CS2422 Assembly Language and System Programming Advanced Procedures Department of Computer Science National Tsing Hua University
Dec 19, 2015
CS2422 Assembly Language and System Programming
Advanced Procedures
Department of Computer ScienceNational Tsing Hua University
CS2422 Assembly Language and System ProgrammingAssembly Language for Intel-Based Computers, 5th Edition
Chapter 8: Advanced Procedures
(c) Pearson Education, 2006-2007. All rights reserved. You may modify and copy this slide show for your personal use, or for use in the classroom, as long as this copyright statement, the author's name, and the title are not changed.
Slides prepared by the author
Revision date: June 4, 2006
Kip Irvine
3
Chapter Overview
Stack Frames Recursion .MODEL Directive INVOKE, ADDR, PROC, and PROTO Creating Multimodule Programs
4
Two Ways to Pass Parameters
Register vs. stack parameters: Register parameters require dedicating a register
to each parameter. Stack parameters are passed through run-time stack
Registers are faster than stack Ex: two ways of calling DumpMem; clearly the
second is easier to write
pushadmov esi,OFFSET arraymov ecx,LENGTHOF arraymov ebx,TYPE arraycall DumpMempopad
push OFFSET arraypush LENGTHOF arraypush TYPE arraycall DumpMem
5
How to Pass Stack Parameters?
Use stack frame (activation record) Area of run-time stack that stores everything a
procedure needs in order to run, including return address, passed parameters, saved registers, and local variables state of the procedure
Each invocation to a procedure will push the corresponding stack frame into the run-time stack different invocations (even to the same procedure) will occupy different areas of the stack
Procedure return will pop entire stack frame
Analog: mobile home
6
Contents of Stack Frame
What data are needed for the following function to run?
int AddTwo(int x, y){ int sum; sum = x + y; return sum;}
Parameters: x, yLocal variable: sumReturn addressSaved registers
xy
return addrsum
Size can be determined at assembly time
“state”
7
Accessing Stack Frame
When procedure AddTwo is called, its corresponding stack frame is pushed onto the run-time stack
How to reference the variablesin stack, i.e., x, y, sum?
?
ESP?
xy
return addrsum
ESPAddTwo PROCmov eax,xadd eax,ymov sum,eaxret
AddTwo ENDP
8
Accessing Stack Frame
Idea: use addresses relative to a base address of the stack frame in the run-time stack, which does not change during the procedure base pointer or frame pointer
Dedicate a register to hold this pointer EBP A procedure can explicitly access stack
parameters using constantoffsets from EBP, e.g. [EBP + 8]
EBP is restored to its original value when procedure returns
xy
return addrsum EBP*
[EBP+4][EBP+8]
[EBP+12]
* Exact location of frame pointer will be explained shortly
9
Preparing Stack Frame
Must be done explicitly in the ASM program: Caller procedure pushes arguments on the stack
and calls callee; the CALL instruction will push the return address on the stack
Callee procedure pushes EBP (currently holding frame point of the caller procedure) on the stack
‒ To save the EBP of the caller procedure Callee then sets EBP to ESP
‒ To let EBP point to base of its own stack frame If local variables are needed, a constant is
subtracted from ESP to make room on the stack Net results: set aside a region of memory in stack
to hold all data needed for this procedure
10
Return from Procedure
RET: pops top of stack into the instruction pointer (EIP or IP); control transfers to the target address What about stack parameters?
Syntax:RETRET n
Optional operand n causes n bytes to be added to the stack pointer after EIP (or IP) receives the popped stack
11
Stack Frame Example (1 of 2)
.datasum DWORD ?.code
push 6 ; second argumentpush 5 ; first argumentcall AddTwo ; EAX = summov sum,eax ; save the sum
AddTwo PROCpush ebpmov ebp,esp..
