0

I saw a piece of code like this in asm:

.text:787924E0 testcall        proc near             
.text:787924E0
.text:787924E0 var_F0          = dword ptr -0F0h
.text:787924E0 var_34          = byte ptr -34h
.text:787924E0 retValue        = std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> > ptr -24h
.text:787924E0 var_4           = dword ptr -4
.text:787924E0 result          = dword ptr  8
.text:787924E0 agr1            = std::basic_string<char,std::char_traits<char>,std::allocator<char> > ptr  0Ch
.text:787924E0
.text:787924E0                 push    ebp
.text:787924E1                 mov     ebp, esp
.text:787924E3                 sub     esp, 0F4h
.text:787924E9                 push    ebx
.text:787924EA                 push    esi
.text:787924EB                 push    edi

.text:78792555                 mov     eax, [ebp+result]
.text:78792558                 push    edx
                               ...
.text:78792567                 pop     eax
.text:78792568                 pop     edx
.text:78792569                 pop     edi
.text:7879256A                 pop     esi
.text:7879256B                 pop     ebx
.text:78792576                 add     esp, 0F4h
.text:78792583                 mov     esp, ebp
.text:78792585                 pop     ebp
.text:78792586                 retn

enter image description here

I want to know the basic knowledge questions:

sub esp, 0F4h

why is 0xF4, how is it calculated ？

Peter Cordes
  • 328,167
  • 45
  • 605
  • 847
Tony
  • 35
  • 1
  • 6

1 Answers1

1

In old days people used ebp to point top of the old stack position. nowadays compilers can manually count and allocate enough space end then return the old stack position without ebp. also stack is top to bottom not bottom the top so when you subtract esp you allocate new space in stack.

PYigit
  • 74
  • 1
  • 5
  • 2
    This is true, but not sure it answers the question. (That's mostly the question's fault for being unclear and not showing the source code this was compiled from.) Note that it asks about the `sub esp, 0F4h` to allocate space in the first place. That would be there whether you'd set up EBP as a frame pointer or not; only the `add esp, 0F4h` at the end would be different. Or not, since in this case the braindead compiler added to ESP right before a `mov esp, ebp`; it *did* set up EBP as a legacy frame pointer, probably in a debug build or possibly a function using `alloca` or `alignas(32)`. – Peter Cordes Jun 20 '22 at 07:03