.NET functions disassembled

Question

When disassembling .NET functions, I notice that they all start with a similair pattern. What does this initial code do?

This code appear before the actual code for what the function is supposed to do. Is it some sort of parameter count verification?

func1

private static void Foo(int i)
{
   Console.WriteLine("hello");
}

00000000  push        ebp 
00000001  mov         ebp,esp 
00000003  push        eax 
00000004  mov         dword ptr [ebp-4],ecx 
00000007  cmp         dword ptr ds:[005C14A4h],0 
0000000e  je          00000015 
00000010  call        65E0367F 
//the console writleline code follows here and is not part of the question

func2

static private void Bar()
{
   for (int i = 0; i < 1000; i++)
   {
      Foo(i);
   }
}

00000000  push        ebp 
00000001  mov         ebp,esp 
00000003  push        eax 
00000004  cmp         dword ptr ds:[006914A4h],0 
0000000b  je          00000012 
0000000d  call        65CC36CF 
// the for loop code follows here

func3

private static void Foo()
{
   Console.WriteLine("hello");
}

00000000  push        ebp 
00000001  mov         ebp,esp 
00000003  cmp         dword ptr ds:[005614A4h],0 
0000000a  je          00000011 
0000000c  call        65E3367F 

[Edit] So is this a correct description of it?

//fix stackframe
00000000  push        ebp 
00000001  mov         ebp,esp 
//store eax so it can be used locally
00000003  push        eax 
//ensure static ctor have been called
00000004  cmp         dword ptr ds:[006914A4h],0 
//it has been called, ignore it
0000000b  je          00000012
//it hasn't been called, call it now 
0000000d  call        65CC36CF 

or?

Answer 1

This prologue has two parts.

Setting up the stackframe

This stores the current EBP register on the stack and then assigns the value of the stackpointer(ESP) to EBP.

push        ebp 
mov         ebp,esp

If there are local variables that are stored on the stack (i.e. not enough space in the registers available) then ESP will be moved by their size to build the stackframe of the current function.

And at the end of the function you'll see these operations reversed, so the stack-frame of the previous function gets restored.

EBP should always point to the beginning of the stackframe of the current function
ESP to the end(which has a lower address on x86 because the stack grows downwards).

This is part of the common calling conventions and needed for stack unrolling when an exception is thrown. This is not .net specific and used by most calling conventions on windows/x86.

After setting up the stackframe its common to store some registers on the stack. That's because you might want to use certain registers as temporary variables, but the calling convention requires your function to conserve them. So you need to back them up on the stack. Which registers must be preserved and which can be modified depends on the calling convention you use.

When referring to local variables on the stack you can use [ebp-x] where ebp points to the beginning of the stackframe, and x is an offset which indicates where in the stackframe the variable is stored. Alternatively you can use [esp+y] with an offset from the end of the stackframe.

Call to the static constructor/initializer

As danbystrom noticed the second part is most likely the call to a static constructor/initializer. Since the static constructor is not called on program startup but on the first access, every access for which the jitter can't guarantee that the static constructor has already executed needs to check if it has been called, and then calls it if not.

00000004  cmp         dword ptr ds:[006914A4h],0 
0000000b  je          00000012 
0000000d  call        65CC36CF

This is something like if (globalVar!=0) Call Function_65CC36CF. Where most likely the global var indicates if the static constructor has run, and the call is a call to the static constructor.

---

As far as I know your comments on the disassembly are correct.

---

Check this OldNewThing blog entry on stackframes: How to rescue a broken stack trace: Recovering the EBP chain

Answer 2

Since your methods are all static: the code is used to check if the class' static initializer has yet been executed.

00000007  cmp    dword ptr ds:[005C14A4h],0  ; test if static initializer has executed
0000000e  je     00000015                    ; skip call to initializer if already done
00000010  call   65E0367F                    ; call static initializer
00000015  ....                               ; continue with the method's code

Answer 3

If you're talking about the push and the mov, it's just fixing up the callstack. I'm not sure what the remainder of those segments is doing off the top of my head.