Return value in eax
old EBP
12
Stack Frame Example (2 of 2)
AddTwo PROCpush ebpmov ebp,esp ; base of stack framemov eax,[ebp + 12]; second argument (6)add eax,[ebp + 8] ; first argument (5)pop ebpret 8 ; clean up the stack
AddTwo ENDP ; EAX contains the sum
old EBP
13
Passing Arguments by Reference (1/2)
Consider the ArrayFill procedure, which fills an array with 16-bit random integers
Calling procedure passes address of the array, along with a count of number of array elements:
.datacount = 100array WORD count DUP(?).code
push OFFSET arraypush COUNTcall ArrayFill
...
14
Passing Arguments by Reference (2/2)
ArrayFill can reference an array without knowing the array's name:
ESI points to the beginning of the array, so it's easy to use a loop to access each array element
ArrayFill PROCpush ebpmov ebp,esppushadmov esi,[ebp+12]mov ecx,[ebp+8]...
15
Local Variables
To explicitly create local variables, subtract their total size from ESP to leave space Still part of the stack frame
Ex.: creates and initializes two 32-bit local variables (locA and locB):
MySub PROCpush ebpmov ebp,espsub esp,8 ; make spacemov DWORD PTR [ebp-4],123456h ; locAmov DWORD PTR [ebp-8],0 ; locB...
16
Clean Local Variables on Return
Before return, resets ESP by assigning it the value of EBP release local variables from the stack
MySub PROCpush ebpmov ebp,espsub esp,8mov DWORD PTR [ebp-4],123456h ; locAmov DWORD PTR [ebp-8],0 ; locBmov esp,ebppop ebp
retMySub ENDP
17
ENTER and LEAVE
ENTER directive creates stack frame for a called procedureENTER numbytes, nestinglevel pushes EBP on the stack sets EBP to the base of the stack frame reserves space for local variables
LEAVE: reverse operations
MySub PROCpush ebpmov ebp,espsub esp,8
MySub PROCenter 8,0
18
LOCAL Directive
A local variable is created, used, and destroyed within a single procedure
LOCAL directive declares a list of local variablesLOCAL varlist
immediately follows the PROC directive each variable is assigned a type
MySub PROCLOCAL var1:BYTE, var2:WORD, var3:SDWORD
19
Using LOCAL
Examples:
myProc PROC, ; procedureLOCAL t1:BYTE, ; local variables
LOCAL flagVals[20]:BYTE ; array of bytes
LOCAL pArray:PTR WORD ; pointer to an array
20
MASM-Generated Code (1/2)
BubbleSort PROCLOCAL temp:DWORD, SwapFlag:BYTE. . .ret
BubbleSort ENDP
BubbleSort PROCpush ebpmov ebp,espadd esp,0FFFFFFF8h ; add -8 to ESP. . .mov esp,ebppop ebpret
BubbleSort ENDP
21
MASM-Generated Code (2/2)
Diagram of the stack frame for BubbleSort:
22
Non-Doubleword Local Variables
Local variables can have different sizes How are their memory space allocated in the
stack by LOCAL directive? 8-bit: assigned to next available byte 16-bit: assigned to next even (word) boundary 32-bit: assigned to next doubleword boundary
23
Local Byte Variable
Example1 PROC LOCAL var1:BYTE mov al,var1 ; [EBP - 1] retExample1 ENDP
24
LEA Instruction
Return offsets of direct and indirect operands OFFSET can only return constant offsets LEA required when obtaining the offset of a stack
parameter or local variable. For example:
CopyString PROC,count:DWORD ; parameterLOCAL temp[20]:BYTE ; local variablemov edi,OFFSET count ; invalid operandmov esi,OFFSET temp ; invalid operandlea edi,count ; oklea esi,temp ; ok
void CopyString(int *count){ char temp[20];
... }
25
Review
1. (True/False): A procedure’s stack frame always contains caller’s return address and procedure’s local variables.
2. (True/False): Arrays are passed by reference to avoid copying them onto the stack.
