CS2422 Assembly Language and System Programming

Advanced Procedures

Department of Computer ScienceNational Tsing Hua University

CS2422 Assembly Language and System ProgrammingAssembly Language for Intel-Based Computers, 5th Edition

Chapter 8: Advanced Procedures

(c) Pearson Education, 2006-2007. All rights reserved. You may modify and copy this slide show for your personal use, or for use in the classroom, as long as this copyright statement, the author's name, and the title are not changed.

Slides prepared by the author

Revision date: June 4, 2006

Kip Irvine

3

Chapter Overview

Stack Frames Recursion .MODEL Directive INVOKE, ADDR, PROC, and PROTO Creating Multimodule Programs

4

Two Ways to Pass Parameters

Register vs. stack parameters: Register parameters require dedicating a register

to each parameter. Stack parameters are passed through run-time stack

Registers are faster than stack Ex: two ways of calling DumpMem; clearly the

second is easier to write

pushadmov esi,OFFSET arraymov ecx,LENGTHOF arraymov ebx,TYPE arraycall DumpMempopad

push OFFSET arraypush LENGTHOF arraypush TYPE arraycall DumpMem

5

How to Pass Stack Parameters?

Use stack frame (activation record) Area of run-time stack that stores everything a

procedure needs in order to run, including return address, passed parameters, saved registers, and local variables state of the procedure

Each invocation to a procedure will push the corresponding stack frame into the run-time stack different invocations (even to the same procedure) will occupy different areas of the stack

Procedure return will pop entire stack frame

Analog: mobile home

6

Contents of Stack Frame

What data are needed for the following function to run?

int AddTwo(int x, y){ int sum; sum = x + y; return sum;}

Parameters: x, yLocal variable: sumReturn addressSaved registers

xy

return addrsum

Size can be determined at assembly time

“state”

7

Accessing Stack Frame

When procedure AddTwo is called, its corresponding stack frame is pushed onto the run-time stack

How to reference the variablesin stack, i.e., x, y, sum?

?

ESP?

xy

return addrsum

ESPAddTwo PROCmov eax,xadd eax,ymov sum,eaxret

AddTwo ENDP

8

Accessing Stack Frame

Idea: use addresses relative to a base address of the stack frame in the run-time stack, which does not change during the procedure base pointer or frame pointer

Dedicate a register to hold this pointer EBP A procedure can explicitly access stack

parameters using constantoffsets from EBP, e.g. [EBP + 8]

EBP is restored to its original value when procedure returns

xy

return addrsum EBP*

[EBP+4][EBP+8]

[EBP+12]

* Exact location of frame pointer will be explained shortly

9

Preparing Stack Frame

Must be done explicitly in the ASM program: Caller procedure pushes arguments on the stack

and calls callee; the CALL instruction will push the return address on the stack

Callee procedure pushes EBP (currently holding frame point of the caller procedure) on the stack

‒ To save the EBP of the caller procedure Callee then sets EBP to ESP

‒ To let EBP point to base of its own stack frame If local variables are needed, a constant is

subtracted from ESP to make room on the stack Net results: set aside a region of memory in stack

to hold all data needed for this procedure

10

Return from Procedure

RET: pops top of stack into the instruction pointer (EIP or IP); control transfers to the target address What about stack parameters?

Syntax:RETRET n

Optional operand n causes n bytes to be added to the stack pointer after EIP (or IP) receives the popped stack

11

Stack Frame Example (1 of 2)

.datasum DWORD ?.code

push 6 ; second argumentpush 5 ; first argumentcall AddTwo ; EAX = summov sum,eax ; save the sum

AddTwo PROCpush ebpmov ebp,esp..

Return value in eax

old EBP

12

Stack Frame Example (2 of 2)

AddTwo PROCpush ebpmov ebp,esp ; base of stack framemov eax,[ebp + 12]; second argument (6)add eax,[ebp + 8] ; first argument (5)pop ebpret 8 ; clean up the stack

AddTwo ENDP ; EAX contains the sum

old EBP

13

Passing Arguments by Reference (1/2)

Consider the ArrayFill procedure, which fills an array with 16-bit random integers

Calling procedure passes address of the array, along with a count of number of array elements:

.datacount = 100array WORD count DUP(?).code

push OFFSET arraypush COUNTcall ArrayFill

...

14

Passing Arguments by Reference (2/2)

ArrayFill can reference an array without knowing the array's name:

ESI points to the beginning of the array, so it's easy to use a loop to access each array element

ArrayFill PROCpush ebpmov ebp,esppushadmov esi,[ebp+12]mov ecx,[ebp+8]...

15

Local Variables

To explicitly create local variables, subtract their total size from ESP to leave space Still part of the stack frame

Ex.: creates and initializes two 32-bit local variables (locA and locB):

MySub PROCpush ebpmov ebp,espsub esp,8 ; make spacemov DWORD PTR [ebp-4],123456h ; locAmov DWORD PTR [ebp-8],0 ; locB...

