title: Understanding how parameters are passed to functions in Assembly
body: <p>I am reading this <a href="http://shellblade.net/docs/ret2libc.pdf" rel="nofollow noreferrer" title="writeup">writeup</a> on how to perform a <code>ret2libc</code> exploit.  It states that the arguments passed to a function are stored at <code>ebp+8</code>.</p>
  
  <p>Now, if I take a simple C program</p>
  
  <pre><code>#include &lt;stdlib.h&gt;
  
  int main() {
    system("/bin/sh");
  }
  </code></pre>
  
  <p>And compile it:
  <code>gcc -m32 -o test_sh test_sh.c</code></p>
  
  <p>and look at the disassembly of it with
  <code>objdump -d -M intel test_sh</code></p>
  
  <pre><code>0804840b &lt;main&gt;:
   804840b:       8d 4c 24 04             lea    ecx,[esp+0x4]
   804840f:       83 e4 f0                and    esp,0xfffffff0
   8048412:       ff 71 fc                push   DWORD PTR [ecx-0x4]
   8048415:       55                      push   ebp
   8048416:       89 e5                   mov    ebp,esp
   8048418:       51                      push   ecx
   8048419:       83 ec 04                sub    esp,0x4
   804841c:       83 ec 0c                sub    esp,0xc
   804841f:       68 c4 84 04 08          push   0x80484c4
   8048424:       e8 b7 fe ff ff          call   80482e0 &lt;system@plt&gt;
   8048429:       83 c4 10                add    esp,0x10
   804842c:       b8 00 00 00 00          mov    eax,0x0
   8048431:       8b 4d fc                mov    ecx,DWORD PTR [ebp-0x4]
   8048434:       c9                      leave  
   8048435:       8d 61 fc                lea    esp,[ecx-0x4]
   8048438:       c3                      ret    
   8048439:       66 90                   xchg   ax,ax
   804843b:       66 90                   xchg   ax,ax
   804843d:       66 90                   xchg   ax,ax
   804843f:       90                      nop
  </code></pre>
  
  <p>The line</p>
  
  <pre><code>804841f:       68 c4 84 04 08          push   0x80484c4
  </code></pre>
  
  <p>Pushes the address of the string "/bin/sh" onto the stack.  Immediately afterwards the <code>system@plt</code> function is called.  So how does one arrive to <code>ebp+8</code> from the above output? </p>
  
  <p>Help would be appreciated!</p>