title: learning disassembly
body: <p>In an attempt to understand what occurs underneath I am making small C programs and then reversing it, and trying to understand its objdump output.</p>
  
  <p>The C program is:</p>
  
  <pre><code>#include &lt;stdio.h&gt;
  
  int function(int a, int b, int c) {
      printf("%d, %d, %d\n", a,b,c);
  }
  
  int main() {
      int a;
      int *ptr;
  
      asm("nop");
      function(1,2,3);
  }
  </code></pre>
  
  <p>The objdump output for function gives me the following.</p>
  
  <pre><code>080483a4 &lt;function&gt;:
   80483a4:   55                      push   ebp
   80483a5:   89 e5                   mov    ebp,esp
   80483a7:   83 ec 08                sub    esp,0x8
   80483aa:   ff 75 10                push   DWORD PTR [ebp+16]
   80483ad:   ff 75 0c                push   DWORD PTR [ebp+12]
   80483b0:   ff 75 08                push   DWORD PTR [ebp+8]
   80483b3:   68 04 85 04 08          push   0x8048504
   80483b8:   e8 fb fe ff ff          call   80482b8 &lt;printf@plt&gt;
   80483bd:   83 c4 10                add    esp,0x10
   80483c0:   c9                      leave  
  </code></pre>
  
  <p>Notice that before the call to printf, three DWORD's with offsets 8,16,12(they must be the arguments to <code>function</code> in the reverse order) are being pushed onto the stack. Later a hex address which must be the address of the format string is being pushed.</p>
  
  <p><code>My doubt is</code></p>
  
  <ol>
  <li>Rather than pushing 3 DWORDS and the format specifier onto the stack directly, I expected to see the esp being manually decremented and the values being pushed onto the stack after that. How can one explain this behaviour?</li>
  </ol>