2

I'm trying to learn assembly and have found that I keep getting segfaults when trying to push/pop data off of the stack. I've read a few guides and know how the stack works and how to work with the stack; but don't know why I keep getting the error.

Can someone help?

segment .data
        myvar: db "hello world", 0xA0, 0
        myvarL: equ $-myvar

segment .text
        global _start

_start:
        push ebp
        mov ebp, esp
        push myvarL
        push myvar
        call _hworld

        mov eax, 1
        mov ebx, 0
        int 0x80

_hworld:
        mov eax, 4
        mov ebx, 1
        mov ecx, [ebp+4]
        mov edx, [ebp+8]
        pop ebp
        int 0x80
        ret

I'm assuming that the +4 is 32 bits, then +8 is 64 bits. It isn't really clear to me why this way is being done on some of the guides I've read. I would assume that myvar is 13 bytes?

This is error:

$ ./pushpop 
Segmentation fault
2
  • 2
    Are you absolutely sure you first call _hworld and then run it again? i.e. where's the exit() of your program? Oct 14, 2012 at 16:55
  • The 4/8 thing is probably due to stack alignment. I think I'm right in saying that generally speaking, the stack pointer stays aligned to the machine word-length. So will only move in 32 or 64 bit chunks.
    – lynks
    Oct 14, 2012 at 16:57

3 Answers 3

0

Just a thought

segment .data
    myvar: db "hello world", 0xA0, 0
    myvarL: equ $-myvar
segment .text
    global _start
_start:
    push ebp
    mov ebp, esp
    push myvarL
    push myvar
    call _hworld
    pop  ebp          // 
 //
    mov eax,1
    mov ebx,0
    int 80h  ; // exit

_hworld:
    mov eax, 4
    mov ebx, 1
    mov ecx, [ebp+4]
    mov edx, [ebp+8]
//  pop ebp               <-- this will pop the return address
    int 0x80
    ret
1
  • That's not it. Or that's just a part of it. ebp+4/8 points up the stack, to the return address and parameters of _start. ebp-4/8 ponts down the stack, to the pushed myvarL and myvar. Oct 14, 2012 at 17:03
0
_start:
        push ebp
        mov ebp, esp ; ebp points to its old value on the stack
                     ; ebp + 4 points to the return address from _start
                     ; ebp + 8 points to 1st on-stack parameter to _start

        push myvarL ; ebp - 4 points to myvarL on stack
        push myvar ; ebp - 8 points to myvar on stack
        call _hworld

;       are we going to now execute _hworld without a call???
;       vvvv

_hworld:
        mov eax, 4
        mov ebx, 1
        mov ecx, [ebp+4] ; ebp + 4 points to return address from _start
        mov edx, [ebp+8] ; ebp + 8 points to 1st on-stack parameter to _start
;                  ^^^^ why???

Btw, I'm not sure the colon is right in here: myvarL: equ $-myvar, unless, of course, push myvarL turns out to be push 13.

Oh, and this line:

        pop ebp

is going to steal the return address from _hworld, so the following ret will fetch myvar from the stack as the return address and try to execute myvar as code.

2
  • Yes, the pop ebp would pop the return address Oct 14, 2012 at 17:05
  • Yeah, lose the pop ebp and it should work. You'll still have some cruft on the stack, but sys_exit shouldn't care. Use [esp + 4] etc. to find your parameters. Oct 14, 2012 at 17:33
0

The reason why my code was segfaulting was because I was not saving esp upon entering the _hworld segment and was not restoring it upon leaving.

This is the new working code:

segment .data
    myvar: db "hello world", 0x0A, 0
    myvarL: equ $-myvar
    myvar2: db "super bad test", 0x0A, 0
    myvar2L: equ $-myvar2

segment .text
    global _start

_start:
    push myvarL ; store myvarL on the stack
    push myvar  ; store myvar on the stack
    call _hworld

    push myvar2L    ; store myvar2L on the stack
    push myvar2 ; store myvar2 on the stack
    call _hworld2

    mov eax, 1
    mov ebx, 0
    int 0x80

_hworld:
    push ebp    ; store the current value of ebp on the stack (hence +8)
    mov ebp, esp    ; store current esp in ebp

    mov eax, 4
    mov ebx, 1
    mov ecx, [ebp+8]    ; +4 is old ebp
    mov edx, [ebp+12]
    int 0x80

    mov esp, ebp    ; restore ebp to esp
    pop ebp     ; restore ebp
    ret

_hworld2:
    push ebp    ; store old ebp on the stack
    mov ebp, esp    ; store esp in ebp

    mov eax, 4
    mov ebx, 1
    mov ecx, [ebp +8]   ; +4 is old ebp
    mov edx, [ebp +12]
    int 0x80

    mov esp, ebp    ; restore ebp to esp
    pop ebp     ; restore ebp
    ret
1
  • You seem to leave the variables myvarXX into the stack. Oct 15, 2012 at 3:22

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.