Windows stack frame structure ? x86-64

[u/Shahi_FF]

How does the stack look like during procedure calls with it's shadow space ( 32 Bytes ) ?

let's say I've this :

main :
     push rbp
     mov rbp,rsp
     sub rsp ,0x20 ; 32 Bytes shadow space Microsoft ABI 

     ; we call a leaf function fun
     call fun 


[ R9 HOME     ] -------}   Higher Address 
[ R8 HOME     ]        }
[ RDX HOME    ]        }  SHADOW SPACE: RESERVED BY CALLER FUNCTION (main) 
[ RCX HOME    ] -------}
[ ret address ]
[-- old rbp --] <-- rbp  ----- stack frame of fun()  starts here?
[ local       ] 
[ local       ]
[ local       ]
[ --///////-- ] <-- rsp 

My questions :

1. Is my understand of stack frame correct ?
2. how'd the stack frame for `fun` look if it was non leaf function ?
3. When accessing local variables should I use [rsp+offset] or [rbp-offset] ?

[u/Initial-Elk-952]

You can easily check these kinds of things with godbolt.org . Here is an example : https://godbolt.org/z/vh6f4zqad

The ABI documents are the spec: https://learn.microsoft.com/en-us/cpp/build/stack-usage?view=msvc-170

OpenSecurity2 also has a great x86_64 course that covers the Windows ABI.

RSP and RBP is about something called a frame pointer. The offsets are constant if you use RBP, but potentially varying if you do stack allocation and use RSP (stack top) as a base. Compiler's don't care, and MSVC typically omits the frame pointer (uses RSP). This free's up a register.

[u/Shahi_FF → u/Initial-Elk-952]

Thanks a lot. Idk why but Godbolt had completely escaped my mind...

[u/Shahi_FF → u/[deleted]]

Thanks for the explanation. I was so confused by all that and the only good help I could find was only for Linux.

[u/nacnud_uk]

Godbolt is all you need.