المكدس واتفاقيات استدعاء الدوال

You can read basic x86/x64 instructions and follow control flow. To truly understand function calls you must know the stack and calling conventions.

These rules govern how arguments arrive and how cleanup happens.

The stack is a region of memory that grows downward (toward lower addresses). It stores return addresses, saved registers, and local variables.

• push decrements RSP and writes
• pop reads and increments RSP

Two registers track the stack:

• RSP (stack pointer) points to the current top
• RBP (base pointer) anchors the current frame

Locals are addressed relative to RBP, like [rbp-8].

Most functions begin with a prologue that sets up the frame: save the old base pointer, then point RBP at the new frame.

The epilogue reverses the prologue, restoring the caller's frame before returning.

A calling convention is the contract for passing arguments and returning values.

• Where arguments go (registers or stack)
• Who cleans up the stack
• Which registers must be preserved

On Linux x64 the first six integer arguments go in registers: rdi, rsi, rdx, rcx, r8, r9. The return value comes back in rax.

Extra arguments spill onto the stack.

Windows x64 uses different registers: the first four arguments go in rcx, rdx, r8, r9, and the caller reserves 32 bytes of shadow space.

Recognizing the OS tells you which mapping to apply when reading arguments.

Some registers may be clobbered by a call (caller-saved), others must be preserved (callee-saved).

Seeing a function push rbx, rbp, and r12-r15 in its prologue is a strong hint about which registers it intends to use.

When you land in a function, mapping registers to arguments lets you label them. If the code reads rdi first on Linux, that is argument one.

This is how raw disassembly becomes readable pseudocode like send(sock, buf, len).

When a function has more arguments than the convention allows in registers, the extras are pushed onto the stack by the caller. The callee reads them at positive offsets from RBP, like [rbp+0x10].

Spotting these accesses helps you recover the full argument list.

Under the System V AMD64 convention, which register holds the FIRST integer argument?

You can now decode function calls at the metal level:

• Stack grows down; RSP tops it, RBP anchors the frame
• Prologue/epilogue set up and tear down frames
• Calling conventions map registers to arguments (System V vs Microsoft x64)

This turns opaque disassembly into recognizable function signatures.