7879256A pop esi
.text:7879256B pop ebx
.text:78792576 add esp, 0F4h
.text:78792583 mov esp, ebp
.text:78792585 pop ebp
.text:78792586 retn
I want to know the basic knowledge questions:
sub esp, 0F4h
why is 0xF4, how is it calculated ?
CodePudding user response:
In old days people used ebp to point top of the old stack position. nowadays compilers can manually count and allocate enough space end then return the old stack position without ebp. also stack is top to bottom not bottom the top so when you subtract esp you allocate new space in stack.