Whenever I attach a process in OllyDbg v1.10 on my Windows 7 64-bit machine, I notice that the first saved EBP on the stack doesn't point to the very base of the stack. Instead it points 16 bytes before it.
To illustrate what I mean, see the following screenshot:
The EBP (highlighted in gray), which is right above the
RETURN to ntdll.76FC9F45, is pointing to
1B05FFEC. Note that this address ends with
Question 1: Why isn't the EBP pointing to
Question 2: What do the first 16 bytes on the stack represent?
Question 3: Is the number of bytes (16), which are between
StackBase and the address to where the first
EBP points to, fixed for Windows OSs?