CODEWITHSUNDEEP
x86
user327399
user327399

Reputation:

the sub x86-instruction question

Assume that we have the following c code

void fun(void){
    printf("this is fun\n");
}

Then, we compile it with debug mode, we get the following disassemble code:

push ebp
mov ebp,esp
sub esp, 0xc0
...

Ok,we just discuss:

sub esp, 0xc0

My question is: why is the default value here 0xc0, not the other value, such as 0xF0, 0xFF… and so on?

Upvotes: 0

Views: 67

Answers (1)

Craig Parton
Craig Parton

Reputation: 118

This is a standard stack frame setup, saving the stack pointer then using EBP for indexing. The amount subtracted from ESP is what is allocated for the procedure's local variable storage, and local variables will be accessed by referencing [EBP-??].

Without seeing the code for your procedure it is difficult to say why it allocates that much storage. There is no default value used by the compiler, it always allocates exactly what is needed. It can do this because local variables types must be explicitly declared, and the compiler knows how much space is used by each type. There is no randomness or uncertainty in it, and no benefit to allocating extra storage. I also can't see how randomizing the local variable storage size would prevent any kind of stack-based attack. Most modern processors have hardware data execution prevention measures in place, making these attacks impossible anyway.

Upvotes: 1

Related Questions