c an assembler

Thus, you would define a function in C style in the following way:

global  _myfunc 

_myfunc: 
        push    ebp 
        mov     ebp,esp 
        sub     esp,0x40        ; 64 bytes of local stack space 
        mov     ebx,[ebp+8]     ; first parameter to function 

        ; some more code 

        leave                   ; mov esp,ebp / pop ebp 
        ret

B.4.65 ENTER: Create Stack Frame


ENTER imm,imm ; C8 iw ib [186]


ENTER constructs a stack frame for a high-level language procedure call. The first operand (the iw in the opcode definition above refers to the first operand) gives the amount of stack space to allocate for local variables; the second (the ib above) gives the nesting level of the procedure (for languages like Pascal, with nested procedures).


The function of ENTER, with a nesting level of zero, is equivalent to


PUSH EBP ; or PUSH BP in 16 bits
MOV EBP,ESP ; or MOV BP,SP in 16 bits
SUB ESP,operand1 ; or SUB SP,operand1 in 16 bits


This creates a stack frame with the procedure parameters accessible upwards from EBP, and local variables accessible downwards from EBP.


With a nesting level of one, the stack frame created is 4 (or 2) bytes bigger, and the value of the final frame pointer EBP is accessible in memory at [EBP-4].


This allows ENTER, when called with a nesting level of two, to look at the stack frame described by the previous value of EBP, find the frame pointer at offset -4 from that, and push it along with its new frame pointer, so that when a level-two procedure is called from within a level-one procedure, [EBP-4] holds the frame pointer of the most recent level-one procedure call and [EBP-8] holds that of the most recent level-two call. And so on, for nesting levels up to 31.


Stack frames created by ENTER can be destroyed by the LEAVE instruction: see section B.4.136.

Zum Vergrößern anklicken....

The callee may then access its parameters relative to EBP. The doubleword at [EBP] holds the previous value of EBP as it was pushed; the next doubleword, at [EBP+4], holds the return address, pushed implicitly by CALL. The parameters start after that, at [EBP+8]. The leftmost parameter of the function, since it was pushed last, is accessible at this offset from EBP; the others follow, at successively greater offsets. Thus, in a function such as printf which takes a variable number of parameters, the pushing of the parameters in reverse order means that the function knows where to find its first parameter, which tells it the number and type of the remaining ones.

Zum Vergrößern anklicken....

8.1.4 c32.mac: Helper Macros for the 32-bit C Interface

Included in the NASM archives, in the misc directory, is a file c32.mac of macros. It defines three macros: proc, arg and endproc. These are intended to be used for C-style procedure definitions, and they automate a lot of the work involved in keeping track of the calling convention.

An example of an assembly function using the macro set is given here:

proc _proc32

%$i arg
%$j arg
mov eax,[ebp + %$i]
mov ebx,[ebp + %$j]
add eax,[ebx]

endproc

This defines _proc32 to be a procedure taking two arguments, the first (i) an integer and the second (j) a pointer to an integer. It returns i + *j.

Note that the arg macro has an EQU as the first line of its expansion, and since the label before the macro call gets prepended to the first line of the expanded macro, the EQU works, defining %$i to be an offset from BP. A context-local variable is used, local to the context pushed by the proc macro and popped by the endproc macro, so that the same argument name can be used in later procedures. Of course, you don't have to do that.

arg can take an optional parameter, giving the size of the argument. If no size is given, 4 is assumed, since it is likely that many function parameters will be of type int or pointers.

Zum Vergrößern anklicken....

So, meine Fragen nun:

- kann ich einfach ENTER statt push und mov und sub für den Anfang benutzen? Oder gibt es einen Grund dies nciht zu tun.

- Woher weiß ich, wieviel stack space ich reservieren muß für "lokale Var."? (erster Paramter ENTER.)

- Was soll der 2. Parameter bei ENTER und im Zshng mit c.

- Was hat das mit den ebp offsets (s.o.) in + und in - Richtung auf sich?

- Ich habe ja verstanden, daß der return Wert in eax stehen sollte. Im obigen Bsp mit einer Übergabe als pointer, da reicht es doch (um dem c standrad zu genügen) und die verweiste Speicherstelle upzudaten, wenn ich den Wert, auf den der pointer zeigt, ändere?

- Bzgl der nasm Syntax/Makro arg: Woher weiß ich anhand des Quelltextes, was für ein Datentyp es ist? Sehe ich es nur implizit, was ich damit anstelle? Bzw oben steht einfach "integer", woher weiß nasm ob es byte, word oder dword ist?

Zum Vergrößern anklicken....