1 Basics of the Stack

The stack is a region of memory used for temporary storage of data during the execution of a program. It operates on the Last In, First Out (LIFO) principle, meaning the last item pushed onto the stack is the first one to be popped off. This makes the stack particularly useful for managing function calls, passing parameters, storing local variables, and handling interrupt service routines.

Stack Pointer (SP/ESP/RSP)

• SP (16-bit mode): In 16-bit real mode, the Stack Pointer (SP) is a 16-bit register that points to the current top of the stack. It is accessed using the SP register directly.
• ESP (32-bit mode): In 32-bit protected mode, the Extended Stack Pointer (ESP) is a 32-bit register that points to the top of the stack. It is accessed using the ESP register.
• RSP (64-bit mode): In 64-bit mode, the Stack Pointer (RSP) is a 64-bit register that points to the top of the stack. It is accessed using the RSP register.

2 Stack Operations

2.1 Push Operation:

The push instruction is used to push (or store) data onto the stack. When a value is pushed onto the stack, the stack pointer (SP/ESP/RSP) is decremented to allocate space for the new data. As we all know that stack in x86 grows from higher to lower memory.

Syntax:

push operand

• Operand: Can be a register, memory address, or immediate value.

Examples:

push eax        ; Push the contents of register eax onto the stack
push 123        ; Push the immediate value 123 onto the stack
push dword [myVariable]  ; Push the double word at memory location myVariable onto the stack

Size Specifiers

You can specify the size of the data being pushed onto the stack. This is particularly useful when dealing with different data sizes (byte, word, double word).

push size operand

• Size: Specifies the size of the data (byte, word, dword).
• Operand: Can be a register, memory address, or immediate value.

push byte 10     ; Push 8-bit value 10 onto the stack
push word bx     ; Push 16-bit value in bx register onto the stack
push dword [myVariable]   ; Push 32-bit value at memory location myVariable onto the stack

pusha and pushad Instructions:

These instructions push all general-purpose registers onto the stack. They are useful for saving and restoring the complete CPU state during interrupt service routines or context switches.

• pusha (16-bit):
  • Pushes ax, cx, dx, bx, sp, bp, si, di.
• pushad (32-bit):
  • Pushes eax, ecx, edx, ebx, esp, ebp, esi, edi.

Note: There is no instruction for the 64-bit which pushes all the register all at once.

2.2 Pop Operation

The pop instruction is used to pop (or retrieve) data from the stack. When data is popped from the stack, the stack pointer (SP/ESP/RSP) is incremented to deallocate the space occupied by the data.

Syntax:

pop operand

• Operand: Can be a register or memory address.

Examples:

pop ebx         ; Pop the top value from the stack into register ebx
pop dword [myVariable]  ; Pop the top double word from the stack into memory location myVariable

Stack Pointer Adjustments

When you execute a pop instruction, the stack pointer is incremented to move past the value that was popped off the stack:

• 16-bit mode: Increments SP by 2 bytes (16 bits).
• 32-bit mode: Increments ESP by 4 bytes (32 bits).
• 64-bit mode: Increments RSP by 8 bytes (64 bits).

Examples in Different Modes

• 16-bit Mode

In 16-bit mode, the pop instruction works with 16-bit registers and addresses.

pop ax          ; Pop the top 16-bit value from the stack into ax
pop word [myVar] ; Pop the top 16-bit value from the stack into the memory location myVar

• 32-bit Mode

In 32-bit mode, the pop instruction works with 32-bit registers and addresses.

pop eax         ; Pop the top 32-bit value from the stack into eax
pop dword [myVar] ; Pop the top 32-bit value from the stack into the memory location myVar

• 64-bit Mode

In 64-bit mode, the pop instruction works with 64-bit registers and addresses.

pop rax         ; Pop the top 64-bit value from the stack into rax
pop qword [myVar] ; Pop the top 64-bit value from the stack into the memory location myVar

popa and popad Instructions

These instructions are used to pop multiple general-purpose registers from the stack in a single operation. They are the counterparts to the pusha and pushad instructions.

• popa (16-bit):
  • Pops values into di, si, bp, sp (ignored), bx, dx, cx, ax.
• popad (32-bit):
  • Pops values into edi, esi, ebp, esp (ignored), ebx, edx, ecx, eax.