0

I am taking a class right now and as part of the research project there is a question on how the ESP/RSP pointer is used in relation to popping the return address on a stack frame into the register.

Now looking up the leave instruction I found the following in the manual https://c9x.me/x86/html/file_module_x86_id_154.html

"Releases the stack frame set up by an earlier ENTER instruction. The LEAVE instruction copies the frame pointer (in the EBP register) into the stack pointer register (ESP), which releases the stack space allocated to the stack frame. The old frame pointer (the frame pointer for the calling procedure that was saved by the ENTER instruction) is then popped from the stack into the EBP register, restoring the calling procedure's stack frame.

A RET instruction is commonly executed following a LEAVE instruction to return program control to the calling procedure."

So if what its saying here, and I am just looking for verification because several Youtube videos have seemed to mangle this process;

My thinking is: EBP is copied to ESP than what is being pointed at by ESP is placed into the EBP pointer as now we are back to our previous frame.

Peter Cordes
  • 328,167
  • 45
  • 605
  • 847
Thomas Cosenza
  • 21
  • 2
  • Your last sentence doesn't quite make sense; should "than" be ", then"? – Nate Eldredge Aug 28 '21 at 17:13
  • 2
    If it helps, `leave` is equivalent to `mov esp, ebp / pop ebp` which in turn is equivalent to `mov esp, ebp / mov ebp, [esp] / add esp, 4` (not counting effects on flags). See also https://stackoverflow.com/questions/41907672/need-some-explanations-about-leave-instruction-in-assembly-language – Nate Eldredge Aug 28 '21 at 17:14
  • yes .. that is perfect thanks! – Thomas Cosenza Aug 28 '21 at 17:46
  • @Nate Eldredge: `mov esp, ebp` \ `mov ebp, dword [ss:esp]` \ `lea esp, [esp + 4]` is another way you can describe `leave`. This one doesn't affect the status flags either, like `leave` or `pop`. – ecm Aug 28 '21 at 18:16
  • 1
    @ecm: Right, but `lea` is already confusing enough to beginners that I didn't want to bring it into this discussion. – Nate Eldredge Aug 28 '21 at 18:20

0 Answers0