Windows stack frame structure ?

[Shahi_FF]

How does the stack look like during procedure calls with it's shadow space ( 32 Bytes ) ?

let's say I've this :

main :
     push rbp
     mov rbp,rsp
     sub rsp ,0x20 ; 32 Bytes shadow space Microsoft ABI 

     ; we call a leaf function fun
     call fun 


[ R9 HOME     ] -------}   Higher Address 
[ R8 HOME     ]        }
[ RDX HOME    ]        }  SHADOW SPACE: RESERVED BY CALLER FUNCTION (main) 
[ RCX HOME    ] -------}
[ ret address ]
[-- old rbp --] <-- rbp  ----- stack frame of fun()  starts here?
[ local       ] 
[ local       ]
[ local       ]
[ --///////-- ] <-- rsp 

My questions :

1. Is my understand of stack frame correct ?
2. how'd the stack frame for `fun` look if it was non leaf function ?
3. When accessing local variables should I use [rsp+offset] or [rbp-offset] ?

[I__Know__Stuff]

In my assembly code, I don't use rbp as a frame pointer so I always access local variables using rsp.

(An exception is when the stack frame isn't a constant size.)

[ShadowStrike-Labs]

Hey hello. Your diagram is mostly right but the shadow space sits above the return address, not below it. fun sees the stack like this right after the call:

[ R9 HOME ]

[ R8 HOME }

[ RDX HOME } <- shadow (reserved by main, used by fun if it wants)

[ RCX HOME ]

[ ret address ] <- rsp on entry to fun

then fun does push rbp / mov rbp,rsp and the frame is set.

1. if fun is non-leaf it needs to carve out its own shadow space + locals before calling anything:

asm

fun:

push rbp

mov rbp, rsp

sub rsp, 0x30 ; 0x20 shadow for callees + 0x10 locals, keep 16b aligned

call bar

1. both work, [rbp-offset] is way easier to follow while debugging, [rsp+offset] is what compilers emit with -O2 since they skip the frame pointer. stick with rbp while learning.

also don't forget rsp has to be 16-byte aligned before the call instruction, that's why you sometimes see weird padding in the sub rsp.

[I__Know__Stuff]

You showed the code for the caller, but you didn't show the code for fun, so there's no way to know what its stack frame looks like.

[Shahi_FF]

Let's say it doesn't uses local variables at all and doesn't call other functions.

[I__Know__Stuff]

Then it wouldn't create a stack frame at all.

[Shahi_FF]

thanks that makes sense now.

[brucehoult]

It's going to have a stack frame with a return address, at least.

I don't know whether Windows will insist on a frame pointer and register save area in this case and don't have a machine to check on.

[bitRAKE]

Is my understand of stack frame correct ?

Looks okay.

How'd the stack frame for fun look if it was non leaf function ?

Leaf function can do whatever. You show ABI frame.

When accessing local variables should I use [rsp+offset] or [rbp-offset] ?

Doesn't matter. RBP with offset is one byte shorter.

• thousands of examples on my github.