Void add (int I, int B) <br/>{< br/> I = I + B; <br/>}< br/> void main () <br/> {</P> <p> int I = 1, B = 2, c = 3, D = 4, G = 5; <br/> Add (I, B); <br/> I = g; <br/>}
EBP can be used after the stack address is assigned by ESP.
EBP-XXX to access the data in the stack,
ESP is busy with local variables and function parameters, so its value is constantly changing.
The rule for addressing with ESP is:
Current ESP address + push count * 4 + sub minus size = the ESP at this time should be equal to EBP
So now use the value obtained by ESP-the correct address value can be obtained if you want to access the location of the element * 4
MoV eax, dword ptr ss: [esp + 4C] ESP + 4C and mov dword ptr ss: [ebp-14]. Same
It also verifies that there is a call part,
MoV eax, dword ptr ss: [esp + 4C] When the stack has been balanced and does not affect its addressing to the ebp-14
This proves that,
In the called function, you can access the local variables in the called function...
The addresses and values of the five local variables in the call function are as follows:
0012ff6c 00000005
0012ff70 00000004
0012ff74 00000003
0012ff78 00000002
0012ff7c 00000001
However, the formula they calculated is a little troublesome. Don't use such shell software in the future. If this is the case, it would be too exhausting to compute data sources.