What is between ESP and EBP?
95,194
Usually, this space is reserved for local variables that end up stored on the stack. At the start of the function, ESP
is decremented by the appropriate value.
In your case, there are 104 bytes worth of locals in the function.
Author by
Martin Ba
C++ Link of the day: Stop Software Patents (by http://www.ffii.org/)
Updated on May 31, 2021Comments
-
Martin Ba almost 3 years
Right, I'm sure this is implicitly answered many times, but I seem not to be able to quite get to it.
If you have a (x86) stack trace (say, looking at it in WinDbg), and you look at the registers, what does it mean for EBP and ESP values to be x bytes apart?
Links:
- https://stackoverflow.com/a/3699916/321013
- https://stackoverflow.com/a/2466587/321013
- https://stackoverflow.com/a/5738940/321013
To give an example of a recent stack trace I had:
0:016> k ChildEBP RetAddr 1ac5ee8c 76b831bb ntdll!NtDelayExecution+0x15 1ac5eef4 76b83a8b KERNELBASE!SleepEx+0x65 1ac5ef04 0060e848 KERNELBASE!Sleep+0xf 1ac5ef10 76859d77 MyApp!application_crash::CommonUnhandledExceptionFilter+0x48 [...\applicationcrash.inc.cpp @ 47] 1ac5ef98 775a0df7 kernel32!UnhandledExceptionFilter+0x127 1ac5efa0 775a0cd4 ntdll!__RtlUserThreadStart+0x62 1ac5efb4 775a0b71 ntdll!_EH4_CallFilterFunc+0x12 1ac5efdc 77576ac9 ntdll!_except_handler4+0x8e 1ac5f000 77576a9b ntdll!ExecuteHandler2+0x26 1ac5f0b0 7754010f ntdll!ExecuteHandler+0x24 1ac5f0b0 6e8858bb ntdll!KiUserExceptionDispatcher+0xf 1ac5f400 74e68ed7 mfc80u!ATL::CSimpleStringT<wchar_t,1>::GetString [f:\dd\vctools\vc7libs\ship\atlmfc\include\atlsimpstr.h @ 548] 1ac5fec0 6e8c818e msvcr80!_NLG_Return [F:\dd\vctools\crt_bld\SELF_X86\crt\prebuild\eh\i386\lowhelpr.asm @ 73] 1ac5ff48 74e429bb mfc80u!_AfxThreadEntry+0xf2 [f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\thrdcore.cpp @ 109] 1ac5ff80 74e42a47 msvcr80!_callthreadstartex+0x1b [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 348] 1ac5ff88 76833677 msvcr80!_threadstartex+0x66 [f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c @ 326] 1ac5ff94 77569f02 kernel32!BaseThreadInitThunk+0xe 1ac5ffd4 77569ed5 ntdll!__RtlUserThreadStart+0x70 1ac5ffec 00000000 ntdll!_RtlUserThreadStart+0x1b 0:016> r eax=00000000 ebx=1ac5efc8 ecx=19850614 edx=00000000 esi=1ac5eed0 edi=00000000 eip=7754fd21 esp=1ac5ee8c ebp=1ac5eef4 iopl=0 nv up ei pl nz na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
Values of ESP
1ac5ee8c
- EBP1ac5eef4
= 104 bytes difference. So what's in there?