0

So if I would have something like this

rout:
pop eax
pop ecx
add ecx,2
push ecx
ret

Then just

push 3
call rout

I've noticed that the first time to pop isn't going to give me the value 3 as I thought it would, instead I get it after the first pop.

My question is, what is the last value pushed to the stack while I'm calling it? (In register eax in this example)

1 Answer 1

1

Assuming your are working with 80x86 architecture:

It's the return address of the proc (if its a near call). The next POP would give you your value (3) if it was a NEAR call, or the segment of the return address in case it was a FAR call.

Check this site for pseudocode of what actually happens when you issue a CALL.

Sign up to request clarification or add additional context in comments.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.