1. Assembly function call convention
Assembly IA-32

2. Function Call Protocol
Stack-frame
Parameters
Return Value

3. Stack Frame (1) Stack frame from calling function
Function Arguments (if any)
Function return address
Stack
Memory

4. Stack Frame (2)
Is the stack memory associated with the function context
Alignment: 4 bytes
The register must EBP points to the beginning of the frame
By having EBP as a base pointer the function memory is organized:
To access the parameters (MOV ..., [ EBP ])
To access local variables (MOV ..., [ EBP ])
ESP always points to the last used memory value

5. Example (Prologue) caller_frame … EBP ESP int f(int a, int b, int c) {
return a + b + c; }
int main()
(…)
f(1, 2,3);
caller_frame …
EBP
Memory Addresses
ESP

6. Example (Prologue) caller_frame … EBP 3 2 ESP
int f(int a, int b, int c) {
return a + b + c; }
int main()
(…)
f(1, 2,3);
caller_frame … 3 2 1
EBP
Memory Addresses
ESP

7. Example (Prologue) caller_frame … EBP 3 2 int f(int a, int b, int c) {
return a + b + c; }
int main()
(…)
f(1, 2,3);
caller_frame … 3 2 1
return addr
EBP
Memory Addresses
ESP

8. Example (Prologue) caller_frame … EBP 3 2 int f(int a, int b, int c) {
return a + b + c; }
int main()
(…)
f(1, 2,3);
caller_frame … 3 2 1
return addr
old_ebp
EBP
Memory Addresses
ESP

9. Example (Prologue) caller_frame … EBP 3 2 int f(int a, int b, int c) {
return a + b + c; }
int main()
(…)
f(1, 2,3);
caller_frame … 3 2 1
return addr
old_ebp
EBP
Memory Addresses
ESP

10. Example (Epilogue) int f(int a, int b, int c) { return a + b + c; }
int main()
(…)
f(1, 2,3);
caller_frame … 3 2 1
return addr
old_ebp
EBP
Memory Addresses
ESP

11. Example (Epilogue) int f(int a, int b, int c) { return a + b + c; }
int main()
(…)
f(1, 2,3);
caller_frame … 3 2 1
return addr
old_ebp
EBP
Memory Addresses
ESP

12. Example (Epilogue) EIP CURRENT_SOURCE_ADDR int f(int a, int b, int c){
return a + b + c; }
int main()
(…)
f(1, 2,3);
caller_frame … 3 2 1
return addr
old_ebp
EBP
Memory Addresses
ESP

13. Example (Epilogue) EIP return addr int f(int a, int b, int c) {
return a + b + c; }
int main()
(…)
f(1, 2,3);
caller_frame … 3 2 1
return addr
old_ebp
EBP
Memory Addresses
ESP

14. Parameters First parameter at the lowest address position
STACK
+============+
| return_addr| +4 (ebp+)
<<ebp>> | old_ebp |
-4 | … | +28
-8 | … | +24
-12 | arg_2 | +20
-16 | arg_1 | <<esp>>
First parameter at the lowest address position
Parameters are always aligned to 4 bytes
If char or short, they occupy the lower part of the 4 bytes
Stack adjustment after the call is the caller responsibility

15. Return Value
Register: ints and pointers
EAX
EDX:EAX (for 64 bits)

16. Return Value structs
STACK
+============+
| return_addr| +4 (ebp+)
<<ebp>> | old_ebp |
-4 | … | +16
-8 | … | +12
-12 | arg_2 | +8
-16 | arg_1 |
-20 |hidden_param| <<esp>>
Stack before the function call of a function that returns a struct
The hidden_param points the allocated memory by the function for the return value
If the function has any other params, they are stacked after the hidden
The callee function must return on EAX the hidden_param

17. Registers Must be preserved: Not preserved:
EIP, ESP, EBP – Always modified by the callee function
EBX, ESI, EDI – Must be preserved if the callee function uses them
Not preserved:
EAX; ECX, EDX
Flags