i have this question about passing parameters
i saw an example that did the following:


the way i understand this code is:
push ebp ; this stores the parameters in the stack to be read one by one directly from the stack
mov ebp, esp ; takes the address of the stack and store it in ebp, i dunno y he did this
mov eax, [esp+8] ; i dunno y he started with 8, and i also dunno why he didnt call ebp directly

the things i mentioned that i dunno in the comments is that i dunno why it isnt done like this
push ebp
mov eax, [ebp+8]

any explaination?

The first two instructions are to set up the EBP-frame, ESP-frame procs don't have that, but then accessing local variables and parameters is more complicated because ESP typically changes during execution (when using PUSH for instance). Also, addressing via [ESP+x] makes the instructions 1 byte longer than [EBP+x].

The code used [esp+8] because after using PUSH EBP, you have [ESP]= old EBP, [ESP+4] = return address (used by RET instruction), and [ESP+8] = first function's argument. However, considering this is an EBP-frame function, I think you may have copied the last instruction wrong and actually it is "mov eax, [ebp+8]", but it is OK anyway because at that point EBP=ESP and perhaps it is even an optimization because the CPU does not have to wait for mov ebp, esp completion.

man, im sorry
but can u go simpler?
just a little bit?
i read it like 10 times
- "frame procs" whats that?
- "[ESP+x] makes the instructions 1 byte longer" how so? for example, makes it like [ESP+9] inted of [ESP+8]?
- "ESP typically changes during execution (when using PUSH for instance)." why will it change after push?

and sorry for copying the last line wrong

ESP holds a value (memory address) called the stack pointer. Parameters are stored on the stack (in memory relative to ESP). To access these values we need to maintain a pointer relative to ESP -- which is difficult when ESP changes (as more space is needed on the stack).

PUSH works by adjusting ESP to make space on the stack, and then storing the value at the address ESP. PUSH {regmem} is analogous to SUB ESP,4 / MOV [ESP],{regmem}.

The use of a frame pointer allows the stack pointer to fluxuate in a dynamic manner without loosing a point of reference. EBP is used in this manner above. First the contents of EBP are preserved on the stack, then ESP is preserved in EBP.

Instruction encoding is one byte shorter with offsets from EBP than they are from ESP -- this is what the processor sees and not in reference to the mnemonic representation. How the processor handles instructions can effect execution performance. Smaller code takes up less space in memory/disk/network.

Can you share with us your experience/goals to assist in communication?

thanks alot bitRAKE, i got it now
actually i dont have much experience when it comes to low level coding, im kinda good with delphi and win32 platform applications.
and i got no goals, i was just watching some asm vedios and this one poped out and i didnt understand it.

is there a book or paper that explains this small things? or it comes with experience?

Somewhere in the Intel manuals these basic things must be described in detail. Certainly, volume 1, but I don't know what chapter - maybe right at the start? Randy Hyde's AoA (Art of Assembly Language) most certainly covers it as well. Some people just jump in modifying existing sources - which works well once you have an overview of the architecture in mind.

...and ask lots of questions, of course.

Yes, it is in Volume 1. Chapter 6 - Procedure calls, interrupts and exceptions; section 6.2 - Stacks.

thanks alot
ill start reading right now