x86-64 ASM - The Stack

• Last-in-first-out (LIFO) data structure where you can only “push” on a value or “pop” off a value.
• The stack exists conceptually — different OSes have different conventions or ASLR may be used
• By convention, the stack grows towards lower memory addresses
• RSP points to the top of the stack or the lowest address

What’s on the stack?

• Function return addresses
• Local variables
• Sometimes for passing arguments
• Too many registers to juggle

Push and Pop Instructions

As mentioned previously, a push will add a value to the stack and a pop will take off a value from the stack. Automatically, RSP will be adjusted to account for values pushed and popped off (subtract 8 for push, add 8 for pop).

You can either push directly from a register or from memory in the form r/mX

• Square brackets [] mean to treat a value as a memory address similar to the dereference operator *
• Base only -> [rbx]
• Base+index*scale -> [rbx+rcx*8]
• Base+index*scale+displacement -> [rbx+rcx*8+0x20] (this would be good for accessing from multidimensional arrays)