Why do we "PUSH EBP" and "MOV EBP, ESP" in the CALLEE in Assembly?
Solution 1
It is establishing a new stack frame within the callee, while preserving the stack frame of the caller. A stack frame allows consistent access to passed parameters and local variables using fixed offsets relative to EBP
anywhere in the function, while ESP
is free to continue being modified as needed while the function is running. ESP
is a moving target, so accessing parameters and variables using dynamic offsets relative to ESP
can be tricky, if not impossible, depending on how the function uses the stack. Creating a stack frame is generally safer, at the cost of using a few bytes of stack space to preserve the pointer to the caller's stack frame.
Solution 2
The given answer from Remy is perfect, however here is one small addition, a thing you might also see right after
mov ebp, esp
it's very possible to see instruction such:
sub esp, 20h ; creating space for local variables with size 20h
sub esp, CCh ; creating space for local variables with size CCh
along side with an AND call sometimes (like and esp, 0FFFFFFF0h). This is also part of the dealing with the stack and it's done so the stack can be align and be divisible by 16. Of course all this depends on the used calling convention (cdecl, fastcall, stdcall etc.)
Comments
-
Artur Grigio almost 2 years
Why do we
push ebp
as the first action in the Callee of an Assembly function?I understand that then we use
mov edi, [ebp+8]
to get the passed in variables, but ouresp
is already pointing to return address of the Caller function. We can easily access the passed in variables withmov edi, [esp+4]
or if we pushed the Callee registers, thenmov edi, [esp+16]
.So, why have that extra register in the cpu (the
ebp
) which you later have to manage in functions? i.e.push ebp mov ebp, esp ... mov esp, ebp pop ebp