0. Department of Computer Science National Tsing Hua University
Advanced Procedures
Department of Computer Science
National Tsing Hua University

1. Assembly Language for Intel-Based Computers, 5th Edition
Kip Irvine
Chapter 8: Advanced Procedures
Slides prepared by the author
Revision date: June 4, 2006
(c) Pearson Education, All rights reserved. You may modify and copy this slide show for your personal use, or for use in the classroom, as long as this copyright statement, the author's name, and the title are not changed.

2. Chapter Overview Stack Frames Recursion .MODEL Directive
INVOKE, ADDR, PROC, and PROTO
Creating Multimodule Programs

3. Two Ways to Pass Parameters
Register vs. stack parameters:
Register parameters require dedicating a register to each parameter. Stack parameters are passed through run-time stack
Registers are faster than stack
Ex: two ways of calling DumpMem; clearly the second is easier to write
pushad
mov esi,OFFSET array
mov ecx,LENGTHOF array
mov ebx,TYPE array
call DumpMem
popad
push OFFSET array
push LENGTHOF array
push TYPE array
call DumpMem

4. How to Pass Stack Parameters?
Use stack frame (activation record)
Area of run-time stack that stores everything a procedure needs in order to run, including return address, passed parameters, saved registers, and local variables  state of the procedure
Each invocation to a procedure will push the corresponding stack frame into the run-time stack  different invocations (even to the same procedure) will occupy different areas of the stack
Procedure return will pop entire stack frame
Analog: mobile home

5. Contents of Stack Frame
What data are needed for the following function to run?
int AddTwo(int x, y) {
int sum;
sum = x + y;
return sum; }
Parameters: x, y
Local variable: sum
Return address
Saved registers x y
return addr
sum
“state”
Size can be determined at assembly time

6. Accessing Stack Frame
When procedure AddTwo is called, its corresponding stack frame is pushed onto the run-time stack
How to reference the variables in stack, i.e., x, y, sum? ?
ESP?
ESP
AddTwo PROC
mov eax,x
add eax,y
mov sum,eax
ret
AddTwo ENDP x y
return addr
sum

7. Accessing Stack Frame
Idea: use addresses relative to a base address of the stack frame in the run-time stack, which does not change during the procedure  base pointer or frame pointer
Dedicate a register to hold this pointer  EBP
A procedure can explicitly access stack parameters using constant offsets from EBP, e.g. [EBP + 8]
EBP is restored to its original value when procedure returns
[EBP+12] x y
return addr
sum
[EBP+8]
[EBP+4]
EBP*
* Exact location of frame pointer will be explained shortly

8. Preparing Stack Frame Must be done explicitly in the ASM program:
Caller procedure pushes arguments on the stack and calls callee; the CALL instruction will push the return address on the stack
Callee procedure pushes EBP (currently holding frame point of the caller procedure) on the stack
To save the EBP of the caller procedure
Callee then sets EBP to ESP
To let EBP point to base of its own stack frame
If local variables are needed, a constant is subtracted from ESP to make room on the stack
Net results: set aside a region of memory in stack to hold all data needed for this procedure

9. Return from Procedure
RET: pops top of stack into the instruction pointer (EIP or IP); control transfers to the target address
What about stack parameters?
Syntax:
RET
RET n
Optional operand n causes n bytes to be added to the stack pointer after EIP (or IP) receives the popped stack

10. Stack Frame Example (1 of 2)
.data
sum DWORD ?
.code
push 6 ; second argument
push 5 ; first argument
call AddTwo ; EAX = sum
mov sum,eax ; save the sum
Return value in eax
AddTwo PROC
push ebp
mov ebp,esp .
old EBP

11. Stack Frame Example (2 of 2)
old EBP
AddTwo PROC
push ebp
mov ebp,esp ; base of stack frame
mov eax,[ebp + 12]; second argument (6)
add eax,[ebp + 8] ; first argument (5)
pop ebp
ret 8 ; clean up the stack
AddTwo ENDP ; EAX contains the sum

12. Passing Arguments by Reference (1/2)
Consider the ArrayFill procedure, which fills an array with 16-bit random integers
Calling procedure passes address of the array, along with a count of number of array elements:
.data
count = 100
array WORD count DUP(?)
.code
push OFFSET array
push COUNT
call ArrayFill
...

