L05 · Little-Endian, the Registers eip/ebp/esp, and Push/Pop

Discussion prompt

Before we open L05 · Little-Endian, the Registers eip/ebp/esp, and Push/Pop: without looking back, what was the main idea of L04 · Numbers, the Toolchain, and 32-bit C Memory Layout, and what could you do by the end of it that you could not do before?

Hint: One sentence for the idea, one for the skill. If the second one is blank, that is the part to revisit.

Sort into buckets

Sort these by Significance, from memory, without looking back at Least-significant byte at the lowest address. Telling them apart on the spot is the skill; the table is only where the answer happens to be written down.

least

0x1000

—

0x1001; 0x1002

most

0x1003

g1

Significance is "least" for 0x1000 — that is what the table on "Least-significant byte at the lowest…" records, and it is the single property separating this group from the rest.

g2

Significance is "—" for 0x1001, 0x1002 — that is what the table on "Least-significant byte at the lowest…" records, and it is the single property separating this group from the rest.

g3

Significance is "most" for 0x1003 — that is what the table on "Least-significant byte at the lowest…" records, and it is the single property separating this group from the rest.

Discussion prompt

Bytes are physically little-endian, but on stack diagrams we usually write the whole word 0x44332211 in one 4-byte row to stay readable — the little-endianness is abstracted away.

That is stated as though it always holds. Do one of two things: produce a case where it fails, or say precisely what rules such a case out. "It just does" is not on the menu.

Hint: Hunt at the extremes first — zero, one, negative, empty, equal. If every extreme survives, the reason they survive is the proof.

Put in order

Put the moves of Read a little-endian value from a dump into the order they have to happen.

1. Lowest address is the least-significant byte
2. Assemble most-significant first to read the word
3. Verify by storing it back

Why: These are the moves of the worked example in the order it makes them, and each one is set up by the one before it. 0xEF is at the lowest address, so it is the LSB; 0xDE at the highest is the MSB.

Comparison matrix

From Read a little-endian value from a dump: every row here is a choice with a cost. Fill the Byte column, then say which row you would actually pick and what you give up for it.

Predict first

A student writes this, and it looks reasonable:

Goal: write 0xDEADBEEF over a 4-byte slot.

It is wrong. Say what breaks — and say it before you turn the page.

Correct: Types the value in 'reading' order — but memory is little-endian, so this stores the bytes reversed and the slot holds 0xEFBEADDE.

Goal: write 0xDEADBEEF over a 4-byte slot.

Why: Types the value in 'reading' order — but memory is little-endian, so this stores the bytes reversed and the slot holds 0xEFBEADDE.

Comparison matrix

From Three special registers: refill the Name column from what you know. The rest of the table is as it appeared.

Discussion prompt

Because the stack grows down, the 'top of the frame' (where it began) is the highest address — that's ebp. The 'bottom' (the growing edge) is the lowest address — that's esp.

That is stated as though it always holds. Do one of two things: produce a case where it fails, or say precisely what rules such a case out. "It just does" is not on the menu.

Hint: Hunt at the extremes first — zero, one, negative, empty, equal. If every extreme survives, the reason they survive is the proof.

Comparison matrix

From The general-purpose registers: refill the Typical use column from what you know. The rest of the table is as it appeared.

Comparison matrix

From push = decrement, then write: every row here is a choice with a cost. Fill the esp column, then say which row you would actually pick and what you give up for it.

Comparison matrix

From pop = read, then increment: refill the esp column from what you know. The rest of the table is as it appeared.

Discussion prompt

Full trace: two pushes and a pop — before any calculation: what is the plan? Name the moves in order, in plain English, without doing the arithmetic.

Hint: It starts with: push $0xAA

Sort into buckets

Sort these by esp, from memory, without looking back at Full trace: two pushes and a pop. Telling them apart on the spot is the skill; the table is only where the answer happens to be written down.

0xbffff020

start

0xbffff01c

push $0xAA; pop %eax

0xbffff018

push $0xBB

g1

esp is "0xbffff020" for start — that is what the table on "Full trace: two pushes and a pop" records, and it is the single property separating this group from the rest.

g2

esp is "0xbffff01c" for push $0xAA, pop %eax — that is what the table on "Full trace: two pushes and a pop" records, and it is the single property separating this group from the rest.

g3

esp is "0xbffff018" for push $0xBB — that is what the table on "Full trace: two pushes and a pop" records, and it is the single property separating this group from the rest.

Predict first

A student writes this, and it looks reasonable:

Write *(0x1000) = eax, THEN set esp = 0x0FFC

It is wrong. Say what breaks — and say it before you turn the page.

Correct: Writes at the OLD esp, clobbering the current top-of-stack value before allocating.

push %eax with esp = 0x1000.

Why: Writes at the OLD esp, clobbering the current top-of-stack value before allocating.

Sort into buckets

Some of these hold up and some are the exact mistakes this lesson is built to prevent. Sort them.

