Learning Malware Analysis

8.1 Stack

The stack is an area of the memory that gets allocated by the operating system when the thread is created. The stack is organized in a Last-In-First-Out (LIFO) structure, which means that the most recent data that you put in the stack will be the first one to be removed from the stack. You put data (called pushing) onto the stack by using the push instruction, and you remove data (called popping) from the stack using the pop instruction. The push instruction pushes a 4-byte value onto the stack, and the pop instruction pops a 4-byte value from the top of the stack. The general forms of the push and pop instructions are shown here:

push source     ; pushes source on top of the stackpop destination ; copies value from the top of the stack ...