We Just Closed a $8 million Series A Funding

We are proud to announce that we have just closed a new round of funding. Our Series A, led by daphni and Trinity Ventures and joined by new investor Omidyar Network. This new funding of $8.2 million will allow us to provide the Holberton School opportunity to even more students.

The school’s population has increased 6 fold – enrolling to date more than 200 students. We recently moved into a new location that can eventually accommodate 1,000 students. While we are about to graduate our first cohort, many of our students have already found internships and jobs at companies like Apple, Tesla, Docker, Dropbox, LinkedIn, IBM, Scality and more.

As Julien, our CEO, says “Everyone deserves a first-rate education. Students at Holberton come from all walks of life, from cashiers to musicians to poker players  – as well as right out of high school – without the money, background and education needed to be ‘Ivy League material. With Holberton, they now have the same opportunity as the more fortunate and they leave with skills to learn for a lifetime. Our students compete with Ivy League graduates and get the jobs.”

Holberton School students celebrating
Holberton School students celebrating

We launched 2016, the school is free until students find a job. We use a project-based and peer-learning approach, where students learn by working on projects and helping each other. There are no lectures and no teachers, instead tech mentors who provide guidance to the students both on the curriculum and on their careers via keynotes and fireside chats.

Marie Ekeland, daphni co-founder says that “Holberton is not just supplying the STEM community with the highest level full stack software engineers, they are offering everyone, regardless of race, age, sex or family background the opportunity to be part of this amazing industry.”

Our students have published articles on popular websites and gone on to amazing jobs. Like participating in the future of self-driving cars at Tesla and even a coveted internship at NASA’s SETI Institute, protecting the earth from asteroids.

As our dear Board of Trustees member, NE-YO, said: Let’s make Holberton one of the biggest schools on the face of the planet.

 

Mentor Mania

Holberton’s curriculum is unique in the way that it’s continually iterating based upon feedback from mentors and industry trends. Mentors are professionals working in the Tech industry, from small companies like Gandi and Scality, up to the Facebook and Google of the world.  It is our pleasure to welcome new mentors to the Holberton family. We’re excited about the varying areas of expertise these tech professionals will be joining us with.

Without further ado, we introduce you to the newest additions to the Holberton School Mentor program…

Evelyn de Souza

Evelyn is a Data Privacy and Security Strategy leader who serves as an advisor to several startups and has been overhauling and re-institutionalizing security and privacy in the smallest to the largest organizations in order to protect user’s personal data, as part of her consultancy. She has been recognized as one of the Top 10 Women in Cloud by CloudNOW and as a Silicon Valley Business Journal Woman of Influence. During a sabbatical last year, Evelyn took six months to launch a non-profit affordable housing initiative in her community which has become the launch pad for her next generation community concept.

 

Michael Kehoe

Michael is a Staff Site-Reliability Engineer (SRE) at LinkedIn working with various teams within the company to improve their operability experience. Thanks for Michael that your favorite professional social network is always up and running. Michael has experience in systems engineering from frontend proxies to backend databases. Before joining LinkedIn, Michael interned at NASA working on the PhoneSat project.

 

Paul Guermonprez

Paul is an autonomous drone software architect and drone big-data analyst for Intel. One of his projects is working with Intel clients to analyze data gathered from drones with computer vision, 3D reconstruction and deep learning using Intel Insight, Intel’s drone data solution. Another one is designing autonomous drone solutions for complex cases like indoor navigation and delivery fleets. He started as bioinformatician in human biotech for 8 years, then moved to tech to focus on high-performance computing and IoT. He is now helping Intel partners build autonomous and data driven drone solutions. In his spare time, Paul is a pedagogical consultant for higher education and is teaching Entrepreneurship and Innovation at Toulouse University in France.

 

Han Yuan

Han, the Senior Vice President of Engineering at Upwork, has joined the mentor team at Holberton School. Han has a genuine interest in alternative education models. “Knowledge pays dividends for the rest of someone’s life.” In joining the mentor team, Han hopes to help pass along the valuable knowledge he’s gained over his 19 years working in tech. To Han, mentoring can be both personally and professionally gratifying adding that Holberton School is cultivating a strong and diverse talent pool.

We are proud to offer a malleable mentor program in which mentors have the opportunity to choose what areas they want to help with as well as how often they would like to be involved. If you’re interested in becoming a mentor at Holberton, check out the info here.

Student Spotlight: Corbin Coleman

We’ve said it before and we’ll say it again; the varied student body is an integral ingredient in our Holberton School’s secret sauce. We look forward to having more high school students like Corbin Coleman join the Holberton School community. I caught up with Corbin over a complimentary (and tasty!) lunch at Docker HQ to chat about his time at Holberton, his internship at Docker and how his hard work has recently paid off with a transition from intern to full time software engineer!

Corbin ringing the Job Gong @ Holberton School, signaling he landed an internship!

Corbin’s story starts like a lot of American students, he graduated high school and decided that he would attend a community college to complete his general education classes. “I was accepted to a four year university but looking at how much debt you have to go into, I thought it was ridiculous.” While community college can be a more affordable option than university, the education model is based on passive learning where instruction is mostly about theory.  Corbin was looking for a more practical education where he would learn by doing, preparing him for the industry. Holberton School was a natural choice for Corbin with its project based curriculum, and the fact that there is no upfront tuition sealed the deal for him. “I did not have to choose between quality and affordability, Holberton was offering both.”

Not unlike many 20-somethings, while attending community college Corbin was working as a server during the “in-between” time after high school. It was during this time Corbin discovered Holberton School. “My dad first introduced me to Holberton. Then he explained to me that this school was the direct opposite of everything I didn’t like about traditional education.” This was the type of program Corbin could see himself succeeding in being that Holberton’s education model follows a project based and peer learning structure.

