So, after the function prologue, the value 0x1 is stored in the first function local variable a. And, a is accessed using [RBP – 0x8]. Please note that using [RBP – 0x4] we can access the local variable d. Now, we move the 32-bit content of [RBP – 0x8] to EAX and copy the value of EAX to EDI. Please note that in x64, the first function argument is passed in the RDI register. Here, we are passing 32-bit value and hence, using EDI. Now, the function func() is called.
mov DWORD PTR [rbp-0x8],0x1 mov eax,DWORD PTR [rbp-0x8] mov edi,eax call 2e <main+0x19>
Now, let’s look at the stack frame of the main function.
After func() returns, the following assembly instructions are executed in the main function.
0000000000000015 <main>: push rbp mov rbp,rsp sub rsp,0x10 mov DWORD PTR [rbp-0x8],0x1 mov eax,DWORD PTR [rbp-0x8] mov edi,eax call 2e <main+0x19> mov DWORD PTR [rbp-0x4],eax mov eax,0x0 leave ret
Here, we are first copying the returned value to [RBP – 0x4] that can be used to access the d variable. Now, we are copying 0x0 to EAX and returning from the main function. Please note that EAX is used to contain the returned value of a function.
Now, let’s try to understand the leave instruction. The leave instruction performs the following steps:
In this article, we would discuss:
-
Stack Frames in x86 64-bit Processors or x64
-
What is the Red Zone in x64 stack frame?






0 Comments