It's in the frame pointer.<p>Edit: You're right, optimized code might not save the frame pointer and this wouldn't provide any benefit if your frame had unknown size.  But usually the preamble saves the old ESP in EBP and it is restored at the end.  Maybe there is another alternative.