Assembly Language for x86 Processors

7th Edition
Kip R. Irvine

Chapter 8: Advanced Procedures

Slides prepared by the author.

Revision date: 1/15/2014

(c) Pearson Education, 2014. All rights reserved. You may modify and copy this slide show for your personal use, or for
use in the classroom, as long as this copyright statement, the author's name, and the title are not changed.
 Chapter Overview

• Stack Frames
• Recursion

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 2

 Stack Frame
• Also known as an activation record
• Area of the stack set aside for a procedure's return
address, passed parameters, saved registers, and
local variables
• Created by the following steps:
• Calling program pushes arguments on the stack and
calls the procedure.
• The called procedure pushes EBP on the stack, and
sets EBP to ESP.
• If local variables are needed, a constant is subtracted
from ESP to make room on the stack.

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 3

 Stack Parameters
• More convenient than register parameters
• Two possible ways of calling DumpMem. Which is
easier?

pushad push TYPE array

mov esi,OFFSET array push LENGTHOF array
mov ecx,LENGTHOF array push OFFSET array
mov ebx,TYPE array call DumpMem
call DumpMem
popad

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 4

 Passing Arguments by Value
• Push argument values on stack
• (Use only 32-bit values in protected mode to keep the
stack aligned)

• Call the called-procedure

• Accept a return value in EAX, if any

• Remove arguments from the stack if the called-

procedure did not remove them

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 5

 Example

.data
val1 DWORD 5 (val2) 6
val2 DWORD 6 (val1) 5 ESP
.code
push val2
push val1
Stack prior to CALL

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 6

 Passing by Reference
• Push the offsets of arguments on the stack

• Call the procedure

• Accept a return value in EAX, if any

• Remove arguments from the stack if the called

procedure did not remove them

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 7

 Example

.data (offset val2) 00000004

val1 DWORD 5
(offset val1) 00000000 ESP
val2 DWORD 6

.code
push OFFSET val2
push OFFSET val1 Stack prior to CALL

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 8

 Stack after the CALL

value or addr of val2

value or addr of val1

return address ESP

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 9

 Passing an Array by Reference (1 of 2)

• The ArrayFill procedure fills an array with 16-bit

random integers
• The calling program passes the address of the array,
along with a count of the number of array elements:

.data
count = 100
array WORD count DUP(?)
.code
push OFFSET array
push COUNT
call ArrayFill

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 10

 Passing an Array by Reference (2 of 2)

ArrayFill can reference an array without knowing the array's

name:

ArrayFill PROC
push ebp offset(array) [EBP + 12]
mov ebp,esp
count
pushad [EBP + 8]
mov esi,[ebp+12] return address
mov ecx,[ebp+8] EBP EBP
.
.

ESI points to the beginning of the array, so it's easy to use a loop
to access each array element. View the complete program.

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 11

 Accessing Stack Parameters (C/C++)

• C and C++ functions access stack parameters using

constant offsets from EBP1.
• Example: [ebp + 8]
• EBP is called the base pointer or frame pointer
because it holds the base address of the stack frame.
• EBP does not change value during the function.
• EBP must be restored to its original value when a
function returns.

1 BP in Real-address mode

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 12

 RET Instruction

• Return from subroutine

• Pops stack into the instruction pointer (EIP or IP).
Control transfers to the target address.
• Syntax:
• RET
• RET n
• Optional operand n causes n bytes to be added to
the stack pointer after EIP (or IP) is assigned a value.

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 13

 Who removes parameters from the stack?

Caller (C) ...... or ...... Called-procedure (STDCALL):

AddTwo PROC
push val2 push ebp
push val1 mov ebp,esp
call AddTwo mov eax,[ebp+12]
add esp,8 add eax,[ebp+8]

pop ebp
ret 8

( Covered later: The MODEL directive specifies calling conventions )

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 14

 Your turn . . .
• Create a procedure named Difference that subtracts
the first argument from the second one. Following is
a sample call:
push 14 ; first argument
push 30 ; second argument
call Difference ; EAX = 16

Difference PROC
push ebp
mov ebp,esp
mov eax,[ebp + 8] ; second argument
sub eax,[ebp + 12] ; first argument
pop ebp
ret 8
Difference ENDP

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 15

 Saving and Restoring Registers
• Push registers on stack just after assigning ESP to
EBP
• local registers are modified inside the procedure

