0

I am pushing some int value in inline-assembly:

_asm
  {
  mov eax,i3  
  push eax
  mov eax,ii  
  }

Later I retrieve this value doing pops:

_asm
  {
  pop eax
  mov ii,eax  
  pop eax
  mov i3,eax  
  }

What I'd like to inpect my stack without doing a pop. I need to rearrange or rewiew a few values. I can then restore the stack when I'm done.

I am very rusty in asm. Is there something like:

mov ii,esp+4

that would move the next (not current) stack element? I'm just guessing. I need this code to run in both 32 bit win and 64 win environment.

nickhar
  • 19,981
  • 12
  • 60
  • 73
user1231247
  • 193
  • 1
  • 8
  • Use the debugger's Memory view window. But above all, just don't write code like that. Use a local variable instead, it is also on the stack. And the debugger can show you the value. – Hans Passant Oct 21 '12 at 14:08

1 Answers1

0

What I'd like to inpect my stack without doing a pop. I need to rearrange or rewiew a few values.

This is how stack-allocated variables act in a function - hence why the function prologue is usually followed by a sub esp, x where x is an amount of space to allocate.

Variable access in C (and in C++) is, therefore, inspecting the stack. Alternatively, if you know how the compiler has allocated the variables, you can read them from your inline ASM.

One way to achieve what you're trying to do might be to list both your input variables and output variables as operands to the inline asm. This osdev article explains it nicely. This way, regardless of how the compiler re-orders the stack between coding alterations and optimisation flags, your assembler will still work.

Alternatively, if you write the entire function yourself, you can load the value of the stack at a given address like so:

mov eax, DWORD PTR [ebp-8]

This will load eax with the value of the memory address located at ebp-8.

  • When I push something on the stack. In my example I do "push eax". A 4 byte value is added to the stack. Will this be the same size on most systems. For example when using win64 does "push eax" add an 8 byte value on the stack? – user1231247 Oct 22 '12 at 07:09