Phoenix Network Forums

Hi,

I have the following code compiled and run on a Intel Xeon system with Linux
OS.

void func(int a, int b, int c) {
char buffer1[5]="sabu";
char buffer2[10]="opensave1";
sleep(20);
}

int main() {
func(1,2,3);
}

Now using gdb I see that the prolog of function "func" is as follows :-

push %ebp
mov %esp,%ebp
sub $0x28,%esp

What I cannot understand is why 28 is subtracted from esp ?? I understand
memory alignment is done here but why 28 ?? I thought it should be 20 ..or
is it bcoz it is Intel Xeon ? what is the logic behind subtracting 28 ?

More info I received from gdb is :-

ebp = 0xbfffd5b8
esp = 0xbfffd580

0xbfffd5a0 -> "sabu"
0xbfffd590 -> "opensave1"

thanks,
Sabu

sabu wrote:push %ebp
mov %esp,%ebp
sub $0x28,%esp

This might just be gcc doing an optimization trick that doesnt really optimize anything ;/.

I havent reversed/debugged anything on *nix in a while though, Im stuck on windows atm.

~c

You need to look at the whole .s file. So, this is most likely what is happening, but you should check your assembly file to be sure.

I get the following:

Code: Select all

LC0:
   .ascii "sabu\0"
LC1:
   .ascii "opensave1\0"
   .text
.globl _func
   .def   _func;   .scl   2;   .type   32;   .endef
_func:
   pushl   %ebp
   movl   %esp, %ebp
   subl   $24, %esp


So, when we execute the function call esp contains the location of the last argument to the function. The first thing the program needs to do is make esp point to a location where it can write "sabu". So we save ebp (pushl %ebp), then we save esp (pushl %ebp), then we load the location of buffer1 into esp.

To do this, we need to go backwards from the location of the function call. To do this, we subtract the number of bytes that we need to go back from esp (subl $24, %esp). How do we get 24? Sabu is 5 bytes (4 chars + the \0 character at the end of the string) "opensave1" is 10 for the same reason. Then we need to leave space for the three arguments to the function (a, b, and c). c is currently pointed to by esp so we can ignore it. a and b are 4 bytes each for a toal of eight. 15+4+8 is 23 but we want to start our strings on a word boundry so we burn a byte and go back 24.

-selket