ESP vs EBP usage

[nobody]

Hi,

The two .asm functions below seem to be equivalent, i.e.,
they both yield the same (correct) results. The first uses
the stack pointer ESP to access data and the second uses
the base pointer EBP.

The first loads EAX with [ESP+4].
The second puts ESP in EBP, then loads EAX with [EBP+8]
The rest of the two programs are essentially the same, except the push/pop.

My question: Why the 4 byte difference in using ESP and EBP?


Michael

=================================

global inhalt_

section  .text ;return the contents of the addr of a 64-bit integer

inhalt_:
  mov   eax, [esp+4]
  mov   eax, [eax]
  mov   edx, [eax+4]
  mov   eax, [eax]
  ret

=================================

global inhalt_

section  .text ;return the contents of the addr of a 64-bit integer

inhalt_:

push  ebp
  mov   ebp, esp
  mov   eax, [ebp+8]
  mov   eax, [eax]
  pop   ebp
  mov   edx, [eax+4]
  mov   eax, [eax]
  ret

[nobody]

I figured out the answer about thirty minutes after I asked the question. It's because I pushed EBP and so grew the stack by 4 bytes.

Michael

[Frank Kotler]

Right. I wasn't sure if you meant the four byte difference between [esp + 4] and [ebp + 8] (seemed "too obvious"), or something with the length of the resulting code (which I hadn't looked into)...

There *is* something interesting(?) in the length of the code...

00000000  55                push ebp
00000001  89E5              mov ebp,esp
or:
00000003  C8000000          enter 0x0,0x0
; "enter N, 0" also does "sub esp, N"


00000007  8B5C2404          mov ebx,[esp+0x4]
0000000B  8B9C2400020000    mov ebx,[esp+0x200]
or:
00000012  8B5D04            mov ebx,[ebp+0x4]
00000015  8B9D00020000      mov ebx,[ebp+0x200]

0000001B  89EC              mov esp,ebp
0000001D  5D                pop ebp
or:
0000001E  C9                leave

0000001F  C3                ret

(I've tried to "group" things that you'd only do once, but that I've done "both ways" for illustration)

Notice that using esp is a byte longer than using ebp. So if your function accesses parameters and/or local variables more than four times, using ebp can be a "win" (for size) despite the push/pop, etc... (speed is probably a lot more important than size, but it's easier to "keep score" if you like size :)

Best,
Frank