Instructions for test_function Text Segment Source Code void test_function(int a) { int flag = a*a; } int main( ) int num = 8; test_function(num); Instructions for test_function gcc, gdb Instructions for main ~ ~ Source code is compiled with gcc to produce object code. Using gdb, we run the program in debug mode. The instructions for the program are loaded into the text segment of memory.

Instructions for test_function Text Segment Source Code void test_function(int a) { int flag = a*a; } int main( ) int num = 8; test_function(num); Instructions for test_function Instructions for main eip ~ ~ ~ ~ Stack Registers The program execution starts at the first line of the main function. A portion of memory is set aside as the stack; currently there is only one stack frame (i.e. the stack frame for main) which comprises the entire stack. The base pointer ebp points directly beneath the stack, and the stack pointer esp points at the top of the stack. The instruction pointer eip points to the next instruction (in the text segment) that will be executed. Recall that ebp, esp, and eip are all registers; they are saved in the CPU, and they each hold the address that they are currently pointing to. esp Stack frame for main ebp

Instructions for test_function Text Segment Source Code void test_function(int a) { int flag = a*a; } int main( ) int num = 8; test_function(num); Instructions for test_function Instructions for main eip ~ ~ ~ ~ Stack Registers The main variable num is declared and initialized, which causes it to be loaded onto the stack. esp Stack frame for main ebp

Instructions for test_function Text Segment Source Code void test_function(int a) { int flag = a*a; } int main( ) int num = 8; test_function(num); Instructions for test_function Instructions for main eip ~ ~ ~ ~ Note: this is the address we want to return to after the function call (i.e. the return address) Stack esp ebp Stack frame for main Registers In preparation for the function call, the argument (i.e. the value of num, which is 8) is placed on the function stack. We also note the return address that eip should come back to after the function call.

~ ~ ~ ~ Text Segment Source Code eip Stack esp ebp Registers void test_function(int a) { int flag = a*a; } int main( ) int num = 8; test_function(num); eip Instructions for test_function Instructions for main ~ ~ ~ ~ Stack esp Stack frame for test_function ebp Registers At the beginning of the function call, several things happen. The instruction pointer eip will jump to the next address to be executed in the test_function portion of the text segment of memory. The stack frame for main is expanded by eight bytes, so that it can accommodate the return address (noted in the last slide) and old value of ebp (which will be used to reconstruct the stack after the function call). These are saved at the top of the (expanded) stack frame for main. Finally, a new stack frame is designated for test_function, above the stack frame for main. Stack frame for main

~ ~ ~ ~ Text Segment Source Code eip Stack esp ebp Registers void test_function(int a) { int flag = a*a; } int main( ) int num = 8; test_function(num); Instructions for test_function eip Instructions for main ~ ~ ~ ~ Stack esp ebp Stack frame for main Stack frame for test_function Registers In test_function, the local (i.e. function) variable flag is declared and initialized to be a*a. Since the parameter a is equal to the value of the argument (8), flag will be set to 64 (or 0x40 in hex). This is loaded into the stack frame for test_function.

Instructions for test_function Text Segment Source Code void test_function(int a) { int flag = a*a; } int main( ) int num = 8; test_function(num); Instructions for test_function Instructions for main eip ~ ~ ~ ~ Stack Registers With the function call completed, eip jumps back to the return address, and esp and ebp are moved back to their original positions to mark out the stack frame for main. The contents of the memory previously used to store flag, return_address, etc. is not deleted or changed, but it is no longer viewed as being part of the main stack frame (and there is no such thing as the stack frame for test_function anymore). esp Stack frame for main ebp