3. (True/False): A procedure’s prologue code always pushes EBP on the stack.
4. (True/False): Local variables are created by adding an integer to the stack pointer.
5. (True/False): In 32-bit protected mode, the last parameter to be pushed on the stack in a procedure call is stored at location EBP+8.
6. (True/False): Passing by reference requires popping a parameter’s offset from the stack in the called procedure.
7. What are two common types of parameters?
26
What's Next
Stack Frames Recursion .MODEL Directive INVOKE, ADDR, PROC, and PROTO Creating Multimodule Programs
27
What is Recursion?
The process created when . . . A procedure calls itself Procedure A calls procedure B, which in turn calls
procedure A Using a graph in which each node is a procedure
and each edge is a procedure call, recursion forms a cycle:
28
Recursively Calculating a Sum
Recursively calculates sum of array of integers. Receives: ECX = count. Returns: EAX = sumCalcSum PROC
cmp ecx,0 ; check counter valuejz L2 ; quit if zeroadd eax,ecx ; otherwise, add to sumdec ecx ; decrement countercall CalcSum ; recursive call
L2: retCalcSum ENDP
Stack frame:
29
Calculating a Factorial (1/3)
This function calculates the factorial of integer n. A new value of n is saved in each stack frame:
int factorial(int n) { if(n == 0) return 1; else return n*factorial(n-1);}
5! = 5 * 4!
4! = 4 * 3!
3! = 3 * 2!
2! = 2 * 1!
1! = 1 * 0!
0! = 1
(base case)
1 * 1 = 1
2 * 1 = 2
3 * 2 = 6
4 * 6 = 24
5 * 24 = 120
1 = 1
recursive calls backing up
30
Calculating a Factorial (2/3)
Factorial PROCpush ebpmov ebp,espmov eax,[ebp+8] ; get ncmp eax,0 ; n < 0?ja L1 ; yes: continuemov eax,1 ; no: return 1jmp L2
L1: dec eaxpush eax ; Factorial(n-1)call Factorial
; Instructions from this point on execute when; each recursive call returns.
ReturnFact:mov ebx,[ebp+8] ; get nmul ebx ; eax = eax * ebx
L2: pop ebp ; return EAXret 4 ; clean up stack
Factorial ENDP
31
Calculating a Factorial (3/3)
Suppose we want to calculate 12!
This diagram shows the first few stack frames created by recursive calls to Factorial
Each recursive call uses 12 bytes of stack space.
32
What's Next
Stack Frames Recursion .MODEL Directive INVOKE, ADDR, PROC, and PROTO Creating Multimodule Programs
33
INVOKE Directive The INVOKE directive is a powerful replacement
for Intel’s CALL instruction that lets you pass multiple arguments
Syntax:INVOKE procedureName [, argumentList]
Arguments can be: immediate values and integer expressions variable names address and ADDR expressions register names
34
INVOKE Examples
.databyteVal BYTE 10wordVal WORD 1000h.code
; direct operands:INVOKE Sub1,byteVal,wordVal
; address of variable:INVOKE Sub2,ADDR byteVal
; register name, integer expression:INVOKE Sub3,eax,(10 * 20)
; address expression (indirect operand):INVOKE Sub4,[ebx]
35
ADDR Operator
Returns a near or far pointer to a variable, depending on which memory model your program uses: Small model: returns 16-bit offset Large model: returns 32-bit segment/offset Flat model: returns 32-bit offset
Simple example:
.datamyWord WORD ?.codeINVOKE mySub,ADDR myWord
36
PROC Directive (1/2)
The PROC directive declares a procedure with an optional list of parameters.
Syntax:label PROC paramList
paramList is a list of parameters separated by commas. Each parameter has the following syntax:
paramName:type type must either be one of the standard ASM
types (BYTE, SBYTE, WORD, etc.), or it can be a pointer to one of these types.
