079 the stack kho tài liệu training

Assembly language programming
By xorpd

Basic Assembly
The Stack

xorpd.net


Objectives
 We learn about the stack data structure.
 We study the x86 stack implementation and instructions.
 We see simple examples of using the stack.


Stack
 Abstract idea for storing data.
 Two operations are allowed: PUSH and POP.
 The last element pushed is the first element to be popped.
 LIFO - Last In First Out.


Stack
 Abstract idea for storing data.
 Two operations are allowed: PUSH and POP.
 The last element pushed is the first element to be popped.
 LIFO - Last In First Out.


Stack
 Abstract idea for storing data.

 Two operations are allowed: PUSH and POP.
 The last element pushed is the first element to be popped.
 LIFO - Last In First Out.

PUSH


Stack
 Abstract idea for storing data.
 Two operations are allowed: PUSH and POP.
 The last element pushed is the first element to be popped.
 LIFO - Last In First Out.

PUSH


Stack
 Abstract idea for storing data.
 Two operations are allowed: PUSH and POP.
 The last element pushed is the first element to be popped.
 LIFO - Last In First Out.

PUSH


Stack
 Abstract idea for storing data.
 Two operations are allowed: PUSH and POP.
 The last element pushed is the first element to be popped.
 LIFO - Last In First Out.

POP


Stack
 Abstract idea for storing data.
 Two operations are allowed: PUSH and POP.
 The last element pushed is the first element to be popped.
 LIFO - Last In First Out.

POP


Stack
 Abstract idea for storing data.
 Two operations are allowed: PUSH and POP.
 The last element pushed is the first element to be popped.
 LIFO - Last In First Out.

POP


Stack (Cont.)
 Real Life stacks:

Andy Rennie
/>
Michael Mandibeg
/>
/>

Stew Dean
/>

ESP
 ESP is a 32 bits register. (Extended Stack Pointer)
esp
sp

 At the moment your code begins to run, esp already contains an
address of a location in memory called “the stack”.
 ESP and the stack are set up automatically by the operation system.

…

00

13

2a

de

4f

11

00

00

ff

ff

…

esp

 There are some special instructions that deal with ESP and the stack.


PUSH
 PUSH arg
 Push onto the stack.

 Two forms:
 arg is of size 16 bit:
 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 − 2
 𝑤𝑜𝑟𝑑 𝑒𝑠𝑝 ← 𝑎𝑟𝑔

 arg is of size 32 bit:
 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 − 4
 𝑑𝑤𝑜𝑟𝑑 𝑒𝑠𝑝 ← 𝑎𝑟𝑔


PUSH
 PUSH arg
 Push onto the stack.

 Two forms:

 arg is of size 16 bit:
 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 − 2
 𝑤𝑜𝑟𝑑 𝑒𝑠𝑝 ← 𝑎𝑟𝑔

 arg is of size 32 bit:
 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 − 4
 𝑑𝑤𝑜𝑟𝑑 𝑒𝑠𝑝 ← 𝑎𝑟𝑔


PUSH
 PUSH arg
 Push onto the stack.

 Two forms:
 arg is of size 16 bit:

Addresses increase

01 23 79 4c d2 00 9a 00 ff 11

 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 − 2
 𝑤𝑜𝑟𝑑 𝑒𝑠𝑝 ← 𝑎𝑟𝑔

 arg is of size 32 bit:
 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 − 4
 𝑑𝑤𝑜𝑟𝑑 𝑒𝑠𝑝 ← 𝑎𝑟𝑔

esp

push

mov
push

12345678h
eax,3h
eax


PUSH
 PUSH arg
 Push onto the stack.

 Two forms:
 arg is of size 16 bit:

Addresses increase

01 23 79 4c 78 56 34 12 ff 11

 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 − 2
 𝑤𝑜𝑟𝑑 𝑒𝑠𝑝 ← 𝑎𝑟𝑔

 arg is of size 32 bit:
 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 − 4
 𝑑𝑤𝑜𝑟𝑑 𝑒𝑠𝑝 ← 𝑎𝑟𝑔

esp

push
mov

push

12345678h
eax,3h
eax


PUSH
 PUSH arg
 Push onto the stack.

