22nd February 2011

x86 Reference

Stack Frames

ESP-0x04  first unused stack address
ESP       last used stack address
          (EBP-0x0C at begin of func)
--------------------------------------
EBP-0x0C  third local var
EBP-0x08  second local var
EBP-0x04  first local var
EBP       saved EBP
EBP+0x04  saved EIP
EBP+0x08  first argument
EBP+0x0C  second argument
EBP+0x10  third argument
--------------------------------------
          last local var
          ...
          first local var
[EBP]     saved EBP
          saved EIP
          first argument
          ...
          last argument
--------------------------------------
...

References


Back to Knowledge Base.