37
PROC Directive (2/2)
Alternate format permits parameter list to be on one or more separate lines:label PROC,paramList
The parameters can be on the same line . . .param-1:type-1, param-2:type-2, ...
Or they can be on separate lines:param-1:type-1, param-2:type-2,. . ., param-n:type-n
comma required
38
Sanity Check #1
Remember that PROC and INVOKE are directives, not instructions.
(i.e., CPU does not understand it.)
39
PROC Examples (1/2)
The AddTwo procedure receives two integers and returns their sum in EAX
C++ programs typically return 32-bit integers from functions in EAX
AddTwo PROC,val1:DWORD, val2:DWORD
mov eax,val1add eax,val2ret
AddTwo ENDP
40
PROC Examples (2/2)
FillArray receives a pointer to an array of bytes, a single byte fill value that will be copied to each element of the array, and the size of the array.
FillArray PROC,pArray:PTR BYTE, fillVal:BYTEarraySize:DWORDmov ecx,arraySizemov esi,pArraymov al,fillVal
L1:mov [esi],alinc esiloop L1ret
FillArray ENDP
41
PROTO Directive
Creates a procedure prototype Syntax:
label PROTO paramList Every procedure called by the INVOKE directive
must have a prototype A complete procedure definition can also serve
as its own prototype Example: Prototype for the ArraySum procedure,
showing its parameter list
ArraySum PROTO,ptrArray:PTR DWORD,szArray:DWORD
42
PROTO Directive
Standard configuration: PROTO appears at top of the program listing,
INVOKE appears in the code segment, and the procedure implementation occurs later in the program:
MySub PROTO ; procedure prototype
.codeINVOKE MySub ; procedure call
MySub PROC ; procedure implementation..
MySub ENDP
43
Sanity Check #2
So, PROC and INVOKE are directives, not instruction.
How does MASM handle the parameters?
44
Passing by Value
When a procedure argument is passed by value, a copy of a 16-bit or 32-bit integer is pushed on the stack. Example:
MASM generates the following code:
.datamyData WORD 1000h.codemain PROC
INVOKE Sub1, myData
push myDatacall Sub1
45
Passing by Reference
When an argument is passed by reference, its address is pushed on the stack. Example:
MASM generates the following code:
.datamyData WORD 1000h.codemain PROC
INVOKE Sub1, ADDR myData
push OFFSET myDatacall Sub1
46
Example: Exchanging Two Integers
Swap procedure exchanges the values of two 32-bit integers. pValX and pValY do not change values, but the integers they point to are modified.Swap PROC USES eax esi edi,pValX:PTR DWORD, ; pointer to 1st intpValY:PTR DWORD ; pointer to 2nd intmov esi,pValX ; get pointersmov edi,pValYmov eax,[esi] ; get first integerxchg eax,[edi] ; exchange with secondmov [esi],eax ; replace first integerret
Swap ENDP
47
Example: Exchanging Two Integers
Will the following work?
A DWORD 10B DWROD 20INVOKE Swap A, BINVOKE Swap ADDR A, ADDR B ;for previous slide
Swap PROC USES eax esi edi,X:DWORD,Y:DWORD
mov eax, X ; get first integerxchg eax, Y ; exchange with secondmov X,eax ; replace first integerret
Swap ENDP
48
Trouble-Shooting Tips
Save and restore registers when they are modified by a procedure. Except a register that returns a function result
When using INVOKE, be careful to pass a pointer to the correct data type. For example, MASM cannot distinguish between a
DWORD argument and a PTR BYTE argument. Do not pass an immediate value to a procedure
that expects a reference parameter. Dereferencing its address will likely cause a
general-protection fault.
49
Summary
Stack parameters more convenient than register parameters passed by value or reference ENTER and LEAVE instructions
Local variables created on the stack below stack pointer LOCAL directive
Recursive procedure calls itself MASM procedure-related directives
INVOKE, PROC, PROTO