13. Passing Arguments by Reference (2/2)
ArrayFill can reference an array without knowing the array's name:
ESI points to the beginning of the array, so it's easy to use a loop to access each array element
ArrayFill PROC
push ebp
mov ebp,esp
pushad
mov esi,[ebp+12]
mov ecx,[ebp+8]
...

14. Local Variables
To explicitly create local variables, subtract their total size from ESP to leave space
Still part of the stack frame
Ex.: creates and initializes two 32-bit local variables (locA and locB):
MySub PROC
push ebp
mov ebp,esp
sub esp,8 ; make space
mov DWORD PTR [ebp-4],123456h ; locA
mov DWORD PTR [ebp-8], ; locB
...

15. Clean Local Variables on Return
Before return, resets ESP by assigning it the value of EBP  release local variables from the stack
MySub PROC
push ebp
mov ebp,esp
sub esp,8
mov DWORD PTR [ebp-4],123456h ; locA
mov DWORD PTR [ebp-8], ; locB
mov esp,ebp
pop ebp
ret
MySub ENDP

16. ENTER and LEAVE
ENTER directive creates stack frame for a called procedure
ENTER numbytes, nestinglevel
pushes EBP on the stack
sets EBP to the base of the stack frame
reserves space for local variables
LEAVE: reverse operations
MySub PROC
push ebp
mov ebp,esp
sub esp,8
MySub PROC
enter 8,0

17. LOCAL Directive
A local variable is created, used, and destroyed within a single procedure
LOCAL directive declares a list of local variables
LOCAL varlist
immediately follows the PROC directive
each variable is assigned a type
MySub PROC
LOCAL var1:BYTE, var2:WORD, var3:SDWORD

18. Using LOCAL Examples: myProc PROC, ; procedure
LOCAL t1:BYTE, ; local variables
LOCAL flagVals[20]:BYTE ; array of bytes
LOCAL pArray:PTR WORD ; pointer to an array

19. MASM-Generated Code (1/2)
BubbleSort PROC
LOCAL temp:DWORD, SwapFlag:BYTE
. . .
ret
BubbleSort ENDP
BubbleSort PROC
push ebp
mov ebp,esp
add esp,0FFFFFFF8h ; add -8 to ESP
. . .
mov esp,ebp
pop ebp
ret
BubbleSort ENDP

20. MASM-Generated Code (2/2)
Diagram of the stack frame for BubbleSort:

21. Non-Doubleword Local Variables
Local variables can have different sizes
How are their memory space allocated in the stack by LOCAL directive?
8-bit: assigned to next available byte
16-bit: assigned to next even (word) boundary
32-bit: assigned to next doubleword boundary

22. Local Byte Variable Example1 PROC LOCAL var1:BYTE
mov al,var ; [EBP - 1]
ret
Example1 ENDP

23. LEA Instruction Return offsets of direct and indirect operands
OFFSET can only return constant offsets
LEA required when obtaining the offset of a stack parameter or local variable. For example:
void CopyString(int *count)
{ char temp[20]; }
CopyString PROC,
count:DWORD ; parameter
LOCAL temp[20]:BYTE ; local variable
mov edi,OFFSET count ; invalid operand
mov esi,OFFSET temp ; invalid operand
lea edi,count ; ok
lea esi,temp ; ok

24. Review
(True/False): A procedure’s stack frame always contains caller’s return address and procedure’s local variables.
(True/False): Arrays are passed by reference to avoid copying them onto the stack.
(True/False): A procedure’s prologue code always pushes EBP on the stack.
(True/False): Local variables are created by adding an integer to the stack pointer.
(True/False): In 32-bit protected mode, the last parameter to be pushed on the stack in a procedure call is stored at location EBP+8.
(True/False): Passing by reference requires popping a parameter’s offset from the stack in the called procedure.
What are two common types of parameters?