 Two forms:
 arg is of size 16 bit:

Addresses increase

01 23 79 4c 78 56 34 12 ff 11

 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 − 2
 𝑤𝑜𝑟𝑑 𝑒𝑠𝑝 ← 𝑎𝑟𝑔

 arg is of size 32 bit:
 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 − 4
 𝑑𝑤𝑜𝑟𝑑 𝑒𝑠𝑝 ← 𝑎𝑟𝑔

esp

push
mov
push

12345678h
eax,3h
eax


PUSH
 PUSH arg
 Push onto the stack.
Addresses increase

 Two forms:
 arg is of size 16 bit:
 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 − 2
 𝑤𝑜𝑟𝑑 𝑒𝑠𝑝 ← 𝑎𝑟𝑔

 arg is of size 32 bit:
 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 − 4
 𝑑𝑤𝑜𝑟𝑑 𝑒𝑠𝑝 ← 𝑎𝑟𝑔

03 00 00 00 78 56 34 12 ff 11
esp

push
mov
push

12345678h
eax,3h
eax

POP
 POP arg
 Pop a value from the stack.

 Two forms:
 arg is of size 16 bit:
 𝑎𝑟𝑔 ← 𝑤𝑜𝑟𝑑 𝑒𝑠𝑝
 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 + 2

 arg is of size 32 bit:
 𝑎𝑟𝑔 ← 𝑑𝑤𝑜𝑟𝑑 [𝑒𝑠𝑝]
 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 + 4


POP
 POP arg
 Pop a value from the stack.

 Two forms:
 arg is of size 16 bit:
 𝑎𝑟𝑔 ← 𝑤𝑜𝑟𝑑 𝑒𝑠𝑝
 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 + 2

 arg is of size 32 bit:
 𝑎𝑟𝑔 ← 𝑑𝑤𝑜𝑟𝑑 [𝑒𝑠𝑝]
 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 + 4

POP
 POP arg
 Pop a value from the stack.
Addresses increase

 Two forms:
 arg is of size 16 bit:
 𝑎𝑟𝑔 ← 𝑤𝑜𝑟𝑑 𝑒𝑠𝑝
 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 + 2

 arg is of size 32 bit:
 𝑎𝑟𝑔 ← 𝑑𝑤𝑜𝑟𝑑 [𝑒𝑠𝑝]
 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 + 4

03 00 00 00 78 56 34 12 ff 11
esp
pop
pop

eax
ecx

eax

ecx

????????

????????

POP
 POP arg
 Pop a value from the stack.

 Two forms:
 arg is of size 16 bit:

Addresses increase

03 00 00 00 78 56 34 12 ff 11

 𝑎𝑟𝑔 ← 𝑤𝑜𝑟𝑑 𝑒𝑠𝑝
 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 + 2

 arg is of size 32 bit:
 𝑎𝑟𝑔 ← 𝑑𝑤𝑜𝑟𝑑 [𝑒𝑠𝑝]
 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 + 4

esp
pop
pop

eax
ecx

eax

ecx

00000003

????????


POP
 POP arg
 Pop a value from the stack.

 Two forms:
 arg is of size 16 bit:

Addresses increase

03 00 00 00 78 56 34 12 ff 11

 𝑎𝑟𝑔 ← 𝑤𝑜𝑟𝑑 𝑒𝑠𝑝
 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 + 2

 arg is of size 32 bit:
 𝑎𝑟𝑔 ← 𝑑𝑤𝑜𝑟𝑑 [𝑒𝑠𝑝]
 𝑒𝑠𝑝 ← 𝑒𝑠𝑝 + 4

esp
pop
pop

eax
ecx

eax

ecx

00000003

12345678


Example – Exchanging values
 Exchanging two values:

push
push
pop
pop

eax
ecx
eax
ecx


Example – Exchanging values
 Exchanging two values:

push
push
pop
pop

eax
ecx
eax
ecx

eax

ecx