栈与调用约定
深入理解函数如何传递参数、返回值并管理栈帧。这些知识能帮助您读懂反汇编代码。
栈与调用约定 是 CoddyKit 上的免费 Reverse Engineering & Binary Analysis Basics 课时。 这是第 4 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 Reverse Engineering & Binary Analysis Basics 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Reverse Engineering & Binary Analysis Basics 课程共包含 4 节课。
本课时的部分内容尚未翻译，以英文显示。
Beyond a Single Call
You can read basic x86/x64 instructions and follow control flow. To truly understand function calls you must know the stack and calling conventions.
These rules govern how arguments arrive and how cleanup happens.
What the Stack Is
The stack is a region of memory that grows downward (toward lower addresses). It stores return addresses, saved registers, and local variables.
pushdecrements RSP and writespopreads and increments RSP
push rax ; rsp -= 8, [rsp] = rax
pop rbx ; rbx = [rsp], rsp += 8RSP and RBP
Two registers track the stack:
- RSP (stack pointer) points to the current top
- RBP (base pointer) anchors the current frame
Locals are addressed relative to RBP, like [rbp-8].
The Function Prologue
Most functions begin with a prologue that sets up the frame: save the old base pointer, then point RBP at the new frame.
push rbp
mov rbp, rsp
sub rsp, 0x20 ; reserve 32 bytes for localsThe Function Epilogue
The epilogue reverses the prologue, restoring the caller's frame before returning.
mov rsp, rbp
pop rbp
retCalling Conventions
A calling convention is the contract for passing arguments and returning values.
- Where arguments go (registers or stack)
- Who cleans up the stack
- Which registers must be preserved
System V AMD64 (Linux x64)
On Linux x64 the first six integer arguments go in registers: rdi, rsi, rdx, rcx, r8, r9. The return value comes back in rax.
Extra arguments spill onto the stack.
; foo(1, 2, 3)
mov edi, 1
mov esi, 2
mov edx, 3
call fooMicrosoft x64 Convention
Windows x64 uses different registers: the first four arguments go in rcx, rdx, r8, r9, and the caller reserves 32 bytes of shadow space.
Recognizing the OS tells you which mapping to apply when reading arguments.
; Windows: bar(a, b)
mov rcx, a
mov rdx, b
sub rsp, 0x28 ; shadow space + alignment
call barCaller-Saved vs Callee-Saved
Some registers may be clobbered by a call (caller-saved), others must be preserved (callee-saved).
Seeing a function push rbx, rbp, and r12-r15 in its prologue is a strong hint about which registers it intends to use.
Reading Arguments in Practice
When you land in a function, mapping registers to arguments lets you label them. If the code reads rdi first on Linux, that is argument one.
This is how raw disassembly becomes readable pseudocode like send(sock, buf, len).
Stack-Passed Arguments
When a function has more arguments than the convention allows in registers, the extras are pushed onto the stack by the caller. The callee reads them at positive offsets from RBP, like [rbp+0x10].
Spotting these accesses helps you recover the full argument list.
; 7th System V argument
mov rax, [rbp+0x10]Quick Check
Under the System V AMD64 convention, which register holds the FIRST integer argument?
Recap
You can now decode function calls at the metal level:
- Stack grows down; RSP tops it, RBP anchors the frame
- Prologue/epilogue set up and tear down frames
- Calling conventions map registers to arguments (System V vs Microsoft x64)
This turns opaque disassembly into recognizable function signatures.
常见问题解答
「栈与调用约定」课时是免费的吗？
是的 — 「栈与调用约定」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Reverse Engineering & Binary Analysis Basics 课程的其余内容，请升级到 CoddyKit PRO。 Reverse Engineering & Binary Analysis Basics 课程共包含 4 节课。
「栈与调用约定」这节课中我会学到什么？
深入理解函数如何传递参数、返回值并管理栈帧。这些知识能帮助您读懂反汇编代码。 你通过在浏览器中直接运行的动手代码来练习 Reverse Engineering & Binary Analysis Basics，全天候 AI 导师会在你学习这节课的过程中回答你的问题。
学习 Reverse Engineering & Binary Analysis Basics 需要有经验吗？
无需任何先前经验。CoddyKit 上的 Reverse Engineering & Binary Analysis Basics 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 4 节课，共 4 节。
「栈与调用约定」课时需要多长时间？
大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。
我能在这节 Reverse Engineering & Binary Analysis Basics 课中编写并运行代码吗？
能。每节 Reverse Engineering & Binary Analysis Basics 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。