08 - The Stack

Cybersecurity, reverse engineering, malware analysis and ethical hacking content!
🌶️ YouTube 👉🏻 Like, Comment & Subscribe!

[Timo-Epis]

"if this is to confusion..." Your tutorial was excelent!!!

[rbt-]

Wow. I am at a lost for words. This is hands down the BEST video on assembly I have seen. THANK YOU!

[mejer_]

Great video and sooo helpful for my upcoming exam in malware analysis. Thx for taking your time to make this video. Saved me a headache

[ZettaiKatsu]

Thanks for the lesson. Whenever you need to overwrite a register but you also need this erased value, just write it on the stack. We push EIP because we need to go the actual body of the Foo function before doing the add. At 13:00 "return addy" means the "old value" of EIP

[OlivierDubois]

Nice and clear introduction! Just one thing starting around 6:55, you mentioned [ebp+4] as a way to reference a variable on the stack, and then draw it below ebp. But as the stack grows downward, I would assume [esp+4] to be in the stack. I believe [ebp+4] would be in the red zone (above the current stack frame).

[Nex-kyuy]

Thank you fir the amazing tutorial. Sorry if this is a stupid question but I would like to know how these registers would work in a real life program if we would want to disassemble and crack it.

[SuperMatchaLatte]

Thank you for a great video!

Would you mind to explain how stack would look like when multiple parameters are passed when procedure/ function is called?

[_AayushThapa]

I understand almost everything but I am still unable to know how the old value of SBP will be restored to its previous value before the function call ( Is it like the SBP contains its own stack data structure so that every time a function is called the old value of the SBP will be pushed onto the SBP stack data structure). And also, the return address will be the part of the calling function stack frame or called function stack frame and the pushed old SBP value as well?

[ДимитърЦонев-гу]

If at the end we increment ESP and it goes over the stored eax in the stack, what happens to eax as eax is no longer in the frame between the base of the stack and the top of the stack? Aren't we losing this data this way?

[sx.]

for the epilogue, shouldnt the stack pointer mov to the base pointer instead? so it would be mov esp, ebp