Fast forward to the point of the internship period in Holberton’s curriculum. “One of the key elements that got me prepared for job interviewing was white boarding.” Corbin explains that the built in technical interview practice increased not only his whiteboarding skills, but his confidence.

Corbin helps the container crew @ Docker HQ!

“Beyond the technical concepts, Holberton does a great job of making it [school] feel like what work feels like.” Corbin noted that the peer based learning structure prepared him to work on the software engineering team he’s a part of now in one of San Francisco hottest startup, Docker. “I learned how to communicate with people that didn’t come from the same background as me.” We’re increasingly seeing the trend in Silicon Valley of skills, not (necessarily) degrees. The soft skills we bolster at Holberton School bring that phrase to life and Corbin is here to prove it.

Corbin’s seamless move from high schooler, to server, to Holberton School student may show an unconventional path but he seems satisfied with his ultimate decision. “Because the way Holberton is run, and the way the curriculum is written I now have a skill set available of being able to teach myself new concepts.”

A Day In The Life of a Holberton Student

Applying to a software engineering program can seem daunting when you look at the big picture. There’s this new subject you’re trying to learn that may seem abstract- pair that with all of the jargon and the logic-heavy problem solving and one might feel overwhelmed with fear. Well, fear not! We wanted to show you what a typical day in a peer learning and project based program looks like.

MORNING – PLD

Peer Learning Days (PLDs) are days where a given cohort is split into groups to review recently covered concepts. PLD groups are made large enough so multiple perspectives can be shared, but small enough to make each student feel individually engaged. These groups generate a positive amount of peer pressure to encourage students to share their thought processes. Students oftentimes spread out over living room style seating, or even bean bags to gear up for a day of collaboration.

Students begin their PLD with a clear whiteboard!

11:30 AM  – DAILY STAND UP MEETING

We simulate what it’s like working in a true engineering environment. The exposure to the working environment structure is invaluable to folks who will be entering the world of Silicon Valley for the first time. “Stand Ups” are used as an efficient way to ensure everyone on a team is on the same page. At Holberton School these daily Stand Up meetings are a chance for the staff and students to make announcements about upcoming events, projects, etc. Holberton School also uses these daily meetings as a time for students to practice their public speaking skills! Each day a student is gives a succinct presentation on a subject of their choosing. Public speaking doesn’t always come easy for people, and at Holberton we think it’s a soft skill that can help to set our students apart from other software engineers.

LUNCH

Students use lunchtime as a way to take socialize further with their fellow future software engineers. Whether folks choose to bring their own or explore the culinary world of San Francisco, you can bet that from during lunch hour the kitchen is electric with students buzzing about weekend plans, discussing concepts they’re touching upon that day, and of course any number of conversations around blockchain, AI, and other hot tech topics.

Students kick back with a laugh over lunch.

AFTERNOON- PLD: CONTINUED

Re-energized and ready for more review, the groups reconvene to continue their day of peer learning. After much whiteboarding, students extend this peer learning exercise to practical application of these concepts. This mix of understanding programming concepts and practical application is a combination paving the way to success for our students.

EVENING – POST PLD

It isn’t out of the ordinary to see students sticking around after PLD has officially ended. Students are either diving deeper into some of the advanced problems and concepts for extra credit or spending extra time reviewing the mandatory tasks of the day to solidify their understanding of the concepts. We are proud to have cultivated the “above & beyond” work ethic with many of our students resulting in after hours diving deeper with peer learning.

THE WHY

The peer learning model serves as practice for students who will be asked to collaborate with peers in a real working environment. Holberton believes soft skills are of equal importance to technical skills. Furthermore, students that fully gain an understanding of a topic are able to practice their coaching skills; tapping into Einstein’s theory that “If you can’t explain it simply, you don’t understand it well enough.” Conversely, PLDs are also one of the best times for students struggling with a specific concept to catch up. The mantra of teamwork makes the dream work” becomes personified through our peer learning days!

Student Stories: Swati Gupta

One of the most consistent themes at Holberton School is the diverse variety of backgrounds represented in our student body. We’ve had the pleasure of cultivating a true melting pot. Holberton student, Swati Gupta, makes an invaluable contribution to the melting pot culture, bringing her experience from a former career in India. Swati dove into the curriculum head first, quickly distinguishing herself as one of our hardest working students.

Swati originally pursued a career in psychology in New Delhi, India. After earning her master’s degree she began working as a counselor. Upon moving to San Francisco, a hub of tech innovation, Swati became interested in a career pivot. Having no prior programming experience, she enrolled in a community college’s computer science program to learn more. “I could’ve received my associate’s degree in computer science but there were general classes in English and social science that I was not interested in, so I didn’t get the degree” Swati explains. Realizing the community college structure was not for her, she reevaluated her options.

Swati Gupta (pictured front right) dines on a mentor led visit to LinkedIn with fellow students and Holberton School co-founder, Julien Barbier

“Holberton offered a more comprehensive software engineering training” was Swati’s reasoning for choosing Holberton School. We pride ourselves on focusing on the bigger picture. For example, many other programs focus on one specific language or technology, but at Holberton, students work across many different languages and levels preparing them to emerge from the program as a full stack software engineer. “Before Holberton I didn’t know how to use the command line, I didn’t know basic admin commands, how to debug my system when something goes wrong, or how to make my system more secure.” Learning these skills would soon help Swati in her search for an internship.