16

Clean Local Variables on Return

Before return, resets ESP by assigning it the value of EBP release local variables from the stack

MySub PROCpush ebpmov ebp,espsub esp,8mov DWORD PTR [ebp-4],123456h ; locAmov DWORD PTR [ebp-8],0 ; locBmov esp,ebppop ebp

retMySub ENDP

17

ENTER and LEAVE

ENTER directive creates stack frame for a called procedureENTER numbytes, nestinglevel pushes EBP on the stack sets EBP to the base of the stack frame reserves space for local variables

LEAVE: reverse operations

MySub PROCpush ebpmov ebp,espsub esp,8

MySub PROCenter 8,0

18

LOCAL Directive

A local variable is created, used, and destroyed within a single procedure

LOCAL directive declares a list of local variablesLOCAL varlist

immediately follows the PROC directive each variable is assigned a type

MySub PROCLOCAL var1:BYTE, var2:WORD, var3:SDWORD

19

Using LOCAL

Examples:

myProc PROC, ; procedureLOCAL t1:BYTE, ; local variables

LOCAL flagVals[20]:BYTE ; array of bytes

LOCAL pArray:PTR WORD ; pointer to an array

20

MASM-Generated Code (1/2)

BubbleSort PROCLOCAL temp:DWORD, SwapFlag:BYTE. . .ret

BubbleSort ENDP

BubbleSort PROCpush ebpmov ebp,espadd esp,0FFFFFFF8h ; add -8 to ESP. . .mov esp,ebppop ebpret

BubbleSort ENDP

21

MASM-Generated Code (2/2)

Diagram of the stack frame for BubbleSort:

22

Non-Doubleword Local Variables

Local variables can have different sizes How are their memory space allocated in the

stack by LOCAL directive? 8-bit: assigned to next available byte 16-bit: assigned to next even (word) boundary 32-bit: assigned to next doubleword boundary

23

Local Byte Variable

Example1 PROC LOCAL var1:BYTE mov al,var1 ; [EBP - 1] retExample1 ENDP

24

LEA Instruction

Return offsets of direct and indirect operands OFFSET can only return constant offsets LEA required when obtaining the offset of a stack

parameter or local variable. For example:

CopyString PROC,count:DWORD ; parameterLOCAL temp[20]:BYTE ; local variablemov edi,OFFSET count ; invalid operandmov esi,OFFSET temp ; invalid operandlea edi,count ; oklea esi,temp ; ok

void CopyString(int *count){ char temp[20];

... }

25

Review

1. (True/False): A procedure’s stack frame always contains caller’s return address and procedure’s local variables.

2. (True/False): Arrays are passed by reference to avoid copying them onto the stack.

3. (True/False): A procedure’s prologue code always pushes EBP on the stack.

4. (True/False): Local variables are created by adding an integer to the stack pointer.

5. (True/False): In 32-bit protected mode, the last parameter to be pushed on the stack in a procedure call is stored at location EBP+8.

6. (True/False): Passing by reference requires popping a parameter’s offset from the stack in the called procedure.

7. What are two common types of parameters?

26

What's Next

Stack Frames Recursion .MODEL Directive INVOKE, ADDR, PROC, and PROTO Creating Multimodule Programs

27

What is Recursion?

The process created when . . . A procedure calls itself Procedure A calls procedure B, which in turn calls

procedure A Using a graph in which each node is a procedure

and each edge is a procedure call, recursion forms a cycle:

28

Recursively Calculating a Sum

Recursively calculates sum of array of integers. Receives: ECX = count. Returns: EAX = sumCalcSum PROC

cmp ecx,0 ; check counter valuejz L2 ; quit if zeroadd eax,ecx ; otherwise, add to sumdec ecx ; decrement countercall CalcSum ; recursive call

L2: retCalcSum ENDP

Stack frame:

29

Calculating a Factorial (1/3)

This function calculates the factorial of integer n. A new value of n is saved in each stack frame:

int factorial(int n) { if(n == 0) return 1; else return n*factorial(n-1);}

5! = 5 * 4!

4! = 4 * 3!

3! = 3 * 2!

2! = 2 * 1!

1! = 1 * 0!

0! = 1

(base case)

1 * 1 = 1

2 * 1 = 2

3 * 2 = 6

4 * 6 = 24

5 * 24 = 120

1 = 1

recursive calls backing up

30

Calculating a Factorial (2/3)

Factorial PROCpush ebpmov ebp,espmov eax,[ebp+8] ; get ncmp eax,0 ; n < 0?ja L1 ; yes: continuemov eax,1 ; no: return 1jmp L2

L1: dec eaxpush eax ; Factorial(n-1)call Factorial

; Instructions from this point on execute when; each recursive call returns.

ReturnFact:mov ebx,[ebp+8] ; get nmul ebx ; eax = eax * ebx

L2: pop ebp ; return EAXret 4 ; clean up stack

Factorial ENDP

31

Calculating a Factorial (3/3)

Suppose we want to calculate 12!

This diagram shows the first few stack frames created by recursive calls to Factorial

Each recursive call uses 12 bytes of stack space.

