关于寄存器ESP和EBP的一些理解

原文：<wbr><a rel="nofollow" href="http://blog.csdn.net/zsJum/article/details/6117043" style="color:rgb(245,149,19); text-decoration:none">http://blog.csdn.net/zsJum/article/details/6117043</a> <div> <div> <span style="color:#003366">一直对寄存器ESP和EBP的概念总是有些混淆，查看定义</span><span style="color:#993300">ESP</span><span style="color:#003366">是栈顶指针，</span><span style="color:#993300">EBP</span><span style="color:#003366">是存取堆栈指针。还是不能很透彻理解。之后借于一段汇编代码，总算是对两者有个比较清晰的理解。</span> </div> <div>下面是按调用约定__stdcall 调用函数test(int p1,int p2)的汇编代码</div> <div>假设执行函数前堆栈指针ESP为NN</div> <div>push p2 ;参数2入栈, ESP -= 4h , ESP = NN - 4h</div> <div>push p1 ;参数1入栈, ESP -= 4h , ESP = NN - 8h</div> <div>call test ;压入返回地址 ESP -= 4h, ESP = NN - 0Ch </div> <div><span style="color:#808080">;//进入函数内</span></div> <div>{</div> <div>push ebp ;保护先前EBP指针， EBP入栈， ESP-=4h, ESP = NN - 10h</div> <div>mov ebp, esp ;设置EBP指针指向栈顶 NN-10h</div> <div>mov eax, dword ptr [ebp+0ch] ;ebp+0ch为NN-4h,即参数2的位置</div> <div>mov ebx, dword ptr [ebp+08h] ;ebp+08h为NN-8h,即参数1的位置</div> <div>sub esp, 8 ;局部变量所占空间ESP-=8, ESP = NN-18h</div> <div>...</div> <div>add esp, 8 ;释放局部变量, ESP+=8, ESP = NN-10h</div> <div>pop ebp ;出栈,恢复EBP, ESP+=4, ESP = NN-0Ch</div> <div>ret 8 ;ret返回,弹出返回地址,ESP+=4, ESP=NN-08h, 后面加操作数8为平衡堆栈,ESP+=8,ESP=NN, 恢复进入函数前的堆栈.</div> <div>}</div> <div>看完汇编后,再看EBP和ESP的定义,哦,豁然开朗,</div> <div> <span style="color:#000080">原来</span><span style="color:#993300">ESP</span><span style="color:#000080">就是一直指向栈顶的指针,而</span><span style="color:#993300">EBP</span><span style="color:#000080">只是存取某时刻的栈顶指针,以方便对栈的操作,如获取函数参数、局部变量等。</span> </div> </div> </wbr>