flat assembler
Message board for the users of flat assembler.

Index > Main > I have two silly questions about ESP register

Author
Thread Post new topic Reply to topic
system error



Joined: 01 Sep 2013
Posts: 671
system error
a. What is the highest possible starting address / value for ESP register. Is it 0FFFFFFFFh or 0FFFFFFFBh? I ask this because I've never seen ESP containing 0FFFFFFFFh. Not even from the DOS prompt's debug command.

b. Top of stack? Does ESP point to the offset address of last item pushed OORRR the offset address of the next available location. "Top of stack" refers to which one? I ask this because even the Intel manual says 'top of stack' without explaining anything. Can't find anything conclusive from the net either.

Enlighten me before I start drawing ugly diagrams on this board to explain my silliness!
Post 08 May 2014, 17:24
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17671
Location: In your JS exploiting you and your system
revolution
a. ESP can be any value. It can be unaligned and it can also wrap around to 0 (but not both at the same time); assuming your page tables allow it.

b. ESP always points to the last value pushed onto the stack. This is known as a "full descending" stack. Both the Intel and AMD manuals explain this, you just have to know where to look.
Post 08 May 2014, 17:47
View user's profile Send private message Visit poster's website Reply with quote
system error



Joined: 01 Sep 2013
Posts: 671
system error
Ok that's it. A snippet to begin with;

Code:
push 10
push 20
push 30
call ask
;...
ask:
        push ebp
        mov ebp,esp
        ;...
        pop ebp
ret    


Regarding question b), after "push ebp", which address does ESP refer to as "top of stack"? Is it 6FF90 or 6FF94? Am I having a perception problem here?

Code:
+--------------+  [6FFA4]
|     10       |
+--------------+  [6FFA0]
|     20       |
+--------------+  [6FF9C]
|     30       |
+--------------+  [6FF98]
|  return add  |
+--------------+  [6FF94]
|   old EBP    |
+--------------+  [6FF90]
| (next avail.)|
+--------------+     


I extended one more slot down to show next available (4-byte) location on the stack.


Last edited by system error on 08 May 2014, 18:21; edited 1 time in total
Post 08 May 2014, 17:50
View user's profile Send private message Reply with quote
system error



Joined: 01 Sep 2013
Posts: 671
system error
revolution wrote:
a. ESP can be any value. It can be unaligned and it can also wrap around to 0 (but not both at the same time); assuming your page tables allow it.

b. ESP always points to the last value pushed onto the stack. This is known as a "full descending" stack. Both the Intel and AMD manuals explain this, you just have to know where to look.


revo, I know about that grow downward thing. Just look at my ugly diagram and tell me what u think is the answer.
Post 08 May 2014, 17:52
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17671
Location: In your JS exploiting you and your system
revolution
A debugger will show you clearly that ESP is 6FF90 and that TOS is "old EBP". If you execute mov eax,[esp] the value in eax will be old EBP. The phrase "full descending" perfectly describes what happens. If you search for it you will likely find a better description than I can give.
Post 08 May 2014, 18:22
View user's profile Send private message Visit poster's website Reply with quote
system error



Joined: 01 Sep 2013
Posts: 671
system error
Damn. I am indeed having a serious perception problem! No more drinks after lunch! LOL Rolling Eyes
Post 08 May 2014, 18:28
View user's profile Send private message Reply with quote
system error



Joined: 01 Sep 2013
Posts: 671
system error
revolution wrote:
A debugger will show you clearly that ESP is 6FF90 and that TOS is "old EBP". If you execute mov eax,[esp] the value in eax will be old EBP. The phrase "full descending" perfectly describes what happens. If you search for it you will likely find a better description than I can give.
Ok thanks. I am having confusion with this downward and upward stuff. I was given the impression that addressing also goes downward (i.e, the offset is the higher address LOL) while in fact only the address grows downward. Funny how I fully understood this before but it turned upside down when I read a description from one textbook.
Post 08 May 2014, 18:38
View user's profile Send private message Reply with quote
system error



Joined: 01 Sep 2013
Posts: 671
system error
Sorry for the trouble. LOL LOL
Post 08 May 2014, 18:41
View user's profile Send private message Reply with quote
sid123



Joined: 30 Jul 2013
Posts: 340
Location: Asia, Singapore
sid123
I know it's a little off topic, but is it possible to look for a stack overflow (no pun intended)? Maybe set manually the limit of the ESP register?
Post 09 May 2014, 00:07
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17671
Location: In your JS exploiting you and your system
revolution
sid123 wrote:
I know it's a little off topic, but is it possible to look for a stack overflow (no pun intended)? Maybe set manually the limit of the ESP register?
Yes. You can catch the guard page exception.

Also, in Windows if you exceed your stack allocation the application is terminated without a chance to do any shutdown. You can test this by writing a small program that simply keeps pushing onto the stack and watch what happens. And while you are at it, try skipping over the guard page and watch the application crash.
Post 09 May 2014, 01:24
View user's profile Send private message Visit poster's website Reply with quote
system error



Joined: 01 Sep 2013
Posts: 671
system error
sid123 wrote:
I know it's a little off topic, but is it possible to look for a stack overflow (no pun intended)? Maybe set manually the limit of the ESP register?


You meant something like mov esp,0ffffffffh? That's the largest value a 32-bit register can have. How could there be stack overflow in the first place? That instruction is legal Rolling Eyes
Post 09 May 2014, 22:50
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17671
Location: In your JS exploiting you and your system
revolution
Stack overflow is when you push too many things and it either clobbers some other memory used for other data or the memory allocation was exceeded and the OS won't/can't give you more space.
Post 10 May 2014, 01:05
View user's profile Send private message Visit poster's website Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.

Website powered by rwasa.