32-bit · Intel syntax · watch ESP, EBP and EIP move
A part of memory that works like a pile of plates: you only add (push) or remove (pop) at the top. Last in, first out.
On x86 the top of the stack has the lowest address. push makes ESP smaller, pop makes it bigger. In the view, the newest value is at the bottom, next to the ESP arrow.
ESP points at the top of the stack.
EBP is the fixed anchor of the current function.
EIP is the address of the next instruction.
call f pushes the return address (where to come back) and jumps to f. ret pops it and jumps back. Overwrite it and the program goes somewhere else!
higher addresses [ebp+12] argument #2 [ebp+8] argument #1 [ebp+4] return address [ebp] saved EBP ◀ EBP [ebp-4] local variable [ebp-8] local variable ◀ ESP lower addresses
Pick an example, press Step ▶ and read What just happened. ◀ Back undoes a step. Hover over anything for a hint.
Run single instructions by hand. EIP is not advanced.
push x | ESP −= 4; [ESP] = x |
pop r | r = [ESP]; ESP += 4 |
call f | push next EIP; jmp f |
ret [n] | pop EIP; ESP += n |
leave | mov esp, ebp; pop ebp |
jmp l | EIP = l |
je jne jl jg jle jge jb ja jbe jae js jns (+ aliases) | conditional jumps |
hlt, nop | stop / do nothing |
mov d, s | d = s |
lea r, [addr] | r = address (no memory read) |
add sub and or xor | d = d op s, sets flags |
cmp test | sub / and, flags only |
inc dec neg not | unary |
shl shr sar | shifts (imm or cl) |
imul r, s [, imm] | signed multiply |
xchg a, b | swap |
eax ebx ecx edx esi edi ebp esp, bytes al ah bl …42, -8, 0x1f, 1fh, 0b101, 'A'[ebp-8], [esp+4], [eax+ecx*4+8]dword [ebp-4] / byte ptr [edi] (default dword)name:, local .loop:; execution starts at main; or #