32

What's Next

Stack Frames Recursion .MODEL Directive INVOKE, ADDR, PROC, and PROTO Creating Multimodule Programs

33

INVOKE Directive The INVOKE directive is a powerful replacement

for Intel’s CALL instruction that lets you pass multiple arguments

Syntax:INVOKE procedureName [, argumentList]

Arguments can be: immediate values and integer expressions variable names address and ADDR expressions register names

34

INVOKE Examples

.databyteVal BYTE 10wordVal WORD 1000h.code

; direct operands:INVOKE Sub1,byteVal,wordVal

; address of variable:INVOKE Sub2,ADDR byteVal

; register name, integer expression:INVOKE Sub3,eax,(10 * 20)

; address expression (indirect operand):INVOKE Sub4,[ebx]

35

ADDR Operator

Returns a near or far pointer to a variable, depending on which memory model your program uses: Small model: returns 16-bit offset Large model: returns 32-bit segment/offset Flat model: returns 32-bit offset

Simple example:

.datamyWord WORD ?.codeINVOKE mySub,ADDR myWord

36

PROC Directive (1/2)

The PROC directive declares a procedure with an optional list of parameters.

Syntax:label PROC paramList

paramList is a list of parameters separated by commas. Each parameter has the following syntax:

paramName:type type must either be one of the standard ASM

types (BYTE, SBYTE, WORD, etc.), or it can be a pointer to one of these types.

37

PROC Directive (2/2)

Alternate format permits parameter list to be on one or more separate lines:label PROC,paramList

The parameters can be on the same line . . .param-1:type-1, param-2:type-2, ...

Or they can be on separate lines:param-1:type-1, param-2:type-2,. . ., param-n:type-n

comma required

38

Sanity Check #1

Remember that PROC and INVOKE are directives, not instructions.

(i.e., CPU does not understand it.)

39

PROC Examples (1/2)

The AddTwo procedure receives two integers and returns their sum in EAX

C++ programs typically return 32-bit integers from functions in EAX

AddTwo PROC,val1:DWORD, val2:DWORD

mov eax,val1add eax,val2ret

AddTwo ENDP

40

PROC Examples (2/2)

FillArray receives a pointer to an array of bytes, a single byte fill value that will be copied to each element of the array, and the size of the array.

FillArray PROC,pArray:PTR BYTE, fillVal:BYTEarraySize:DWORDmov ecx,arraySizemov esi,pArraymov al,fillVal

L1:mov [esi],alinc esiloop L1ret

FillArray ENDP

41

PROTO Directive

Creates a procedure prototype Syntax:

label PROTO paramList Every procedure called by the INVOKE directive

must have a prototype A complete procedure definition can also serve

as its own prototype Example: Prototype for the ArraySum procedure,

showing its parameter list

ArraySum PROTO,ptrArray:PTR DWORD,szArray:DWORD

42

PROTO Directive

Standard configuration: PROTO appears at top of the program listing,

INVOKE appears in the code segment, and the procedure implementation occurs later in the program:

MySub PROTO ; procedure prototype

.codeINVOKE MySub ; procedure call

MySub PROC ; procedure implementation..

MySub ENDP

43

Sanity Check #2

So, PROC and INVOKE are directives, not instruction.

How does MASM handle the parameters?

44

Passing by Value

When a procedure argument is passed by value, a copy of a 16-bit or 32-bit integer is pushed on the stack. Example:

MASM generates the following code:

.datamyData WORD 1000h.codemain PROC

INVOKE Sub1, myData

push myDatacall Sub1

45

Passing by Reference

When an argument is passed by reference, its address is pushed on the stack. Example:

MASM generates the following code:

.datamyData WORD 1000h.codemain PROC

INVOKE Sub1, ADDR myData

push OFFSET myDatacall Sub1

46

Example: Exchanging Two Integers

Swap procedure exchanges the values of two 32-bit integers. pValX and pValY do not change values, but the integers they point to are modified.Swap PROC USES eax esi edi,pValX:PTR DWORD, ; pointer to 1st intpValY:PTR DWORD ; pointer to 2nd intmov esi,pValX ; get pointersmov edi,pValYmov eax,[esi] ; get first integerxchg eax,[edi] ; exchange with secondmov [esi],eax ; replace first integerret

Swap ENDP

47

Example: Exchanging Two Integers

Will the following work?

A DWORD 10B DWROD 20INVOKE Swap A, BINVOKE Swap ADDR A, ADDR B ;for previous slide

Swap PROC USES eax esi edi,X:DWORD,Y:DWORD

mov eax, X ; get first integerxchg eax, Y ; exchange with secondmov X,eax ; replace first integerret

Swap ENDP

48

Trouble-Shooting Tips

Save and restore registers when they are modified by a procedure. Except a register that returns a function result

When using INVOKE, be careful to pass a pointer to the correct data type. For example, MASM cannot distinguish between a

DWORD argument and a PTR BYTE argument. Do not pass an immediate value to a procedure

that expects a reference parameter. Dereferencing its address will likely cause a

general-protection fault.

49

Summary

Stack parameters more convenient than register parameters passed by value or reference ENTER and LEAVE instructions

Local variables created on the stack below stack pointer LOCAL directive

Recursive procedure calls itself MASM procedure-related directives

INVOKE, PROC, PROTO