Registers

esp (stack pointer)

Stores the address of the top of the stack. It is shifted every time something is pushed or popped from the stack.

ebp (frame pointer)

The address of the base of the stack frame of the current function that is running. The reference point for access of arguments and local variables. It only changes when another function is called or ends.

eax (return value)

Stores the return value of a function, and is also used in arithmetic instructions.

Functions

When a function or procedure is started, a stack frame is created and assigned to the current ESP location (the top of the stack). This allows the subroutine to operate independently in its own location in the stack.

When the subroutine ends, the program receives teh parameters passed from the subroutine adn the EIP is reset to the location at the time of the initial call.

Contains two important components, the prologue and epilogue. The prologue prepares the stack to be used, and the epilogue resets the stack to the prologue settings.

Even if the code doesn't contain a return, when the program leaves a subroutine it will still run the epilogue.

Prologue

1. When a program starts, the function parameters i.e. (argc, argv) are pushed on the stack from right to left.
2. The processesor then pushes the contents of the EIP to the stack and points to the first byte after the CALL instruction. This lets us know the address of the next instruction in order to proceed when we return from the function called.
3. Control now passes from the OS (that executed the cuntion) and changes to the function itself.