Mastering Reverse Engineering

Data assembly on the stack

The stack is a memory space in which any data can be stored. The stack can be accessed using the stack pointer register (for 32-bit address space, the ESP register is used). Let's consider the example of the following code snippet:

push 0push 21646c72hpush 6f57206fhpush 6c6c6548hmov eax, esppush 74hpush 6B636150hmov edx, esppush 0push eaxpush edxpush 0mov eax, <user32.MessageBoxA>call eax

This will eventually display the following message box:

How did that happen when no visible text strings were referenced? Before calling for the MessageBoxA function, the stack would look like this:

These push instructions assembled ...