Data assembly on the stack
The stack is a memory space in which any data can be stored. The stack can be accessed using the stack pointer register (for 32-bit address space, the ESP register is used). Let's consider the example of the following code snippet:
push 0 push 21646c72h push 6f57206fh push 6c6c6548h mov eax, esp push 74h push 6B636150h mov edx, esp push 0 push eax push edx push 0 mov eax, <user32.MessageBoxA> call eax
This will eventually display the following message box:
![](https://static.packt-cdn.com/products/9781788838849/graphics/43552fd4-a62f-4ba2-a225-b87af2257abd.png)
How did that happen when no visible text strings were referenced? Before calling for the MessageBoxA
function, the stack would look like this:
![](https://static.packt-cdn.com/products/9781788838849/graphics/04c4496d-55dd-44ba-b831-6ffa608af6cf.png)
These push instructions assembled the null terminated message text at the stack.
push 0 push 21646c72h push 6f57206fh push 6c6c6548h
While the other string was assembled with these push instructions:
push 74h push 6B636150h
In effect, the stack dump would look like this.
![](https://static.packt-cdn.com/products/9781788838849/graphics/bf17a084-2157-4f34-b4ef-683b33ac7dd0.png)
Every after string assembly, the value of register ESP is stored in EAX and then EDX. That is, EAX points...