What are these additional instructions when parsing simple binaries?
this is a bit of a nubian question ... here is some background. I am looking into assembly, so I wrote a very simple C program, compiled it with gcc -m32 -O0 -o prog.elf
, and then objdump against it with objdump -M intel -d prog.elf
.
Code C:
#include <stdio.h>
int main() {
int a = 1;
int b = 2;
a = a + b;
return (0);
}
Which seems simple enough. Generated Intel assembly (with my comments):
push ebp ; Push previous stack frame.
mov ebp, esp ; Move SP to EBP to set new stack frame.
sub esp, 0xc ; Reserve 0xc bytes for local variables.
xor eax, eax ; Clear eax.
mov DWORD PTR [ebp-0x4], 0x0 ; Move 0x0 into local variable ebp-0x4.
mov DWORD PTR [ebp-0x8], 0x1 ; Move 0x1 into local variable ebp-0x8.
mov DWORD PTR [ebp-0xc], 0x2 ; Move 0x2 into local variable ebp-0xc.
mov ecx, DWORD PTR [ebp-0x8] ; Move local variable ebp-0x8 into ecx.
add ecx, DWORD PTR [ebp-0xc] ; Add local variable ebp-0xc to ecx.
mov DWORD PTR [ebp-0x8], ecx ; Move value of ecx into local variable ebp-0x8.
add esp, 0xc ; Set SP back to location before.
pop ebp ; Restore base pointer.
ret ; Return
My question is, what is ebp-0x4 doing there ? It doesn't seem to be doing anything. I'll guess and say this from main () paramators, what does it lack, but for some reason it still pushes 0x0 as a parameter if none is provided? Also, why is xor eax, eax not used ...
I'm just a little confused as to why they are there. If anyone can help me understand why that would be great. Thanks in advance!
source to share
I'm not sure why you think it is xor eax, eax
not being used, this is an easy way to set eax
to zero. Since it is often the return code from a function, this would be the equivalent of yours return 0;
(which doesn't need parentheses, by the way).
As for why it exists ebp-0x4
, I could not say. I will say that the rest of the code is well and truly unoptimized, so it might just be an artifact of the compilation process. It can disappear at higher optimization levels, especially since the entire function can basically be replaced with a single line that you think is overkill :-)
source to share