Business
Jobs
  • About Us
  • Solutions
    • Job Postings
      Post your job and receive qualified candidates in 48h.
    • Candidate Assessments
      500+ technical and psychological tests, plus anti-fraud.
    • Headhunting
      Tailor-made executive search from start to finish.
    • Payroll + EOR
      Payroll dispersal and EOR across 15+ LATAM countries.
  • Pricing
  • Jobs

0

185
Views
Poking the stack

I'm trying to understand how exactly the stack works, so I'll recreate here a small example with some questions.

Pretend that I have a small code in ASM that does the following thing:

(all this is x86, intel syntax, Linux)

push ebp
mov ebp, esp
sub esp, 16

mov eax, 0xdeadbeef  <-- let's call this 'local variable a'
mov [ebp - 16], eax

mov eax, 0xabcdabcd  <-- let's call this 'local variable b'
mov [ebp - 12], eax

mov eax, 0xcacafafa  <-- let's call this 'local variable c'
mov [ebp - 8], eax

mov eax, 0xdada1111  <-- let's call this 'local variable d'
mov [ebp - 4], eax

call 0x10101010 <------- pretend that is the real address of function_B

mov esp, ebp
pop ebp
ret

Now pretend that I have a C function called function_B which get's called from the asm code and it looks like this:

asmlinkage void function_B(void){

    //some code here...

}

How would I access a, b, c and d from function_B with inline ASM code?

Would this work? Should I be doing it differently?

uint32_t val_a;
__asm__ __volatile__(
    ".intel_syntax noprefix;"
    "mov %0, dword [ebp + 4 + 4 + 0];"
    ".att_syntax;"
    : "=r" (val_a)
);

uint32_t val_b;
__asm__ __volatile__(
    ".intel_syntax noprefix;"
    "mov %0, dword [ebp + 4 + 4 + 4];"
    ".att_syntax;"
    : "=r" (val_b)
);

Also, how would I access a, b, c and d if my function looked like this:

asmlinkage void function_B(unsigned int val){

    //some code here...

}
over 4 years ago · Santiago Trujillo
1 answers
Answer question

0

What about this:

void function_B(uint32_t fake){
    uint32_t* poke = &fake;
    uint32_t a = poke[0];
    uint32_t b = poke[1];
    uint32_t c = poke[2];
    uint32_t d = poke[3];
}

What will give you the values of a, b, c and d with your current asm code (which is not pushing any arguments to function_B). If you also want to pass real arguments to function_B you can still add the fake one after the last real argument:

void function_B(unsigned int val,uint32_t fake)

It is actually a little safer to do it like this (then with inline asm) since it has a better chance to survive optimizations (like stack frame omission). But it's still a hack of course, and nothing I would rely too much upon.

over 4 years ago · Santiago Trujillo Report
Answer question
Find remote jobs

Discover the new way to find a job!

Top jobs
Top job categories
Business
Post vacancy Pricing Sales
Legal
Terms and conditions Privacy policy
© 2026 PeakU Inc. All Rights Reserved.
Andres GPT
Show me some job opportunities
There's an error!