# push, pop, and the stack

We already know how a stack works. Here is a previous article to refer to: <https://hexisanoob.gitbook.io/hexisanoob/enum-and-initial-compromise/buffer-overflow-prep>

When we push on stack, the RSP increments from a higher memory address to lower. When we pop, the RSP decrements from lower to higher memory address.

Here is a code I wrote in assembly that performs basic push and pop opperations

```
global start

section .text
_start:

        mov rax,0xaaaaaaaabbbbbbbb
        push rax ; This would put rax's value on the top of stack

        push var1 ; This puts var1 on the top of the stack

        push qword [var1] ; This is a typecasting example. This typecasts the sequence of bytes in var1 as a quadword (8bytes) and puts on stack

        pop r15 ; pops r15 and so on for next 3 instructions
        pop r14
        pop rbx

        ; Exiting the program
        mov rax, 0x3c
        mov rdi, 0
        syscall


section .data
        var1: db 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11, 0x22
```

Let's launch this code in GDB TUI mode and layout regs and asm. We'll step through and dissect this code to see what is happening to the registers as we step to the next instructions.

<figure><img src="https://62284611-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MSvRnuhl_P5WCd1fZEn%2Fuploads%2FsnVcqezZTdz68L1PmZHJ%2Fimage.png?alt=media&#x26;token=100218b7-9509-4115-95b6-657c4d29d7fe" alt=""><figcaption></figcaption></figure>

Now, we can't see the stack as of now. So we'll set up a hook stop. This is a special command which is executed after every step: <https://sourceware.org/gdb/current/onlinedocs/gdb.html/Hooks.html>

I'm setting up a hook-stop to examine 4 giant words at the top of the stack (RSP)

**define hook-stop**\
**x/4xg $rsp**\
**end**

As we can see, the stack is now visible after every next step we take in GDB.

<figure><img src="https://62284611-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MSvRnuhl_P5WCd1fZEn%2Fuploads%2FsHTNFy0NZhLKZZv9MQM9%2Fimage.png?alt=media&#x26;token=d42731da-f888-43c5-a0d2-34b8d25f980d" alt=""><figcaption></figcaption></figure>

We take two next steps and observe how stack is now updated

<figure><img src="https://62284611-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MSvRnuhl_P5WCd1fZEn%2Fuploads%2FzNPw6Tq8AoTq6FtLUo5q%2Fimage.png?alt=media&#x26;token=acfdb018-d397-4625-b804-b5ea00eeab57" alt=""><figcaption></figcaption></figure>

We can similarly see how pop is working now. The value on top of the stack is now popped and stored in r15.

<figure><img src="https://62284611-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MSvRnuhl_P5WCd1fZEn%2Fuploads%2FR9IAxNAIM71r5U76RJVS%2Fimage.png?alt=media&#x26;token=64a7628f-7c4c-4d1b-9068-34609745f12c" alt=""><figcaption></figcaption></figure>

Similarly, other pops are working too

<figure><img src="https://62284611-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MSvRnuhl_P5WCd1fZEn%2Fuploads%2FEbm9dWraWpbx5c74fUmY%2Fimage.png?alt=media&#x26;token=3f0345a5-e1e7-4e13-959f-c8f1e61e6ed1" alt=""><figcaption></figcaption></figure>

Finally, the program exits.

Through this demo we are seeing how push and pop works. How stack is being populated nad we are visually seeing the stack as we go. Then we can also pop certain values and put them in different registers. This is another way to move data btw! This would be helpful in ROP and ROP-buffer overflows