Function call callback

Author: liigo

Link: http://blog.csdn.net/liigo/archive/2006/12/23/1456938.aspx

Reprinted please indicate the source: http://blog.csdn.net/liigo

 

Yesterday I studied the function call stack with the ocean. Please forgive me for any deficiencies or errors!

The two most important points of understanding the call Stack are the stack structure and the role of the EBP register.

First, we need to recognize the following two facts:

1. A function call can be divided into zero to multiple push commands (used for parameter loading) and one call command. The Call Command actually implies an action to press the stack of the returned address (that is, the address of the next command of the Call command.

2. Almost all local compilers insert commands similar to the following before each function body: Push EBP; MoV ebp esp;

That is, when the program executes a real function body of a function, the following data has been imported into the stack in sequence: parameter, return address, and EBP.
The stack structure is similar to the following (the order of parameter stack entry is related to the call method. Here, the default cdecl of C language is used as an example ):

+ | (Stack bottom direction, high address) |
| ...... |
| ...... |
| Parameter 3 |
| Parameter 2 |
| Parameter 1 |
| Return address |
-| Previous layer [EBP] | <-------- [EBP]

The two commands "Push EBP" and "mov EBP esp" are very interesting: first, import EBP into the stack, and then assign the top pointer ESP to EBP. On the surface, the "mov EBP esp" command overwrites the original EBP value with ESP. In fact, it is not because before assigning values to EBP, the original EBP value has been pushed to the stack (located at the top of the stack), and the new EBP just points to the top of the stack.

At this time, the EBP register is already in a very important position. This register stores an address in the stack (the top of the stack after the original EBP enters the stack). From this address as the benchmark, the returned address and parameter value can be obtained up (at the bottom of the stack), and the local variable value can be obtained down (at the top of the stack, this address stores the EBP value of the previous function call!

Generally, the value of SS: [EBP + 4] is the return address, and the value of SS: [EBP + 8] is the first parameter value (the parameter value of the last input stack, assuming that it occupies 4 bytes of memory), the SS: [ebp-4] is the first local variable, and the SS: [EBP] is the EBP value of the previous layer.

Because the EBP address is always "the EBP value for the previous function call", and in each function call, the EBP value at the time can be used to "Up (at the bottom of the stack) returns the address and parameter value, and obtains the local variable value of the function down (in the top direction of the stack ".
This forms recursion until it reaches the bottom of the stack. This is the function call stack.

The use of EBP by the compiler is too subtle.

Starting from the current EBP, it is very easy to find all EBP layers up:

Unsigned int _ EBP;
_ ASM _ EBP, EBP;
While (not stack bottom)
{
//...
_ EBP = * (unsigned int *) _ EBP;
}

If you want to write a simple debugger, read the memory data in the debugged process (rather than the current process-the debugger process.