Module 5 - Summary Exercises

What will be the value of EAX when the following sequence of instructions has executed? PUSH 5 PUSH 10 POP EBX POP EAX

5 How to solve: Remember that the stack is FILO (first in last out) so when we push 5 and then push 10 then the first value to come off the stack is 10 and then 5. Since we first pop into EBX the value of EBX is 10 and then since the next value at the top of the stack is 5 then when we pop into EAX the value of EAX is 5.

Assume ESP equals 1C3Fh at Execution Point A. Trace the following code to Execution Point B, then answer the questions below. MOV EAX, 7 MOV EBX, 11 MOV ECX, 42 MOV EDX, 99 ; Nine Nine! ; Execution Point A PUSH EBX PUSH ECX PUSH EAX PUSH EDX POP ECX ; Execution Point B POP EDX POP EBX POP EAX At Execution Point B, what is the decimal value in ECX? At Execution Point B, what is the hexadecimal value in ESP? At Execution Point B, what is the decimal value in ?

At Execution Point B, what is the decimal value in ECX? Answer: 99 At Execution Point B, what is the hexadecimal value in ESP? Answer: 1C33 At Execution Point B, what is the decimal value in ? Answer: 3 How to solve: Every time a value is pushed, decrement the memory by 4 (for 32 bit gen registers and 2 for 16 bit) When a value is popped, the value that is at the top of the stack is put into to specified registered and the ESP is incremented by 4 (or 2 if you're working with 16 bit registers) The value in ECX was whatever was push via the reg EDX since that was the last register to be pushed. The hexadecimal value in ESP is the value representing the place in memory (the one we are decrementing and incrementing) The decimal value in ESP is the actual value in the spot that the ESP is pointing to. Which in this case is what was push in via the register EAX (since it was directly before the pushed EDX) which is the value 7.

PUSHF is used to preserve all general purpose register contents on the stack.

False The F in PUSHF refers to Flag. PUSHAD pushes all the 32bit general purpose registers to the stack.

When an argument is passed by value, a copy of the address is pushed on the stack.

False

An input parameter may be passed by reference.

True

What is the proper syntax for establishing a subprocedure.

procedureName PROC ;... ;... RET ; return to calling procedure procedureName ENDP Note: we use RET not end or exit and the PROC statement is after the procedure name and so is ENDP

High-level languages always pass arrays to subroutines by value.

False

What instruction (with any necessary operands) would pop the top 32 bits of the runtime stack into the EBP register?

POP EBP

What single instruction would I use to save all general purpose registers?

PUSHAD

A subprocedure's stack frame contains the return address and its local variables.

True

In the IA32 architecture, ESP (the stack pointer) is incremented each time data is popped from the stack.

True

Passing by reference requires accessing a parameter's offset from inside the called procedure.

True

Given the following procedures, with code segment instruction addresses given on each line in 4 byte hex... 00000000 main PROC ; ... Execution Point A 0000011C CALL doSomething 00000120 MOV result, EAX ; ... 0000023E exit 0000023F main ENDP 0000023F checkThings PROC ; ... 00000243 XOR BX, 0A00h ; Execution Point B ; ... 00000274 RET 00000275 checkThings ENDP 00000275 doSomething PROC ; ... 000002A0 CALL checkThings 000002A5 MOV EAX, EDX ; ... 000002F3 RET 000002F4 doSomething ENDP

What is the current value of the stack pointer (in 4 byte hex)? 000002A5 What is the value at the top of the stack (in 4 byte hex)? 000002A5 How to solve: Make a chart to keep track of the ESP, the EIP. Decrement the ESP each time the call and push is used. Increment when RET and POP is called.

Given the following procedures, with code segment instruction addresses given on each line in 4 byte hex... 00000000 main PROC ; ... ; Execution Point A 0000001A CALL someProc1 0000001F CALL WriteDec ; ... 00000030 exit 00000031 main ENDP 00000031 someProc1 PROC 00000031 PUSH EAX 00000035 CALL someProc2 0000003A POP EAX ; Execution Point B ; ... 0000016F RET 0000016F someProc1 ENDP 0000016F someProc2 PROC 0000016F PUSH EBX ; ... 00000205 POP EBX 00000209 RET 0000020A someProc2 ENDP Assume ESP = 000004DAh, EAX = 00000040h, EBX = 00000120h at Execution Point A, there are no stack operations other than those visible, and EAX and EBX are only changed by the visible instructions. At Execution Point B: a.) What is the current value of the stack pointer (in 4 byte hex)? b.) What is the value at the top of the stack (in 4 byte hex)?

What is the current value of the stack pointer (in 4 byte hex)? 000004D6 What is the value at the top of the stack (in 4 byte hex)? 0000001F How to solve: make a chart that has the order at which the call/push/pop/retlines are executed. Decrement the ESP hex value for call and push and increment for the pop and ret lines. The ESP hex value is the value we have been inc/dec but the value at the top of the stack is the next instruction that would be put into the EIP so if the execution point in question is right before a RET statement, the value at the top of the stack would be the number corresponding to the instruction that the RET would return to.

Which of the following instructions always modify the ESP register? (Check all that apply) DEC CALL INC JMP JNE RET POP PUSH

Which of the following instructions always modify the ESP register? (Check all that apply) CALL RET POP PUSH

Which of the following are normally part of the stack frame? (Select all that apply) a.) Arguments b.) Saved Register Values c.) Local Variables d.) Calling Procedure Starting Address e.) Return Address

a.) Arguments b.) Saved Register Values c.) Local Variables e.) Return Address

What advantages do stack parameters have over register parameters? a.) Programs using stack parameters execute more quickly. b.) Stack parameters reduce code clutter because registers do not have to be saved and restored. c.) Stack parameters are compatible with high-level languages. d.) Register parameters are optimized for speed.

b.) Stack parameters reduce code clutter because registers do not have to be saved and restored. c.) Stack parameters are compatible with high-level languages.

Another name for a stack frame is a.) Peripheral Memory b.) Heap record c.) Activation record d.) Local storage e.) Stack record

c.) Activation record

The RET instruction pops the top of the stack into what register? a.) It does not pop the top of the stack into a register. b.) ESP c.) EIP d.) EBP

c.) EIP The extended instruction pointer because it's telling the program which line to return to.

The CALL instruction functions similarly to which of the following? a.) Jump b.) Jump, then Push c.) Push, then Jump d.) Move, then Jump

c.) Push, then Jump

ESP always points to ______ a.) the next, empty, location below the stack. b.) the next, empty, location above the stack. c.) the last value to be added to, or pushed on, the top of stack. d.) the beginning of the stack when your program first began.

c.) the last value to be added to, or pushed on, the top of stack. Helpful info: ESP = Extended Stack Pointer The stack is a FILO/LIFO system where the first thing to go in is the last thing to go out and the first thing to go out is the last thing to go in. This is why the ESP always points to the last value that was added.

What general types of parameters are passed on the stack? a.) Stack frames b.) Local variables c.) Activation records d.) Value parameters e.) Reference parameters

d.) Value parameters e.) Reference parameters

When values are received by a called subroutine, they are called __________. a.) return values b.) arguments c.) variables d.) parameters

d.) parameters

A stack frame is _____ a.) The area of the stack set aside for storing global strings. b.) A register window pointing to local variables. c.) An area in the heap that is used to store global variables d.) The area of the text segment set aside for passed arguments, subroutine return address, local variables, and saved registers e.) The area of the stack set aside for passed arguments, return address, local variables, and saved registers.

e.) The area of the stack set aside for passed arguments, return address, local variables, and saved registers.