What exactly is the base pointer and stack pointer? To what do they point?

Question

Using this example coming from Wikipedia, in which `DrawSquare()` calls `DrawLine()`: (Note that this diagram has high addresses at the bottom and low addresses at the top.) Could anyone explain to me what `ebp` and `esp` are in this context? From what I see, I'd say the stack pointer points always to the top of the stack, and the base pointer to the beginning of the current function? Right? edit: I mean this in the context of Windows programs. edit2: And how does `eip` work, too? edit3: I have the following code from MSVC++: ``` var_C= dword ptr -0Ch var_8= dword ptr -8 var_4= dword ptr -4 hInstance= dword ptr 8 hPrevInstance= dword ptr 0Ch lpCmdLine= dword ptr 10h nShowCmd= dword ptr 14h ``` All of them seem to be dwords, thus taking 4 bytes each. So I can see there is a gap from `hInstance` to `var_4` of 4 bytes. What are they? I assume it is the return address, as can be seen in the diagram from Wikipedia. (editor's note: removed a long quote from Michael's answer, which doesn't b…

Accepted Answer

`esp` is as you say it is, the top of the stack.

`ebp` is usually set to `esp` at the start of the function. Function parameters and local variables are accessed by adding and subtracting, respectively, a constant offset from `ebp`. All x86 calling conventions define `ebp` as being preserved across function calls. `ebp` itself actually points to the previous frame's base pointer, which enables stack walking in a debugger and viewing other frame's local variables to work.

Most function prologs look something like:

```
push ebp      ; Preserve current frame pointer
mov  ebp, esp ; Create new frame pointer pointing to current stack top
sub  esp, 20  ; allocate 20 bytes worth of locals on stack.
```

Then later in the function you may have code like (presuming both local variables are 4 bytes)

```
mov  [ebp-4], eax   ; Store eax in first local
mov  ebx, [ebp - 8] ; Load ebx from second local
```

FPO or frame pointer omission optimization which you can enable will actually eliminate this and use `ebp` as another register and access locals directly off of `esp`, but this makes debugging a bit more difficult since the debugger can no longer directly access the stack frames of earlier function calls.

EDIT:

For your updated question, the missing two entries in the stack are:

```
nShowCmd          = dword ptr +14h
hlpCmdLine        = dword ptr +10h
PrevInstance      = dword ptr +0Ch
hInstance         = dword ptr +08h
return address    = dword ptr +04h     <==
savedFramePointer = dword ptr +00h     <==
var_4             = dword ptr -04h
var_8             = dword ptr -08h
var_C             = dword ptr -0Ch
```

This is because the flow of the function call is:

- Push parameters (`hInstance`, `PrevInstance`, `hlpCmdLine`, `nShowCmd`)

- Call function, which pushes return address

- Push `ebp`

- Allocate space for locals

What exactly is the base pointer and stack pointer? To what do they point?

Solution

Problem