Swati poses with NVIDIA CEO, Jensen Huang

It wasn’t long before she was deciding between a SRE (site-reliability engineer) role with Apple and an engineering internship with NVIDIA. In the end, it was the exciting work that NVIDIA is doing around deep learning and AI that sealed the deal for her. Swati excelled in her internship role and has recently moved into a permanent full-time position as a Software Engineer. Although Swati made the journey look easy, she does have advice for folks interested in learning more “People should really be introspective. It shouldn’t be a one-off thing where they want to get a job and earn money. It’s not that easy. You really have to put yourself into it and keep learning.” Interested in a switch up like Swati? Check out more details about Holberton School here.

Mentor Spotlight: Ayesha, Senior UX Engineer at Salesforce

Holberton School’s curriculum places emphasis on mentor relationships. We have mentors spanning various verticals across the tech industry–from Senior Software Engineer, Ludovic Galibert at Netflix to Neha Jain a Software Engineer at LinkedIn. These mentorships are a win-win for industry veterans in many ways. For Ayesha Mazumdar, a Senior UX Engineer at Salesforce, mentoring has been a constant ever since her high school years. Opportunities to mentor has meant personal growth and, in turn, advancement in her career.

Ayesha (pictured here furthest to the left) poses with Holberton students after a tour and an animation workshop @ Salesforce

Ayesha started a Computer Science Club when she was in high school whose mission was to visit local middle schools and begin teaching students the coding basics. Her passion for mentoring continued throughout her college career, working towards a similar goal. After graduating, Ayesha was eager to get connected with her next mentoring relationship when Holberton School sparked her interest stating “the whole Holberton School system really resonated with me…” She explained to me she was drawn to the practical nature of the curriculum and wanted to help impact the next generation of software engineers.

This was Ayesha’s first time mentoring adults. “It helped me get a different sense of what it’s like to mentor your peers.” She goes on to explain “the experience is mutually beneficial since I get practice explaining technical concepts to adults.” Making the point that mentoring is of equally beneficial to the mentor and mentee, Ayesha credits some of her professional growth to the skills she was able to learn and refine through her participation in Holberton’s mentor program. “All the projects I see in the Holberton curriculum help to give me a sense of technology I should be keeping up with.”

Ayesha participating in a prospective student Q&A @ Holberton School

We chatted about what skills Ayesha relies on to do her job most efficiently, and it’s no coincidence the skills she highlights are paramount in Holberton’s curriculum. “Communication, definitely! You have to be able to communicate well with your technical and non-technical peers. Being comfortable speaking in front of a group of your peers is also super important.” Communication and public speaking practice are two hallmarks of our program.

Ayesha has a few words of wisdom for the aspiring mentor “One of the great parts about mentoring is seeing that each person has a very different perspective on how certain things work depending upon how they were brought up in the industry–I think that if someone wants to be a mentor they should remember that they can bring value to at least one person.” Ayesha’s even if it helps just one person it was worth it mindset is an asset to our mentoring program. It’s no surprise she’s experiencing success in the form of upward mobility in the Salesforce organization. We look forward to our continued relationship with Ayesha and commend her for all of her mentoring service. If you’re interested in becoming a mentor check out the info here!

Throwin’ It Back to 2017: Holberton School’s Year In Review

The past year has been notable for Holberton School in a variety of ways. We’ve welcomed growth within our student body, forged new relationships with a tech heavy hitters, and even received rave reviews from industry titans. In addition to these newfound relationships, our students are succeeding in all of the way we had hoped. Holberton students are landing jobs and internships at great places including but not limited to Tesla, LinkedIn, Apple, and IBM! We’ve narrowed our list to 5 memorable moments, check out the highlights below:

 

5. Home is where the students are…

We are excited to be settled into our new home in San Francisco’s SoMa neighborhood! Our new spot boasts plenty of comfy nooks for studying, meetings, and even relaxing. Our spacious digs provide us with plenty of room to grow and welcome more students into the Holberton School family. We feel right at home in our new space, located on Mission and 5th/6th. With neighbors like Slack, Eventbrite, Yahoo, and Y Combinator, the networking possibilities are endless!

Soft seating and iMacs abound in Holberton School’s new space!

Located at Mission and 5th/6th in the SOMA district of San Francisco, the new location is close to tech companies including Slack, Eventbrite, Yahoo, Y Combinator and more. Location is critical because students are required to intern for as much as half of the school’s 2-year program. The 28,500 sqft is in a six story building (61,000 sqft), with an option to take over the entire building.

 

4. If you’ve got it to give, give it away…

It has been with tremendous gratitude that we have partnered with Google, Scality, Accenture, and CloudNOW to present Holberton students with scholarships to alleviate the cost-of-living associated with the San Francisco Bay Area.  These scholarships were presented to students at Google’s annual #TopWomenInCloud event by Vint Cerf, father of the Internet and inventor of the TCP/IP technology.

(L to R) Sylvain Kalache, Vint Cerf, Kristen Loyd (student)

3. Talkin’ the talk while & walkin’ the walk…

Holberton School students are tenacious by nature. Student, Elaine Yeung, caught the attention of Linus Torvalds, the inventor of the Linux Kernel system, with her rap all about bash. So, when Holberton School co-founder, Julien Barbier, challenged Elaine to take a selfie with Linus in a Holberton t-shirt it was game on. Torvalds graciously obliged Elaine with a selfie and conversation. She walked away from the meeting elated to have been able to meet an innovation legend.

Linus Torvalds w/ Holberton School Student, Elaine Yeung

2. “We’re a movement by ourselves, but we’re a force when we’re together…”

NEYO joined Holberton School’s Board of Trustees. “I just love the fact of what they’re doing with the school — that they’re making it easier for underrepresented people in the world of tech. They’re giving them a platform and access to this knowledge that they probably wouldn’t get otherwise. I think that’s one of the coolest things about this whole situation.” With his support and guidance we are proud to have a diverse student body. In addition to growing our Board of Trustees, we welcomed the support of LinkedIn CEO, Jeff Weiner, as an investing advisor. We are thrilled at the opportunity to be under the tutelage of Jeff and look forward to working together with him towards fulfilling our mission to provide quality education to the most!

