title: Help with understanding a very basic main() disassembly in GDB
body: <p>Heyo,</p>
  
  <p>I have written this very basic main function to experiment with disassembly and also to see and hopefully understand what is going on at the lower level:</p>
  
  <pre><code>int main() {
    return 6;
  }
  </code></pre>
  
  <p>Using gdb to disas main produces this:</p>
  
  <pre><code>0x08048374 &lt;main+0&gt;:    lea    0x4(%esp),%ecx
  0x08048378 &lt;main+4&gt;:    and    $0xfffffff0,%esp
  0x0804837b &lt;main+7&gt;:    pushl  -0x4(%ecx)
  0x0804837e &lt;main+10&gt;:   push   %ebp
  0x0804837f &lt;main+11&gt;:   mov    %esp,%ebp
  0x08048381 &lt;main+13&gt;:   push   %ecx
  0x08048382 &lt;main+14&gt;:   mov    $0x6,%eax
  0x08048387 &lt;main+19&gt;:   pop    %ecx
  0x08048388 &lt;main+20&gt;:   pop    %ebp
  0x08048389 &lt;main+21&gt;:   lea    -0x4(%ecx),%esp
  0x0804838c &lt;main+24&gt;:   ret  
  </code></pre>
  
  <p>Here is my best guess as to what I think is going on and what I need help with line-by-line:</p>
  
  <p><code>lea    0x4(%esp),%ecx</code></p>
  
  <p>Load the address of esp + 4 into ecx. <strong>Why do we add 4 to esp?</strong></p>
  
  <p>I read somewhere that this is the address of the command line arguments. But when I did <code>x/d $ecx</code> I get the value of argc. <strong>Where are the actual command line argument values stored?</strong></p>
  
  <p><code>and    $0xfffffff0,%esp</code></p>
  
  <p>Align stack</p>
  
  <p><code>pushl  -0x4(%ecx)</code></p>
  
  <p>Push the address of where esp was originally onto the stack. <strong>What is the purpose of this?</strong></p>
  
  <p><code>push   %ebp</code></p>
  
  <p>Push the base pointer onto the stack</p>
  
  <p><code>mov    %esp,%ebp</code></p>
  
  <p>Move the current stack pointer into the base pointer</p>
  
  <p><code>push   %ecx</code></p>
  
  <p>Push the address of original esp + 4 on to stack. <strong>Why?</strong></p>
  
  <p><code>mov    $0x6,%eax</code></p>
  
  <p><strong>I wanted to return 6 here so i'm guessing the return value is stored in eax?</strong></p>
  
  <p><code>pop    %ecx</code></p>
  
  <p>Restore ecx to value that is on the stack. <strong>Why would we want ecx to be esp + 4 when we return?</strong></p>
  
  <p><code>pop    %ebp</code></p>
  
  <p>Restore ebp to value that is on the stack</p>
  
  <p><code>lea    -0x4(%ecx),%esp</code></p>
  
  <p>Restore esp to it's original value</p>
  
  <p><code>ret</code></p>
  
  <p>I am a n00b when it comes to assembly so any help would be great! Also if you see any false statements about what I think is going on please correct me.</p>
  
  <p>Thanks a bunch! :]</p>