Tutorial - The Stack

So what is the stack?

Well I hate to use the word in the definition, but it's just a metaphorical stack of bytes; or an abstract data type that serves as a collection of elements, with two principal operations.

PUSH

Adds an element to the collection.

POP

Removes the most recently added element that was not yet removed.

It uses a LIFO (last in, first out) behavior. So if we push value A onto the stack and then push value B, when we pop it will be value B first then value A with the second pop.[1]

Working with the Stack

So let's just dig in, if we have some code like this.

push 123ABC
push 00DEAD
push 00BEEF
pop dword ptr [TestVals]
pop dword ptr [TestVals+4]
pop dword ptr [TestVals+8]

And if we assemble this in some memory.

So let's set a breakpoint and watch the stack as we step though the opcode.

Note: to view the stack you may need to select it for viewing.

Code step 1

Code step 2

So it's here that we start to see the values on the stack.

Code step 3

Code step 4

Code step 5

And here we can start to see the values being popped in the reverse order that they were pushed.

Code step 6

Code step 7

And that's really all there is to the basics of the stack.

The thing to remember is that if you push in some injected code then you will need to pop in order to clean (or sanitize) the stack.

See Also

• Value Types
• Pointers
• The Stack
• AOBs

• How to attach to a process
• How to add script to table
• How to add addresses to the address list

• Cheat Engine Tutorial Guide (x32)
• Cheat Engine Tutorial Guide (x64)

• Finding values - Integers
• Finding values - Floats
• How to break and trace code in a process

• Tutorial - Cheat Form

Sources

1. wikipedia.org/wiki/Stack_(abstract_data_type)