Return to Question

IDA Pro displays certain buffer or padding above (at lower addresses) local variables in stack frame view. For instance:

Example 1.
The following screen shot of stack frame view shows 12 bytes (included in the red box) buffer:

Example 2.
The following screen shot of a different stack frame view shows 12 bytes buffer again:

I understand that IDA marked it as db ?; undefined because it couldn't figure out how it was used. I also realize that IDA automatically calculates size of a stack frame by monitoring ESP. I would assume it might have something to do with non-volitile register save area. However, in Example 1 it clearly shows Saved regs: 0 and in Example 2 it shows Saved regs: 4. I am puzzled, and here go my questions:

Why does IDA Pro display certain buffer or padding above (at lower addresses) local variables in stack frame view? Is it a coincidence that both views show exactly 12 bytes buffer? Is it something particular to certain calling convention?

IDA Pro displays certain buffer or padding above (at lower addresses) local variables in stack frame view. For instance:

Example 1.
The following screen shot of stack frame view shows 12 bytes (included in the red box) buffer:

Example 2.
The following screen shot of a different stack frame view shows 12 bytes buffer again:

I understand that IDA marked it as db ?; undefined because it couldn't figure out how it was used. I also realize that IDA automatically calculates size of a stack frame by monitoring ESP. I would assume it might have something to do with non-volitile register save area. However, in Example 1 it clearly shows Saved regs: 0 and in Example 2 it shows Saved regs: 4. I am puzzled, and here go my questions:

Why does IDA Pro display certain buffer or padding above (at lower addresses) local variables in stack frame view? Is it a coincidence that both views show exactly 12 bytes buffer? Is it something particular to certain calling convention or complier?

IDA Pro displays certain buffer or padding above (at lower addresses) local variables in stack frame view. For instance:

Example 1.
The following screen shot of stack frame view shows 12 bytes (included in the red box) buffer:

Example 2.
The following screen shot of a different stack frame view shows 12 bytes buffer again:

I understand that IDA marked it as db ?; undefined because it couldn't figure out how it was used. I also realize that IDA automatically calculates size of a stack frame by monitoring ESP. Here go my questions:

Why does IDA Pro display certain buffer or padding above (at lower addresses) local variables in stack frame view? Is it a coincidence that both views show exactly 12 bytes buffer? Is it something particular to certain calling convention? Is it somehow related to function structured exception handlers (technically SEH should go below local variables)?

IDA Pro displays certain buffer or padding above (at lower addresses) local variables in stack frame view. For instance:

Example 1.
The following screen shot of stack frame view shows 12 bytes (included in the red box) buffer:

Example 2.
The following screen shot of a different stack frame view shows 12 bytes buffer again:

I understand that IDA marked it as db ?; undefined because it couldn't figure out how it was used. I also realize that IDA automatically calculates size of a stack frame by monitoring ESP. I would assume it might have something to do with non-volitile register save area. However, in Example 1 it clearly shows Saved regs: 0 and in Example 2 it shows Saved regs: 4. I am puzzled, and here go my questions:

Why does IDA Pro display certain buffer or padding above (at lower addresses) local variables in stack frame view? Is it a coincidence that both views show exactly 12 bytes buffer? Is it something particular to certain calling convention?

IDA Pro displays certain buffer or padding above (at lower addresses) local variables in stack frame view. For instance:

Example 1.
The following screen shot of stack frame view shows 12 bytes (included in the red box) buffer:

Example 2.
The following screen shot of a different stack frame view shows 12 bytes buffer again:

I understand that IDA marked it as db ?; undefined because it couldn't figure out how it was used. I also realize that IDA automatically calculates size of a stack frame by monitoring ESP. Here go my questions:

Why does IDA Pro display certain buffer or padding above (at lower addresses) local variables in stack frame view? Is it a coincidence that both views show exactly 12 bytes buffer? Is it something particular to certain calling convention?

IDA Pro displays certain buffer or padding above (at lower addresses) local variables in stack frame view. For instance:

Example 1.
The following screen shot of stack frame view shows 12 bytes (included in the red box) buffer:

Example 2.
The following screen shot of a different stack frame view shows 12 bytes buffer again:

I understand that IDA marked it as db ?; undefined because it couldn't figure out how it was used. I also realize that IDA automatically calculates size of a stack frame by monitoring ESP. Here go my questions:

Why does IDA Pro display certain buffer or padding above (at lower addresses) local variables in stack frame view? Is it a coincidence that both views show exactly 12 bytes buffer? Is it something particular to certain calling convention? Is it somehow related to function structured exception handlers (technically SEH should go below local variables)?