MySub PROC
push ebp
mov ebp,esp
push ecx ; save local registers
push edx

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 16

 Stack Affected by USES Operator
MySub1 PROC USES ecx edx
ret
MySub1 ENDP

• USES operator generates code to save and restore

registers:
MySub1 PROC
push ecx
push edx

pop edx
pop ecx
ret

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 17

 Local Variables
• Only statements within subroutine can view or modify
local variables
• Storage used by local variables is released when
subroutine ends
• local variable name can have the same name as a
local variable in another function without creating a
name clash
• Essential when writing recursive procedures, as well
as procedures executed by multiple execution
threads

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 18

 Creating LOCAL Variables

Example - create two DWORD local variables:

Say: int x=10, y=20;
ret address
saved ebp EBP
10 (x) [ebp-4]
MySub PROC 20 (y) [ebp-8]
push ebp
mov ebp,esp
sub esp,8 ;create 2 DWORD variables

mov DWORD PTR [ebp-4],10 ; initialize x=10

mov DWORD PTR [ebp-8],20 ; initialize y=20

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 19

 LEA Instruction
• LEA returns offsets of direct and indirect operands
• OFFSET operator only returns constant offsets
• LEA required when obtaining offsets of stack
parameters & local variables
• Example
CopyString PROC,
count:DWORD
LOCAL temp[20]:BYTE

mov edi,OFFSET count ; invalid operand

mov esi,OFFSET temp ; invalid operand
lea edi,count ; ok
lea esi,temp ; ok

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 20

 LEA Example

Suppose you have a Local variable at [ebp-8]

And you need the address of that local variable in ESI

You cannot use this:

mov esi, OFFSET [ebp-8] ; error

Use this instead:

lea esi,[ebp-8]

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 21

 Recursion

• What is Recursion?
• Recursively Calculating a Sum
• Calculating a Factorial

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 22

 What is Recursion?

• The process created when . . .

• A procedure calls itself
• Procedure A calls procedure B, which in turn calls
procedure A
• Using a graph in which each node is a procedure
and each edge is a procedure call, recursion forms
a cycle:
A

E B

D C

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 23

 Recursively Calculating a Sum
The CalcSum procedure recursively calculates the sum of an
array of integers. Receives: ECX = count. Returns: EAX = sum
CalcSum PROC
cmp ecx,0 ; check counter value
jz L2 ; quit if zero
add eax,ecx ; otherwise, add to sum
dec ecx ; decrement counter
call CalcSum ; recursive call
L2: ret
CalcSum ENDP

View the complete

Stack frame: program

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 24

 Calculating a Factorial (1 of 3)

This function calculates the factorial of integer n. A new value

of n is saved in each stack frame:

int function factorial(int n) recursive calls backing up

{ 5! = 5 * 4! 5 * 24 = 120
if(n == 0)
return 1; 4! = 4 * 3! 4 * 6 = 24
else
return n * factorial(n-1); 3! = 3 * 2! 3*2=6
}
2! = 2 * 1! 2*1=2

As each call instance returns, the 1! = 1 * 0! 1*1=1

product it returns is multiplied by the
previous value of n. 0! = 1 1=1
(base case)

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 25

 Calculating a Factorial (2 of 3)

Factorial PROC
push ebp
mov ebp,esp
mov eax,[ebp+8] ; get n
cmp eax,0 ; n < 0?
ja L1 ; yes: continue
mov eax,1 ; no: return 1
jmp L2
L1: dec eax
push eax ; Factorial(n-1)
call Factorial
; Instructions from this point on execute when each
; recursive call returns.
ReturnFact:
mov ebx,[ebp+8] ; get n
mul ebx ; eax = eax * ebx
L2: pop ebp ; return EAX
ret 4 ; clean up stack
Factorial ENDP

See the program listing

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 26
 Calculating a Factorial (3 of 3)
12 n
ReturnMain
ebp0
Suppose we want to 11 n-1
calculate 12!
ReturnFact
This diagram shows the ebp1
first few stack frames 10
n-2
created by recursive calls ReturnFact
to Factorial ebp2

Each recursive call uses 9

n-3
12 bytes of stack space. ReturnFact
ebp3
(etc...)

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 27

 Summary
• Stack parameters
• more convenient than register parameters
• passed by value or reference
• ENTER and LEAVE instructions
• Local variables
• created on the stack below stack pointer
• LOCAL directive
• Recursive procedure calls itself

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 28

 53 68 75 72 79 6F

Irvine, Kip R. Assembly Language for x86 Processors 7/e, 2014. 29