Question

I would like to divide a stack to stack-frames by looking on the raw data on the stack. I thought to do so by finding a "linked list" of saved EBP pointers.

  1. Can I assume that a (standard and commonly used) C compiler (e.g. gcc) will always update and save EBP on a function call in the function prologue?

    pushl %ebp
    movl %esp, %ebp

    Or are there cases where some compilers might skip that part for functions that don't get any parameters and don't have local variables?

    The x86 calling conventions and the Wiki article on function prologue don't help much with that.

  2. Is there any better method to divide a stack to stack frames just by looking on its raw data?

Thanks!

No correct solution

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top