tags:

views:

35

answers:

1
; int __stdcall wWinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPWSTR lpCmdLine, int nShowCmd)
_wWinMain@16 proc near

var_8= dword ptr -8
var_4= dword ptr -4
hInstance= dword ptr  8
hPrevInstance= dword ptr  12
lpCmdLine= dword ptr  16
nShowCmd= dword ptr  20

If I have a dword variable on [ebp+4], does it mean the variable is contained in the range [ebp+4] to [ebp+8], or [ebp+4] to [ebp] ? Is what is depicted bellow then correct?

[-12, -08]

[-08, -04] var_8

[-04, 00] var_4

[ 00, +04] ebp

[+04, +08]

[+08, +12] hInstance

[+12, +16] hPrevInstance

[+16, +20] lpCmdLine

[+20, +24] nShowCmd

[+24, +28]

Thanks

+1  A: 

Your understanding is correct. Although the stack grows downward, multi-byte values in memory are stored at increasing memory addresses from the base. The dword variable would be stored in ebp+4, ebp+5, ebp+6, ebp+7. ebp+4 would be the lowest order byte (since x86 is little-endian).

Michael