2021-11-07 · 1

What's the Stack Frame?

securityreversing

This post is over 2 years old. The content may be outdated.

What is a stack frame?

What's the stack frame?


A stack frame is a region created to distinguish a function's own stack area when that function is called. This space stores the local variables and parameters related to the function; it's allocated when the function is called and destroyed when the function ends.

When a function is called, the stack stores the function's parameters, the return address to go back to after the call ends, the local variables declared in the function, and so on. This function-call information stored sequentially in the stack area is called a stack frame. Thanks to this stack frame, after a function call is entirely finished, you can return to the state before that function was called.

1. Function Prologue

push rbp, mov rbp, rsp

!> ****](https://eliez3r.github.io/post/2019/10/16/study-system.Stack-Frame.html)

Using push rbp, we save the function's rbp onto the stack. And by copying rsp into rbp, we set rsp to the rbp address. Since rbp acts as the function's reference point, using rbp as the basis you can easily know the positions of RET, argc, argv, the function's local variables, and so on. ## 2. Function Epilogue The function epilogue is the process of cleaning up the stack when your function ends and returns. It's making it back to the original state. Alongside it uses mov eax, 0x0 pop rbp , ret, and le — study-system.Stack-Frame.html

https://blog.naver.com/hermet/56227646


Original (Korean): tistory — published 2021-11-07, migrated to this blog. This translation was generated with the help of AI.

Comments

Delete this comment?

Related posts

What's the Stack Frame? · 나봄하랑