Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What are the ESP and the EBP registers?

I found that the ESP register is the current stack pointer and EBP is the base pointer for the current stack frame. However, I don't understand these definitions (I am just starting to learn how to code in assembler).

What I understand is that ESP points towards the stack itself and EBP points towards whatever is on top of the stack1. But these are just my guesses and they are most likely incorrect. Otherwise, what would a statement like the following mean?

MOV EBP, ESP     

Footnote 1: Editor's note: Yes, that's incorrect. In standard terminology, the "top of the stack" is where ESP points, even though it's the lowest address in the stack frame. By analogy to a stack data structure that grows upward, even though the callstack on x86 (like most ISAs) grows downward.

like image 494
Lucas Alanis Avatar asked Feb 12 '14 04:02

Lucas Alanis


People also ask

What is the EBP register?

A frame pointer (the ebp register on intel x86 architectures, rbp on 64-bit architectures) contains the base address of the function's frame. The code to access local variables within a function is generated in terms of offsets to the frame pointer.

What is a ESP register?

The ESP register is the stack pointer for the system stack. It is rarely changed directly by a program but is changed when data is pushed onto the stack or popped from the stack. One use for the stack is in procedure calls. the address of the instructions following the procedure call instruction is stored on the stack.

What is EIP EBP ESP?

EBP points to higher memory address at the bottom of the stack, ESP points to the top of the stack at lower memory location. EIP holds the address of next instruction to be executed.

What does EBP mean in assembly?

address of the top of the stack. base pointer (EBP): register containing the. address of the bottom of the stack frame. instruction pointer (EIP): register containing. the address of the instruction to be executed.


2 Answers

esp is the stack pointer, ebp is/was for a stack frame so that when you entered a function ebp could get a copy of esp at that point, everything on the stack before that happens, return address, passed in parameters, etc and things that are global for that function (local variables) will now be a static distance away from the stack frame pointer for the duration of the function. esp is now free to wander about as the compiler desires and can be used when nesting to other functions (each needs to preserve the ebp naturally).

it is a lazy way to manage the stack. makes compiler debugging a lot easier, makes understanding the code generated by the compiler easier, but burns a register that might have been otherwise general purpose.

like image 74
old_timer Avatar answered Oct 12 '22 16:10

old_timer


Normally EBP is used to backup ESP, so if ESP is changed by the code in a function, all it takes to restore ESP is mov ESP, EBP. Also since EBP is normally left unchanged by the code in a function, it can be used to access passed parameters or local variables without having to adjust the offsets.

For "stack frame" usage, EBP is pushed onto the stack at the start of any function, so the value of EBP pushed onto the stack is the value of EBP from the function that called the current function. This makes it possible for code or for a debugger to "back trace" through all the instances where EBP was pushed on to the stack, and each instance of an EBP value on the stack could be considered to be the base pointer of a stack frame.

Note that some compilers have an "omit frame pointers" option, in which case EBP is not used to save ESP or as a stack frame pointer. Instead, the compiler keeps track of ESP, and all local offsets are offsets from the current value of ESP.

like image 34
rcgldr Avatar answered Oct 12 '22 16:10

rcgldr