25. What's Next Stack Frames Recursion .MODEL Directive
INVOKE, ADDR, PROC, and PROTO
Creating Multimodule Programs

26. What is Recursion? The process created when . . .
A procedure calls itself
Procedure A calls procedure B, which in turn calls procedure A
Using a graph in which each node is a procedure and each edge is a procedure call, recursion forms a cycle:

27. Recursively Calculating a Sum
Recursively calculates sum of array of integers. Receives: ECX = count. Returns: EAX = sum
CalcSum PROC
cmp ecx,0 ; check counter value
jz L2 ; quit if zero
add eax,ecx ; otherwise, add to sum
dec ecx ; decrement counter
call CalcSum ; recursive call
L2: ret
CalcSum ENDP
Stack frame:

28. Calculating a Factorial (1/3)
This function calculates the factorial of integer n. A new value of n is saved in each stack frame:
int factorial(int n) {
if(n == 0)
return 1;
else
return n*factorial(n-1); }

29. Calculating a Factorial (2/3)
Factorial PROC
push ebp
mov ebp,esp
mov eax,[ebp+8] ; get n
cmp eax,0 ; n < 0?
ja L1 ; yes: continue
mov eax,1 ; no: return 1
jmp L2
L1: dec eax
push eax ; Factorial(n-1)
call Factorial
; Instructions from this point on execute when
; each recursive call returns.
ReturnFact:
mov ebx,[ebp+8] ; get n
mul ebx ; eax = eax * ebx
L2: pop ebp ; return EAX
ret 4 ; clean up stack
Factorial ENDP

30. Calculating a Factorial (3/3)
Suppose we want to calculate 12!
This diagram shows the first few stack frames created by recursive calls to Factorial
Each recursive call uses 12 bytes of stack space.

31. What's Next Stack Frames Recursion .MODEL Directive
INVOKE, ADDR, PROC, and PROTO
Creating Multimodule Programs

32. INVOKE Directive
The INVOKE directive is a powerful replacement for Intel’s CALL instruction that lets you pass multiple arguments
Syntax:
INVOKE procedureName [, argumentList]
Arguments can be:
immediate values and integer expressions
variable names
address and ADDR expressions
register names

33. INVOKE Examples .data byteVal BYTE 10 wordVal WORD 1000h .code
; direct operands:
INVOKE Sub1,byteVal,wordVal
; address of variable:
INVOKE Sub2,ADDR byteVal
; register name, integer expression:
INVOKE Sub3,eax,(10 * 20)
; address expression (indirect operand):
INVOKE Sub4,[ebx]

34. ADDR Operator .data myWord WORD ? .code INVOKE mySub,ADDR myWord
Returns a near or far pointer to a variable, depending on which memory model your program uses:
Small model: returns 16-bit offset
Large model: returns 32-bit segment/offset
Flat model: returns 32-bit offset
Simple example:
.data
myWord WORD ?
.code
INVOKE mySub,ADDR myWord

35. PROC Directive (1/2)
The PROC directive declares a procedure with an optional list of parameters.
Syntax:
label PROC paramList
paramList is a list of parameters separated by commas. Each parameter has the following syntax:
paramName:type
type must either be one of the standard ASM types (BYTE, SBYTE, WORD, etc.), or it can be a pointer to one of these types.

