Data assembly on the stack

The stack is a memory space in which any data can be stored. The stack can be accessed using the stack pointer register (for 32-bit address space, the ESP register is used). Let's consider the example of the following code snippet:

push 0
push 21646c72h
push 6f57206fh
push 6c6c6548h
mov eax, esp
push 74h
push 6B636150h
mov edx, esp
push 0
push eax
push edx
push 0
mov eax, <user32.MessageBoxA>
call eax

This will eventually display the following message box:

How did that happen when no visible text strings were referenced? Before calling for the MessageBoxA function, the stack would look like this:

These push instructions assembled the null terminated message text at the stack.

push 0
push 21646c72h
push 6f57206fh
push 6c6c6548h

While the other string was assembled with these push instructions:

push 74h
push 6B636150h

In effect, the stack dump would look like this.

Every after string assembly, the value of register ESP is stored in EAX and then EDX.  That is, EAX points to the address of the first string.  EDX points to the address of the second assembled string.

MessageBoxA accepts four parameters.  The second parameter is the message text and the third is the caption text.  From the stack dump shown above, the strings are located at  addresses 0x22FE50 and 0x22FE54.  

push 0
push eax
push edx
push 0
mov eax, <user32.MessageBoxA>

MessageBoxA has all the parameters it requires. Even though the strings were assembled at the stack, as long as data is accessible, it can be used.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.144.193.129