Reversing : The Hacker's Guide to Reverse Engineering

Figure 2.1 A view of the stack after three values are pushed in.

Figure 2.2 A view of the stack after the three values are popped out.

Previously Stored Value

Unknown Data (Unused)

Unknown Data (Unused)

Unknown Data (Unused)

Unknown Data (Unused)

Unknown Data (Unused)

ESP

Lower Memory

Addresses

Higher Memory

Addresses

After POP

POP

Direction

POP EAX

POP EBX

POP ECX

32 Bits

Code Executed:

Previously Stored Value

Value 1

Value 2

Value 3

Unknown Data (Unused)

Unknown Data (Unused)

ESP

Lower Memory

Addresses

Higher Memory

Addresses

After PUSH

PUSH

Direction

PUSH Value 1

PUSH Value 2

PUSH Value 3

32 Bits

Code Executed:

Low-Level Software 41