(L to R) Sylvain Kalache, Jeff Weiner, Julien Barbier pose for a #selfie
(L to R) Sylvain Kalache, NEYO, Julien Barbier

1. They like us, they really like us…

We were sincerely honored by Business Insider’s decision to include Holberton School on it’s list of the 19 hottest San Francisco startups to watch in 2018. Recognizing us as an organization that “flips education on its head” is something the Holberton team is profoundly proud of. We are currently hiring, check out our open positions!

Holberton School staff pose for Business Insider’s list of 19 Hottest SF Startups!

Thank you to everyone who played a role in the school’s success this past year, we truly appreciate each and every one of you! We look forward to an even more exciting 2018!

Let Me Upgrade Ya: Holberton School Moves Into New SOMA Location!

Everyone in the Holberton School family from staff, to mentors, to Holbie fans are delighted with the move from San Francisco’s FiDi to it’s SOMA- or, South of Market- neighborhood! Located at Mission and 5th/6th in the SOMA district of San Francisco, the new location is close to tech companies including Slack, Eventbrite, Yahoo!, Y Combinator and more. This move comes at the perfect time as staff and students get ready to welcome the January 2018 cohort. The building can eventually accommodate up to 1,000 students and we are looking forward to opening the space to many more future software engineers.

In less than two years, the school has grown from 35 students in January 2016 to more than 150. With an expected January incoming class of 65, the previous space, even with a generous donation of space from tech neighbor Gandi could no longer accommodate the growth. In January, Holberton will graduate its first “cohort” of students, 90% of which are already working at companies like Apple, LinkedIn and Dropbox.

The upgrade is made notable by more than doubling the amount of space of the school’s original site. The new spot already feels like home to Holberton, complete with hardwood floors that glow in the natural light provided by the space’s sizable windows. We’ve decorated the space with both comfort and functionality in mind- as whiteboarding is one of the foundations of solving any programming problem, we’ve outfitted the space with enough whiteboard space to satisfy even the most voracious dry-erase-programmer!

While the average classroom setting is configured with desks in neat rows, facing the front of the room. Holberton has sought to accommodate all types of learners- are you the type to be most productive curled up in an armchair, sofa, or even a bean bag chair?! No problem, Holberton has a variety of options in that department with various living room-style vignettes. However, if you’re one to appreciate the typical desk/desktop setup we’ve got you covered, too. We’ve equipped our space with brand new iMacs accessible to all students.

The community vibe has not been lost in the larger space thanks to the finer details. Students can be found collaborating in the kitchen over a meal or sipping coffees, and even gathered in the meetup area bouncing around ideas with a student-led peer learning session. The ample space for collaboration lends itself to the peer learning model Holberton has founded its success upon. There are plenty of conference rooms for groups to work on projects if the open space doesn’t provide the vibe you’re looking for. 



If you’re curious about the new digs or just want to check out what Holberton is all about, our doors are always open for a visit and a chat. We’d be delighted to show you around and give you the 4-1-1 on Holberton’s curriculum and the opportunities in software engineering! We’ve even got an Open House scheduled for Thursday 1/18 @ 6:00 PM! This is the perfect excuse to come check out the school and chat with Holberton students, staff, and mentors!

We Get By With A Little Help From Our Friends

One of Holberton’s goals is to eliminate barriers to high-quality education. On top of having a no upfront tuition approach, we are going further with fundraising to help our students in need pay for living expenses. Holberton was invited to the Annual Top Women in Cloud Innovation Awards event hosted this year at Google where four students were awarded with Cost-of-Living Scholarships.

We’ve had the pleasure of teaming up with Google, Scality, and Accenture with this goal in mind. The total cost of living in San Francisco is 62.2% higher than the national average. When you take a look at the cost of housing in the San Francisco area — it’s about three times more than other cities in the U.S. Each of these organizations has helped alleviate the city’s cost of living for the four scholarship recipients. This initial round of scholarships were organized by CloudNOW’s facilitation of the fundraising. The CloudNOW STEM Scholarships are funded by Accenture, Google and were first announced in September, as a way to help students to pay for living expenses while attending Holberton.

Holberton believes that the cost-of-living should not hinder a student’s ability to attend the school and focus on their studies. “Holberton gave me another path after my goals were no longer served by traditional education, despite leaving me with a mountain of debt,” said Kristen Loyd, 26, of Brentwood, CA. Loyd is a former account relationship manager at an investment firm. “My only challenge was making ends meet until I could find a job and now Accenture has stepped in and relieved me of a great burden, for which I thank them.”

 

(L to R) Sylvain Kalache and Vint Cerf present Kristen Loyd with her scholarship.
(L to R) Sylvain Kalache, Vint Cerf, Tope Agboola, and Siki Giunta pose for a picture while presenting Tope with her scholarship.

Another scholarship recipient, Tope Agboola, has been juggling her time between Holberton’s intensive curriculum while maintaining a full time job. Her motivation and dedication made it a no-brainer for us to acknowledge her hard work with a bit of financial assistance.

We could not let Lindsey Hemenez’s dedication to her newfound passion go unnoticed. Lindsey was living in Elk Grove, California. Doing the math for you folks, that’s 6 hours of commuting a day. Lindsey was a rockstar at budgeting her time on the train so she was able to work on projects. The 6 hour commute soon became untenable, resulting in Lindsey having to move closer to the city. Although her commuting hours have shortened, the close proximity to the city has increased her financial stress.

