1

I'm very very new to assembly so please bear with me.
I have this code that passes a value by reference to a function in order to modify it :

[MethodImpl(MethodImplOptions.NoOptimization | MethodImplOptions.NoInlining)]
static void Main()
{
    int a = 5 ;
    Modify(ref a); 
    Console.WriteLine(a); 
    
                      
}
[MethodImpl(MethodImplOptions.NoOptimization | MethodImplOptions.NoInlining)]
static void Modify (ref int a )
{
 
    a = 77 ; 
}

the generated assembly fot that code is

Program.Main()
L0000: push ebp
L0001: mov ebp, esp
L0003: push eax
L0004: xor eax, eax
L0006: mov [ebp-4], eax   ******* (the confusing part 1 )
L0009: mov dword ptr [ebp-4], 5  
L0010: lea ecx, [ebp-4]
L0013: call dword ptr [0xa9dc6ac]
L0019: mov ecx, [ebp-4]
L001c: call System.Console.WriteLine(Int32)
L0021: mov esp, ebp
L0023: pop ebp
L0024: ret

my question is : in the instruction L0006 : mov [ebp-4], eax this will copy the value of the register eax into the memory location pointed to by Ebp-4 but Ebp-4 does not point to anything ? what I'm missing ?

5
  • Strictly speaking, Modify doesn't need to pass a pointer to work correctly. It needs to receive in the current value and return the output value. Which it does. The fact that it doesn't use pointers is an implementation detail. Commented Feb 21, 2022 at 9:21
  • 1
    The weird part here is that the very next instruction after mov [ebp-4], eax overwrites the same memory location with a constant 5, so the previous store is dead. I hope this is un-optimized assembly. The actual setup of the function arg is lea ecx, [ebp-4], passing the address of that stack variable in the first arg-passing register, ECX. (For fastcall, which I assume this must be using otherwise the LEA makes no sense.) Commented Feb 21, 2022 at 9:22
  • @PeterCordes , what the initial value of Ebp-4 ? does it hold an address of a memory location or the date itseld ?
    – CSharp-n
    Commented Feb 21, 2022 at 10:10
  • The compiler is allocating stack space for a by pushing eax: that stack space is located at ebp-4. Then it does a=0 as a standard initializer then a=5; as your code. Next it passes the value &a, which is computed by ebp-4 to Modify by ref in ecx, and later retrieves the value of a to pass to WriteLine by value.
    – Erik Eidt
    Commented Feb 21, 2022 at 19:29
  • "what the initial value of Ebp-4" ebp-4 is an address, the address of a. We don't know the value of this address, but that it is on somewhere near the top of the stack. Stored at that address, is the variable a, which holds (1st) garbage, (2nd) 0, (3rd) 5, and (4th) presumably 77.
    – Erik Eidt
    Commented Feb 21, 2022 at 19:30

1 Answer 1

5

Posting the unoptimized assembly makes things more confusing, but basically, the lines,

push ebp
mov ebp, esp

makes ebp point to near the top of this function's stack frame. (i.e. set up EBP as a frame pointer).

At function entry [esp] has the return address. Any push will first decrement esp by 4 (assuming a 32-bit environment) and store the value at the new [esp]. With push ebp, [esp] (decremented by 4) stores the old value of ebp, and mov ebp, esp makes ebp = esp.

   push eax

This instruction just just a compact way to do sub esp, 4 to reserve stack space for one dword (int) sized local variable. Before this, ESP = EBP, so the new space is at address ebp-4, whatever that happens to be at run-time.

xor eax, eax                    ; eax = 0
mov [ebp-4], eax                ; store EAX, possibly to zero-init   int a ?
mov dword ptr [ebp-4], 5

You can ignore the first two lines. It's there because you decided to turn off optimization, which often makes things more confusing. The final line mov dword ptr [ebp-4], 5 overwrites the value written by mov [ebp-4], eax.

You cannot write mov dword ptr [ebp], 5 because [ebp] is storing the old value of ebp as I mentioned earlier.

The function call takes its arg in ECX, as per the fastcall calling convention. This register is loaded with a pointer to [ebp-4] using an LEA instruction:

lea ecx, [ebp-4]          ; ECX = ebp-4.   (Not [ebp-4], it's not a load)

In C terms, it's exactly like &a, the address of the local variable. LEA calculates the address, but then puts that in the destination register instead of using it to load from memory.

Notice that after that first function call returns, that memory is reloaded:

mov ecx, [ebp-4]         ; load a  as the arg for the next function call
call System.Console.WriteLine(Int32)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.