两个重要指针:

The ESP (Extended Stack Pointer) holds the top stack address. 指向栈顶 EBP (Extended Base Pointer) is used for this purpose. 指向栈帧

As an example in Windows/Intel, typically, when the function call takes place, data elements are stored on the stack in the following way:

  1. The function parameters are pushed on the stack before the function is called.  The parameters are pushed from right to left.

  2. The function return address is placed on the stack by the x86 CALL instruction, which stores the current value of the EIP register.

  3. Then, the frame pointer that is the previous value of the EBP register is placed on the stack.

  4. If a function includes try/catch or any other exception handling construct such as SEH (Structured Exception Handling - Microsoft implementation), the compiler will include exception handling information on the stack.

  5. Next, the locally declared variables.

  6. Then the buffers are allocated for temporary data storage.

  7. Finally, the callee save registers such as ESI, EDI, and EBX are stored if they are used at any point during the functions execution.  For Linux/Intel, this step comes after step no. 4.

the stack grows downwards in memory as it gets bigger,栈向低内存地址增长,栈越大,栈顶地址越小。

Reference

  1. https://www.tenouk.com/Bufferoverflowc/Bufferoverflow2a.html