I disassembled an .exe file and got this as its first line.
push ebp
- What does it mean?
- Why
ebp? - Does it have anything to do with
popcommand? even though I don't see it in the disassembly!
views:
79answers:
4
+6
A:
push ebp just means pushing whatever is in register ebp onto the stack. ebp stores the stack pointer by convention.
This is generally used to establish a stack frame, followed by
mov ebp, esp
NullUserException
2010-07-31 14:41:05
You may also see the instruction LEAVE at the end of the function, which is equivalent to MOV ESP,EBP followed by POP EBP. That's why you may not see an explicit pop.
indiv
2010-07-31 14:47:27
So, does this mean that all applications start with `push ebp` followed by `mov ebp, esp`?
David Weng
2010-07-31 15:05:44
Most. All apps that use the ebp register for variable addressing or whatever must restore the calling program's stack frame.
Jens Björnhager
2010-07-31 15:20:11
+2
A:
It pushes the value of the EBP register on the stack, and is most commonly used to set up a stackframe. Pop retrieves a value from the stack.
Willem van Rumpt
2010-07-31 14:42:07
+2
A:
The push instruction saves the value of a register onto the stack. The value can later be retrieved using a pop-instruction.
Wikipedia Stack (data structure): http://en.wikipedia.org/wiki/Stack_%28data_structure%29
Ville Krumlinde
2010-07-31 14:43:16