1. Instructions for test_function
Text Segment
Source Code
void test_function(int a) {
int flag = a*a; }
int main( )
int num = 8;
test_function(num);
Instructions for test_function
gcc, gdb
Instructions for main ~ ~
Source code is compiled with gcc to produce object code. Using gdb, we run the program in debug mode. The instructions for the program are loaded into the text segment of memory.

2. Instructions for test_function
Text Segment
Source Code
void test_function(int a) {
int flag = a*a; }
int main( )
int num = 8;
test_function(num);
Instructions for test_function
Instructions for main
eip ~ ~ ~ ~
Stack
Registers
The program execution starts at the first line of the main function. A portion of memory is set aside as the stack; currently there is only one stack frame (i.e. the stack frame for main) which comprises the entire stack. The base pointer ebp points directly beneath the stack, and the stack pointer esp points at the top of the stack. The instruction pointer eip points to the next instruction (in the text segment) that will be executed. Recall that ebp, esp, and eip are all registers; they are saved in the CPU, and they each hold the address that they are currently pointing to.
esp
Stack frame for main
ebp

3. Instructions for test_function
Text Segment
Source Code
void test_function(int a) {
int flag = a*a; }
int main( )
int num = 8;
test_function(num);
Instructions for test_function
Instructions for main
eip ~ ~ ~ ~
Stack
Registers
The main variable num is declared and initialized, which causes it to be loaded onto the stack.
esp
Stack frame for main
ebp

4. Instructions for test_function
Text Segment
Source Code
void test_function(int a) {
int flag = a*a; }
int main( )
int num = 8;
test_function(num);
Instructions for test_function
Instructions for main
eip ~ ~ ~ ~
Note: this is the address we want to return to after the function call (i.e. the return address)
Stack
esp
ebp
Stack frame for main
Registers
In preparation for the function call, the argument (i.e. the value of num, which is 8) is placed on the function stack. We also note the return address that eip should come back to after the function call.

5. ~ ~ ~ ~ Text Segment Source Code eip Stack esp ebp Registers
void test_function(int a) {
int flag = a*a; }
int main( )
int num = 8;
test_function(num);
eip
Instructions for test_function
Instructions for main ~ ~ ~ ~
Stack
esp
Stack frame for test_function
ebp
Registers
At the beginning of the function call, several things happen. The instruction pointer eip will jump to the next address to be executed in the test_function portion of the text segment of memory. The stack frame for main is expanded by eight bytes, so that it can accommodate the return address (noted in the last slide) and old value of ebp (which will be used to reconstruct the stack after the function call). These are saved at the top of the (expanded) stack frame for main. Finally, a new stack frame is designated for test_function, above the stack frame for main.
Stack frame for main

6. ~ ~ ~ ~ Text Segment Source Code eip Stack esp ebp Registers
void test_function(int a) {
int flag = a*a; }
int main( )
int num = 8;
test_function(num);
Instructions for test_function
eip
Instructions for main ~ ~ ~ ~
Stack
esp
ebp
Stack frame for main
Stack frame for test_function
Registers
In test_function, the local (i.e. function) variable flag is declared and initialized to be a*a. Since the parameter a is equal to the value of the argument (8), flag will be set to 64 (or 0x40 in hex). This is loaded into the stack frame for test_function.

7. Instructions for test_function
Text Segment
Source Code
void test_function(int a) {
int flag = a*a; }
int main( )
int num = 8;
test_function(num);
Instructions for test_function
Instructions for main
eip ~ ~ ~ ~
Stack
Registers
With the function call completed, eip jumps back to the return address, and esp and ebp are moved back to their original positions to mark out the stack frame for main. The contents of the memory previously used to store flag, return_address, etc. is not deleted or changed, but it is no longer viewed as being part of the main stack frame (and there is no such thing as the stack frame for test_function anymore).
esp
Stack frame for main
ebp