Hacker News new | ask | show | jobs
by mycall 1736 days ago
I understand the modifications part, but why would push/pop counts be mismatched?
2 comments

It was doing push/ret, ie. pushing stuff (addresses) and then returning to the pushed address. Or popping stuff without pushing before (saving the return address of something) and storing it somewhere.

That is of course perfectly legal, but not something you see in normal programs. In the end, it really helping me to understand how the stack works, but the first time I saw it, it was super confusing.

The return address is on the stack so if you push data and then return, that data is now interpreted as an address to jump to.