Question

I have the next code:

Doit: mov eax, 4 ; for write system call
      push Dword, 0x44434241
      mov ebx, 1
      mov ecx, esp
      mov edx, 4
      int 0x80
      add esp, 4
      ret

As I check, It’s print “ABCD”, but why? AS I understood it, on the stack we have the next picture:

Low — 0x41 0x42 0x43 0x44 — esp,

i.e esp is point to 0x44. When we call 0x80. it should print “DCBA”. What I missed?

Answer 1

Your stack picture is wrong. Because x86 is a little-endian architecture, ESP is equal to the address of the least-significant byte in the pushed value, or 0x41.

From Intel’s priceless Architecture Developer’s Manual:

When an item is pushed onto the stack, the processor decrements the
ESP register, then writes the item at the new top of stack.