Question

The following code

int _main() {return 0;}

Compiled using the command:

gcc -s -nostdlib -nostartfiles 01-simple.c -o01-simple.exe

gcc version 4.4.1 (TDM-1 mingw32)

OllyDbg produced this output:

Can you explain what happens here?
Analysis so far:

// these two seems to be an idiom:
PUSH EBP        // places EBP on stack
MOV EBP, ESP    // overwrites EBP with ESP

MOV EAX, 0      // EAX = 0

LEAVE          // == mov esp, ebp
               //    pop ebp
               // according to 
               // http://en.wikipedia.org/wiki/X86_instruction_listings

What is the meaning of all this?

Answer 1

This creates a stack frame.

PUSH EBP      
MOV EBP, ESP  

In the calling convention being used, the return value is sent back via EAX (so the 0 is there because you wrote return 0; – try changing that to return 1; and see how that affects the code).

MOV EAX, 0 

And this tells the processor to clean up the stack frame (it’s the equivalent of MOV ESP, EBP followed by POP EBP which is the opposite of what was done when creating the stack frame):

LEAVE