Holds up

Networking is the opposite: many protocols are big-endian ('network byte order'). When we reach the network unit, byte order flips — keep the distinction filed.; Registers store a word on the CPU, have no memory address, and are named. Three matter for this unit:; Sanity check from the book: which region do eip, ebp, esp point into? eip → code; ebp and esp → stack.

Breaks

Goal: write 0xDEADBEEF over a 4-byte slot.; Write *(0x1000) = eax, THEN set esp = 0x0FFC

sound

These are stated as this lesson states them — each one survives the edge cases L05 · Little-Endian, the Registers eip/ebp/esp, and Push/Pop puts it through.

flawed

Each of these is lifted from a trap in this deck: reasonable-sounding, and wrong in a way that only shows up once you rely on it.

Put in order

These are the steps of The Lesson-5 recipe, scrambled. Put them back in order before the next slide shows you.

1. Little-endian read: lowest address = LSB; reverse bytes to get the word.
2. Little-endian write: emit the LSB first into increasing addresses.
3. Registers: eip → code; ebp → top (high) of frame; esp → bottom (low) of frame.
4. push: esp −= 4, then *(esp) = value.
5. pop: reg = *(esp), then esp += 4 (old value now below esp = undefined).
6. Trace discipline: every push/pop moves esp by exactly 4; write the value AND the new esp each step.

Why: This is the order the recipe itself gives. Recalling the sequence without the slide in front of you is the difference between recognising the method and being able to run it — most of what goes wrong in practice is a step done out of turn.

Discussion prompt

The Lesson-5 recipe works on the cases you have just seen. Push it to the edge: what is the most degenerate input it still handles — empty, zero, one item, everything equal — and what is the first case where it stops being true? Name the case, not just "it breaks".

Hint: Try the smallest legal input, then the largest, then the one where two things collide. Methods are specified at their edges; the middle takes care of itself.

Check your understanding

What 32-bit value is stored there?

• A. 0x08041000 (correct)
• B. 0x00100408
• C. 0x10000804
• D. 0x04081000

Answer: A

Why: Little-endian: the lowest address holds the least-significant byte. Bytes low→high are 00,10,04,08, so the MSB (0x08) is last. Reading most-significant first gives 08 04 10 00 = 0x08041000.

Why B tempts people

This reads the bytes in address order without reversing — that treats the dump as big-endian.

Why C tempts people

Bytes are shuffled arbitrarily; little-endian is a clean full reversal of byte order, not a swap of pairs.

Why D tempts people

This reverses only some bytes; the correct reading reverses all four to 08 04 10 00.

Check your understanding

What is esp afterward?

• A. 0xbffff0f8 (correct)
• B. 0xbffff0f4
• C. 0xbffff100
• D. 0xbffff10c

Answer: A

Why: Three pushes lower esp by 3×4 = 12 (0xbffff100 → 0xbffff0f4), and one pop raises it by 4 (→ 0xbffff0f8). Net is −8 from the start.

Why B tempts people

This counts the three pushes (−12) but forgets the pop adds 4 back.

Why C tempts people

This assumes pushes and pops cancel one-for-one; there are three pushes and only one pop.

Why D tempts people

This moves esp the wrong direction — pushes DECREMENT esp (stack grows down), not increment.

Eliminate the wrong options

Which register points to the HIGHEST address of the current frame, and what is it called?

3 of these 4 are wrong. Strike them one at a time, and say what rules each one out before you strike the next. The survivor is the answer.

• A. ebp, the base pointer — the top (highest address) of the frame.
• B. esp, the stack pointer — it always sits at the highest address.
• C. eip, the instruction pointer — it tracks the top of the stack.
• D. eax, the accumulator — it stores the frame base.

Survives elimination: A

Why: §2.5: ebp (base pointer) marks the top of the frame, which — because the stack grows down — is the highest address. esp marks the bottom (lowest address), and eip is the instruction pointer into the code region.

Check your understanding

Which register points to the HIGHEST address of the current frame, and what is it called?

• A. ebp, the base pointer — the top (highest address) of the frame. (correct)
• B. esp, the stack pointer — it always sits at the highest address.
• C. eip, the instruction pointer — it tracks the top of the stack.
• D. eax, the accumulator — it stores the frame base.

Answer: A

Why: §2.5: ebp (base pointer) marks the top of the frame, which — because the stack grows down — is the highest address. esp marks the bottom (lowest address), and eip is the instruction pointer into the code region.

Why B tempts people

esp points to the BOTTOM of the frame, the lowest address — it moves as you push/pop.

Why C tempts people

eip points into the code region at the current instruction, not into the stack at all.

Why D tempts people

eax is a general-purpose register for return values; it has no role marking the frame.

Draw it

One page, no notation unless you need it: draw how these connect — Little-Endian Bytes · The Registers · Push & Pop. Put an arrow wherever one of them is what makes another possible, and label the arrow with why.