36. PROC Directive (2/2)
Alternate format permits parameter list to be on one or more separate lines:
label PROC,
paramList
The parameters can be on the same line . . .
param-1:type-1, param-2:type-2, ...
Or they can be on separate lines:
param-1:type-1,
param-2:type-2,
. . .,
param-n:type-n
comma required

37. Sanity Check #1
Remember that PROC and INVOKE are directives, not instructions.
(i.e., CPU does not understand it.)

38. PROC Examples (1/2) AddTwo PROC, val1:DWORD, val2:DWORD mov eax,val1
The AddTwo procedure receives two integers and returns their sum in EAX
C++ programs typically return 32-bit integers from functions in EAX
AddTwo PROC,
val1:DWORD, val2:DWORD
mov eax,val1
add eax,val2
ret
AddTwo ENDP

39. PROC Examples (2/2)
FillArray receives a pointer to an array of bytes, a single byte fill value that will be copied to each element of the array, and the size of the array.
FillArray PROC,
pArray:PTR BYTE, fillVal:BYTE
arraySize:DWORD
mov ecx,arraySize
mov esi,pArray
mov al,fillVal
L1: mov [esi],al
inc esi
loop L1
ret
FillArray ENDP

40. PROTO Directive Creates a procedure prototype Syntax:
label PROTO paramList
Every procedure called by the INVOKE directive must have a prototype
A complete procedure definition can also serve as its own prototype
Example: Prototype for the ArraySum procedure, showing its parameter list
ArraySum PROTO,
ptrArray:PTR DWORD,
szArray:DWORD

41. PROTO Directive Standard configuration:
PROTO appears at top of the program listing, INVOKE appears in the code segment, and the procedure implementation occurs later in the program:
MySub PROTO ; procedure prototype
.code
INVOKE MySub ; procedure call
MySub PROC ; procedure implementation .
MySub ENDP

42. Sanity Check #2 So, PROC and INVOKE are directives, not instruction.
How does MASM handle the parameters?

43. Passing by Value
When a procedure argument is passed by value, a copy of a 16-bit or 32-bit integer is pushed on the stack. Example:
MASM generates the following code:
.data
myData WORD 1000h
.code
main PROC
INVOKE Sub1, myData
push myData
call Sub1

44. Passing by Reference
When an argument is passed by reference, its address is pushed on the stack. Example:
MASM generates the following code:
.data
myData WORD 1000h
.code
main PROC
INVOKE Sub1, ADDR myData
push OFFSET myData
call Sub1

45. Example: Exchanging Two Integers
Swap procedure exchanges the values of two 32-bit integers. pValX and pValY do not change values, but the integers they point to are modified.
Swap PROC USES eax esi edi,
pValX:PTR DWORD, ; pointer to 1st int
pValY:PTR DWORD ; pointer to 2nd int
mov esi,pValX ; get pointers
mov edi,pValY
mov eax,[esi] ; get first integer
xchg eax,[edi] ; exchange with second
mov [esi],eax ; replace first integer
ret
Swap ENDP

46. Example: Exchanging Two Integers
Will the following work?
Swap PROC USES eax esi edi,
X:DWORD,
Y:DWORD
mov eax, X ; get first integer
xchg eax, Y ; exchange with second
mov X,eax ; replace first integer
ret
Swap ENDP
A DWORD 10
B DWROD 20
INVOKE Swap A, B
INVOKE Swap ADDR A, ADDR B ;for previous slide

47. Trouble-Shooting Tips
Save and restore registers when they are modified by a procedure.
Except a register that returns a function result
When using INVOKE, be careful to pass a pointer to the correct data type.
For example, MASM cannot distinguish between a DWORD argument and a PTR BYTE argument.
Do not pass an immediate value to a procedure that expects a reference parameter.
Dereferencing its address will likely cause a general-protection fault.

48. Summary Stack parameters Local variables
more convenient than register parameters
passed by value or reference
ENTER and LEAVE instructions
Local variables
created on the stack below stack pointer
LOCAL directive
Recursive procedure calls itself
MASM procedure-related directives
INVOKE, PROC, PROTO