New to the Holberton family, Miranda Evans is someone to keep an eye on! She’s decided to pursue a path to being a full stack software engineer via Holberton School. This decision, however, comes with it’s sacrifice of putting a pause on receiving an income in order to place her full attention on the curriculum.

All of these women strive to push the ball forward in integrating more women into the field of software engineering. With the helping hands of our corporate partners we are confident that they will find their way to success!

Shoutout to Jocelyn DeGance Graham who played an integral role in organizing not only the funding for the scholarships, but also in coordinating the Top Women In Cloud event, along with Susan Wu. We look forward to to our continued work towards the goal of eliminating barriers to high quality education.  Want to help us with training a highly qualified and diverse group of Software Engineers? Become a Corporate Partner and help by funding or recruiting our students.

Hack the virtual memory: the stack, registers and assembly code

hack the virtual memory, the stack, registers and assembly code

This is the fifth chapter in a series about virtual memory. The goal is to learn some CS basics in a different and more practical way.

If you missed the previous chapters, you should probably start there:

The Stack

As we have seen in chapter 2, the stack resides at the high end of memory and grows downward. But how does it work exactly? How does it translate into assembly code? What are the registers used? In this chapter we will have a closer look at how the stack works, and how the program automatically allocates and de-allocates local variables.

Once we understand this, we will be able to play a bit with it, and hijack the flow of our program. Ready? Let’s start!

Note: We will talk only about the user stack, as opposed to the kernel stack

Prerequisites

In order to fully understand this article, you will need to know:

  • The basics of the C programming language (especially pointers)

Environment

All scripts and programs have been tested on the following system:

  • Ubuntu
    • Linux ubuntu 4.4.0-31-generic #50~14.04.1-Ubuntu SMP Wed Jul 13 01:07:32 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
  • Tools used:
    • gcc
    • gcc (Ubuntu 4.8.4-2ubuntu1~14.04.3) 4.8.4
    • objdump
    • GNU objdump (GNU Binutils for Ubuntu) 2.2

Everything we cover will be true for this system/environment, but may be different on another system

Automatic allocation

Let’s first look at a very simple program that has one function that uses one variable (0-main.c):

#include <stdio.h>

int main(void)
{
    int a;

    a = 972;
    printf("a = %d\n", a);
    return (0);
}

Let’s compile this program and disassemble it using objdump:

holberton$ gcc 0-main.c
holberton$ objdump -d -j .text -M intel

The assembly code produced for our main function is the following:

000000000040052d <main>:
  40052d:       55                      push   rbp
  40052e:       48 89 e5                mov    rbp,rsp
  400531:       48 83 ec 10             sub    rsp,0x10
  400535:       c7 45 fc cc 03 00 00    mov    DWORD PTR [rbp-0x4],0x3cc
  40053c:       8b 45 fc                mov    eax,DWORD PTR [rbp-0x4]
  40053f:       89 c6                   mov    esi,eax
  400541:       bf e4 05 40 00          mov    edi,0x4005e4
  400546:       b8 00 00 00 00          mov    eax,0x0
  40054b:       e8 c0 fe ff ff          call   400410 <printf@plt>
  400550:       b8 00 00 00 00          mov    eax,0x0
  400555:       c9                      leave  
  400556:       c3                      ret    
  400557:       66 0f 1f 84 00 00 00    nop    WORD PTR [rax+rax*1+0x0]
  40055e:       00 00 

Let’s focus on the first three lines for now:

000000000040052d <main>:
  40052d:       55                      push   rbp
  40052e:       48 89 e5                mov    rbp,rsp
  400531:       48 83 ec 10             sub    rsp,0x10

The first lines of the function main refers to rbp and rsp; these are special purpose registers. rbp is the base pointer, which points to the base of the current stack frame, and rsp is the stack pointer, which points to the top of the current stack frame.

Let’s decompose step by step what is happening here. This is the state of the stack when we enter the function main before the first instruction is run:

the stack

  • push rbp instruction pushes the value of the register rbp onto the stack. Because it “pushes” onto the stack, now the value of rsp is the memory address of the new top of the stack. The stack and the registers now look like this:

the stack

  • mov rbp, rsp copies the value of the stack pointer rsp to the base pointer rbp -> rpb and rsp now both point to the top of the stack

the stack

  • sub rsp, 0x10 creates a space to store values of local variables. The space between rbp and rsp is this space. Note that this space is large enough to store our variable of type integer

the stack

We have just created a space in memory – on the stack – for our local variables. This space is called a stack frame. Every function that has local variables will use a stack frame to store those variables.

Using local variables

The fourth line of assembly code of our main function is the following:

  400535:       c7 45 fc cc 03 00 00    mov    DWORD PTR [rbp-0x4],0x3cc

0x3cc is actually the value 972 in hexadecimal. This line corresponds to our C-code line:

a = 972;

mov DWORD PTR [rbp-0x4],0x3cc is setting the memory at address rbp - 4 to 972. [rbp - 4] IS our local variable a. The computer doesn’t actually know the name of the variable we use in our code, it simply refers to memory addresses on the stack.

This is the state of the stack and the registers after this operation:

the stack

leave, Automatic de-allocation

If we look now at the end of the function, we will find this:

  400555:       c9                      leave  

The instruction leave sets rsp to rbp, and then pops the top of the stack into rbp.

the stack

the stack

Because we pushed the previous value of rbp onto the stack when we entered the function, rbp is now set to the previous value of rbp. This is how:

  • The local variables are “de-allocated”, and
  • the stack frame of the previous function is restored before we leave the current function.

