So if I would have something like this
rout:
pop eax
pop ecx
add ecx,2
push ecx
ret
Then just
push 3
call rout
I’ve noticed that the first time to pop isn’t going to give me the value 3 as I thought it would, instead I get it after the first pop.
My question is, what is the last value pushed to the stack while I’m calling it? (In register eax in this example)
Assuming your are working with 80×86 architecture:
It’s the return address of the proc (if its a near call). The next POP would give you your value (3) if it was a NEAR call, or the segment of the return address in case it was a FAR call.
Check this site for pseudocode of what actually happens when you issue a CALL.