The state of the stack and the registers rbp and rsp are restored to the same state as when we entered our main function.

Playing with the stack

When the variables are automatically de-allocated from the stack, they are not completely “destroyed”. Their values are still in memory, and this space will potentially be used by other functions.

This is why it is important to initialize your variables when you write your code, because otherwise, they will take whatever value there is on the stack at the moment when the program is running.

Let’s consider the following C code (1-main.c):

#include <stdio.h>

void func1(void)
{
     int a;
     int b;
     int c;

     a = 98;
     b = 972;
     c = a + b;
     printf("a = %d, b = %d, c = %d\n", a, b, c);
}

void func2(void)
{
     int a;
     int b;
     int c;

     printf("a = %d, b = %d, c = %d\n", a, b, c);
}

int main(void)
{
    func1();
    func2();
    return (0);
}

As you can see, func2 does not set the values of its local vaiables a, b and c, yet if we compile and run this program it will print…

holberton$ gcc 1-main.c && ./a.out 
a = 98, b = 972, c = 1070
a = 98, b = 972, c = 1070
holberton$ 

… the same variable values of func1! This is because of how the stack works. The two functions declared the same amount of variables, with the same type, in the same order. Their stack frames are exactly the same. When func1 ends, the memory where the values of its local variables reside are not cleared – only rsp is incremented.
As a consequence, when we call func2 its stack frame sits at exactly the same place of the previous func1 stack frame, and the local variables of func2 have the same values of the local variables of func1 when we left func1.

Let’s examine the assembly code to prove it:

holberton$ objdump -d -j .text -M intel
000000000040052d <func1>:
  40052d:       55                      push   rbp
  40052e:       48 89 e5                mov    rbp,rsp
  400531:       48 83 ec 10             sub    rsp,0x10
  400535:       c7 45 f4 62 00 00 00    mov    DWORD PTR [rbp-0xc],0x62
  40053c:       c7 45 f8 cc 03 00 00    mov    DWORD PTR [rbp-0x8],0x3cc
  400543:       8b 45 f8                mov    eax,DWORD PTR [rbp-0x8]
  400546:       8b 55 f4                mov    edx,DWORD PTR [rbp-0xc]
  400549:       01 d0                   add    eax,edx
  40054b:       89 45 fc                mov    DWORD PTR [rbp-0x4],eax
  40054e:       8b 4d fc                mov    ecx,DWORD PTR [rbp-0x4]
  400551:       8b 55 f8                mov    edx,DWORD PTR [rbp-0x8]
  400554:       8b 45 f4                mov    eax,DWORD PTR [rbp-0xc]
  400557:       89 c6                   mov    esi,eax
  400559:       bf 34 06 40 00          mov    edi,0x400634
  40055e:       b8 00 00 00 00          mov    eax,0x0
  400563:       e8 a8 fe ff ff          call   400410 <printf@plt>
  400568:       c9                      leave  
  400569:       c3                      ret    

000000000040056a <func2>:
  40056a:       55                      push   rbp
  40056b:       48 89 e5                mov    rbp,rsp
  40056e:       48 83 ec 10             sub    rsp,0x10
  400572:       8b 4d fc                mov    ecx,DWORD PTR [rbp-0x4]
  400575:       8b 55 f8                mov    edx,DWORD PTR [rbp-0x8]
  400578:       8b 45 f4                mov    eax,DWORD PTR [rbp-0xc]
  40057b:       89 c6                   mov    esi,eax
  40057d:       bf 34 06 40 00          mov    edi,0x400634
  400582:       b8 00 00 00 00          mov    eax,0x0
  400587:       e8 84 fe ff ff          call   400410 <printf@plt>
  40058c:       c9                      leave  
  40058d:       c3                      ret  

000000000040058e <main>:
  40058e:       55                      push   rbp
  40058f:       48 89 e5                mov    rbp,rsp
  400592:       e8 96 ff ff ff          call   40052d <func1>
  400597:       e8 ce ff ff ff          call   40056a <func2>
  40059c:       b8 00 00 00 00          mov    eax,0x0
  4005a1:       5d                      pop    rbp
  4005a2:       c3                      ret    
  4005a3:       66 2e 0f 1f 84 00 00    nop    WORD PTR cs:[rax+rax*1+0x0]
  4005aa:       00 00 00 
  4005ad:       0f 1f 00                nop    DWORD PTR [rax]

As you can see, the way the stack frame is formed is always consistent. In our two functions, the size of the stack frame is the same since the local variables are the same.

push   rbp
mov    rbp,rsp
sub    rsp,0x10

And both functions end with the leave statement.

The variables a, b and c are referenced the same way in the two functions:

  • a lies at memory address rbp - 0xc
  • b lies at memory address rbp - 0x8
  • c lies at memory address rbp - 0x4

Note that the order of those variables on the stack is not the same as the order of those variables in our code. The compiler orders them as it wants, so you should never assume the order of your local variables in the stack.

So, this is the state of the stack and the registers rbp and rsp before we leave func1:

the stack

When we leave the function func1, we hit the instruction leave; as previously explained, this is the state of the stack, rbp and rsp right before returning to the function main:

the stack

So when we enter func2, the local variables are set to whatever sits in memory on the stack, and that is why their values are the same as the local variables of the function func1.

the stack

ret

You might have noticed that all our example functions end with the instruction ret. ret pops the return address from stack and jumps there. When functions are called the program uses the instruction call to push the return address before it jumps to the first instruction of the function called.
This is how the program is able to call a function and then return from said function the calling function to execute its next instruction.

So this means that there are more than just variables on the stack, there are also memory addresses of instructions. Let’s revisit our 1-main.c code.

When the main function calls func1,

  400592:       e8 96 ff ff ff          call   40052d <func1>

it pushes the memory address of the next instruction onto the stack, and then jumps to func1.
As a consequence, before executing any instructions in func1, the top of the stack contains this address, so rsp points to this value.

the stack

After the stack frame of func1 is formed, the stack looks like this:

the stack

Wrapping everything up

Given what we just learned, we can directly use rbp to directly access all our local variables (without using the C variables!), as well as the saved rbp value on the stack and the return address values of our functions.

To do so in C, we can use:

    register long rsp asm ("rsp");
    register long rbp asm ("rbp");

Here is the listing of the program 2-main.c:

#include <stdio.h>

void func1(void)
{
    int a;
    int b;
    int c;
    register long rsp asm ("rsp");
    register long rbp asm ("rbp");

    a = 98;
    b = 972;
    c = a + b;
    printf("a = %d, b = %d, c = %d\n", a, b, c);
    printf("func1, rpb = %lx\n", rbp);
    printf("func1, rsp = %lx\n", rsp);
    printf("func1, a = %d\n", *(int *)(((char *)rbp) - 0xc) );
    printf("func1, b = %d\n", *(int *)(((char *)rbp) - 0x8) );
    printf("func1, c = %d\n", *(int *)(((char *)rbp) - 0x4) );
    printf("func1, previous rbp value = %lx\n", *(unsigned long int *)rbp );
    printf("func1, return address value = %lx\n", *(unsigned long int *)((char *)rbp + 8) );
}

void func2(void)
{
    int a;
    int b;
    int c;
    register long rsp asm ("rsp");
    register long rbp asm ("rbp");

    printf("func2, a = %d, b = %d, c = %d\n", a, b, c);
    printf("func2, rpb = %lx\n", rbp);
    printf("func2, rsp = %lx\n", rsp);
}

int main(void)
{
    register long rsp asm ("rsp");
    register long rbp asm ("rbp");

    printf("main, rpb = %lx\n", rbp);
    printf("main, rsp = %lx\n", rsp);
    func1();
    func2();
    return (0);
}

Getting the values of the variables

the stack

From our previous discoveries, we know that our variables are referenced via rbp – 0xX:

  • a is at rbp - 0xc
  • b is at rbp - 0x8
  • c is at rbp - 0x4

So in order to get the values of those variables, we need to dereference rbp. For the variable a:

  • cast our variable rbp to a char *: (char *)rbp
  • subtract the correct amount of bytes to get the address of where the variable is in memory: (char *)rbp) - 0xc
  • cast it again to a pointer pointing to an int since a is of type int: (int *)(((char *)rbp) - 0xc)
  • and dereference it to get the value sitting at this address: *(int *)(((char *)rbp) - 0xc)

The saved rbp value

the stack

Looking at the above diagram, the current rbp directly points to the saved rbp, so we simply have to cast our variable rbp to a pointer to an unsigned long int and dereference it: *(unsigned long int *)rbp.

The return address value

the stack

The return address value is right before the saved previous rbp on the stack. rbp is 8 bytes long, so we simply need to add 8 to the current value of rbp to get the address where this return value is on the stack. This is how we do it:

  • cast our variable rbp to a char *: (char *)rbp
  • add 8 to this value: ((char *)rbp + 8)
  • cast it to point to an unsigned long int: (unsigned long int *)((char *)rbp + 8)
  • dereference it to get the value at this address: *(unsigned long int *)((char *)rbp + 8)

The output of our program

holberton$ gcc 2-main.c && ./a.out 
main, rpb = 7ffc78e71b70
main, rsp = 7ffc78e71b70
a = 98, b = 972, c = 1070
func1, rpb = 7ffc78e71b60
func1, rsp = 7ffc78e71b50
func1, a = 98
func1, b = 972
func1, c = 1070
func1, previous rbp value = 7ffc78e71b70
func1, return address value = 400697
func2, a = 98, b = 972, c = 1070
func2, rpb = 7ffc78e71b60
func2, rsp = 7ffc78e71b50
holberton$

We can see that:

  • from func1 we can access all our variables correctly via rbp
  • from func1 we can get the rbp of the function main
  • we confirm that func1 and func2 do have the same rbp and rsp values
  • the difference between rsp and rbp is 0x10, as seen in the assembly code (sub rsp,0x10)
  • in the main function, rsp == rbp because there are no local variables

The return address from func1 is 0x400697. Let’s double check this assumption by disassembling the program. If we are correct, this should be the address of the instruction right after the call of func1 in the main function.

holberton$ objdump -d -j .text -M intel | less
0000000000400664 <main>:
  400664:       55                      push   rbp
  400665:       48 89 e5                mov    rbp,rsp
  400668:       48 89 e8                mov    rax,rbp
  40066b:       48 89 c6                mov    rsi,rax
  40066e:       bf 3b 08 40 00          mov    edi,0x40083b
  400673:       b8 00 00 00 00          mov    eax,0x0
  400678:       e8 93 fd ff ff          call   400410 <printf@plt>
  40067d:       48 89 e0                mov    rax,rsp
  400680:       48 89 c6                mov    rsi,rax
  400683:       bf 4c 08 40 00          mov    edi,0x40084c
  400688:       b8 00 00 00 00          mov    eax,0x0
  40068d:       e8 7e fd ff ff          call   400410 <printf@plt>
  400692:       e8 96 fe ff ff          call   40052d <func1>
  400697:       e8 7a ff ff ff          call   400616 <func2>
  40069c:       b8 00 00 00 00          mov    eax,0x0
  4006a1:       5d                      pop    rbp
  4006a2:       c3                      ret    
  4006a3:       66 2e 0f 1f 84 00 00    nop    WORD PTR cs:[rax+rax*1+0x0]
  4006aa:       00 00 00 
  4006ad:       0f 1f 00                nop    DWORD PTR [rax]

And yes! \o/

Hack the stack!

Now that we know where to find the return address on the stack, what if we were to modify this value? Could we alter the flow of a program and make func1 return to somewhere else? Let’s add a new function, called bye to our program (3-main.c):

#include <stdio.h>
#include <stdlib.h>

void bye(void)
{
    printf("[x] I am in the function bye!\n");
    exit(98);
}

void func1(void)
{
    int a;
    int b;
    int c;
    register long rsp asm ("rsp");
    register long rbp asm ("rbp");

    a = 98;
    b = 972;
    c = a + b;
    printf("a = %d, b = %d, c = %d\n", a, b, c);
    printf("func1, rpb = %lx\n", rbp);
    printf("func1, rsp = %lx\n", rsp);
    printf("func1, a = %d\n", *(int *)(((char *)rbp) - 0xc) );
    printf("func1, b = %d\n", *(int *)(((char *)rbp) - 0x8) );
    printf("func1, c = %d\n", *(int *)(((char *)rbp) - 0x4) );
    printf("func1, previous rbp value = %lx\n", *(unsigned long int *)rbp );
    printf("func1, return address value = %lx\n", *(unsigned long int *)((char *)rbp + 8) );
}

void func2(void)
{
    int a;
    int b;
    int c;
    register long rsp asm ("rsp");
    register long rbp asm ("rbp");

    printf("func2, a = %d, b = %d, c = %d\n", a, b, c);
    printf("func2, rpb = %lx\n", rbp);
    printf("func2, rsp = %lx\n", rsp);
}

int main(void)
{
    register long rsp asm ("rsp");
    register long rbp asm ("rbp");

    printf("main, rpb = %lx\n", rbp);
    printf("main, rsp = %lx\n", rsp);
    func1();
    func2();
    return (0);
}

Let’s see at which address the code of this function starts:

holberton$ gcc 3-main.c && objdump -d -j .text -M intel | less
00000000004005bd <bye>:
  4005bd:       55                      push   rbp
  4005be:       48 89 e5                mov    rbp,rsp
  4005c1:       bf d8 07 40 00          mov    edi,0x4007d8
  4005c6:       e8 b5 fe ff ff          call   400480 <puts@plt>
  4005cb:       bf 62 00 00 00          mov    edi,0x62
  4005d0:       e8 eb fe ff ff          call   4004c0 <exit@plt>

Now let’s replace the return address on the stack from the func1 function with the address of the beginning of the function bye, 4005bd (4-main.c):

#include <stdio.h>
#include <stdlib.h>

void bye(void)
{
    printf("[x] I am in the function bye!\n");
    exit(98);
}

void func1(void)
{
    int a;
    int b;
    int c;
    register long rsp asm ("rsp");
    register long rbp asm ("rbp");

    a = 98;
    b = 972;
    c = a + b;
    printf("a = %d, b = %d, c = %d\n", a, b, c);
    printf("func1, rpb = %lx\n", rbp);
    printf("func1, rsp = %lx\n", rsp);
    printf("func1, a = %d\n", *(int *)(((char *)rbp) - 0xc) );
    printf("func1, b = %d\n", *(int *)(((char *)rbp) - 0x8) );
    printf("func1, c = %d\n", *(int *)(((char *)rbp) - 0x4) );
    printf("func1, previous rbp value = %lx\n", *(unsigned long int *)rbp );
    printf("func1, return address value = %lx\n", *(unsigned long int *)((char *)rbp + 8) );
    /* hack the stack! */
    *(unsigned long int *)((char *)rbp + 8) = 0x4005bd;
}

void func2(void)
{
    int a;
    int b;
    int c;
    register long rsp asm ("rsp");
    register long rbp asm ("rbp");

    printf("func2, a = %d, b = %d, c = %d\n", a, b, c);
    printf("func2, rpb = %lx\n", rbp);
    printf("func2, rsp = %lx\n", rsp);
}

int main(void)
{
    register long rsp asm ("rsp");
    register long rbp asm ("rbp");

    printf("main, rpb = %lx\n", rbp);
    printf("main, rsp = %lx\n", rsp);
    func1();
    func2();
    return (0);
}
holberton$ gcc 4-main.c && ./a.out
main, rpb = 7fff62ef1b60
main, rsp = 7fff62ef1b60
a = 98, b = 972, c = 1070
func1, rpb = 7fff62ef1b50
func1, rsp = 7fff62ef1b40
func1, a = 98
func1, b = 972
func1, c = 1070
func1, previous rbp value = 7fff62ef1b60
func1, return address value = 40074d
[x] I am in the function bye!
holberton$ echo $?
98
holberton$ 

We have called the function bye, without calling it! ?

Outro

I hope that you enjoyed this and learned a couple of things about the stack. As usual, this will be continued! Let me know if you have anything you would like me to cover in the next chapter.

Questions? Feedback?

If you have questions or feedback don’t hesitate to ping us on Twitter at @holbertonschool or @julienbarbier42.
Haters, please send your comments to /dev/null.

Happy Hacking!

Thank you for reading!

As always, no one is perfect (except Chuck of course), so don’t hesitate to contribute or send me your comments if you find anything I missed.

Files

This repo contains the source code (X-main.c files) for programs created in this tutorial.

Read more about the virtual memory

Follow @holbertonschool or @julienbarbier42 on Twitter to get the next chapters! This was the fifth chapter in our series on the virtual memory. If you missed the previous ones, here are the links to them:

Many thanks to Naomi for proof-reading! ?