Skip to main content

memory Memory allocation on the stack

Here is a sample function reversedfunction reverse engineered from aan easy program.:

main            proc near
var_70          = dword ptr -70h
var_6C          = dword ptr -6Ch
var_68          = dword ptr -68h
i_2             = dword ptr -54h
i               = dword ptr -4
push    ebp
mov     ebp, esp
and     esp, 0FFFFFFF0h
sub     esp, 70h
mov     [esp+70h+i], 0
jmp     short loc_804840A
loc_80483F7:
mov     eax, [esp+70h+i]
mov     edx, [esp+70h+i]
add     edx, edx
mov     [esp+eax*4+70h+i_2], edx
add     [esp+70h+i], 1
loc_804840A:
cmp     [esp+70h+i], 13h
jle     short loc_80483F7
mov     [esp+70h+i], 0
jmp     short loc_8048441
loc_804841B:
mov    eax, [esp+70h+i]
mov    edx, [esp+eax*4+70h+i_2]
mov    eax, offset aADD ; "a[%d]=%d\n"
mov    [esp+70h+var_68], edx
mov    edx, [esp+70h+i]
mov    [esp+70h+var_6C], edx
mov    [esp+70h+var_70], eax
call   _printf
add    [esp+70h+i], 1
loc_8048441:
cmp    [esp+70h+i], 13h
jle     short loc_804841B
mov    eax, 0
leave 
retn
main   endp

C code

#include <stdio.h>
int main() {
    int a[20];
    int i;
    for (i=0; i<20; i++)
        a[i]=i*2;
    for (i=0; i<20; i++)
        printf ("a[%d]=%d\n", i, a[i]);
    return 0; 
}

My questions are:

  1. Why is memory not allocated consecutively and why are some parts of the memory in between esp + 70h -54h and esp + 70h -68h, are not used?

  2. In sub esp, 70h, the number 70h seems to be a random number in a different program, and itit is often larger than we needsneed. Why notdon't the compiler just allocatedallocate what we need  ?

memory allocation on stack

Here is a sample function reversed from a easy program.

main            proc near
var_70          = dword ptr -70h
var_6C          = dword ptr -6Ch
var_68          = dword ptr -68h
i_2             = dword ptr -54h
i               = dword ptr -4
push    ebp
mov     ebp, esp
and     esp, 0FFFFFFF0h
sub     esp, 70h
mov     [esp+70h+i], 0
jmp     short loc_804840A
loc_80483F7:
mov     eax, [esp+70h+i]
mov     edx, [esp+70h+i]
add     edx, edx
mov     [esp+eax*4+70h+i_2], edx
add     [esp+70h+i], 1
loc_804840A:
cmp     [esp+70h+i], 13h
jle     short loc_80483F7
mov     [esp+70h+i], 0
jmp     short loc_8048441
loc_804841B:
mov    eax, [esp+70h+i]
mov    edx, [esp+eax*4+70h+i_2]
mov    eax, offset aADD ; "a[%d]=%d\n"
mov    [esp+70h+var_68], edx
mov    edx, [esp+70h+i]
mov    [esp+70h+var_6C], edx
mov    [esp+70h+var_70], eax
call   _printf
add    [esp+70h+i], 1
loc_8048441:
cmp    [esp+70h+i], 13h
jle     short loc_804841B
mov    eax, 0
leave 
retn
main   endp

C code

#include <stdio.h>
int main() {
  int a[20];
  int i;
  for (i=0; i<20; i++)
    a[i]=i*2;
  for (i=0; i<20; i++)
  printf ("a[%d]=%d\n", i, a[i]);
  return 0; 
}

My questions are:

  1. Why is memory not allocated consecutively and why some parts of the memory in between esp + 70h -54h and esp + 70h -68h, are not used?

  2. In sub esp, 70h, the number 70h seems a random number in different program and it is often larger than we needs. Why not the compiler just allocated what we need  ?

Memory allocation on the stack

Here is a sample function reverse engineered from an easy program:

main            proc near
var_70          = dword ptr -70h
var_6C          = dword ptr -6Ch
var_68          = dword ptr -68h
i_2             = dword ptr -54h
i               = dword ptr -4
push    ebp
mov     ebp, esp
and     esp, 0FFFFFFF0h
sub     esp, 70h
mov     [esp+70h+i], 0
jmp     short loc_804840A
loc_80483F7:
mov     eax, [esp+70h+i]
mov     edx, [esp+70h+i]
add     edx, edx
mov     [esp+eax*4+70h+i_2], edx
add     [esp+70h+i], 1
loc_804840A:
cmp     [esp+70h+i], 13h
jle     short loc_80483F7
mov     [esp+70h+i], 0
jmp     short loc_8048441
loc_804841B:
mov    eax, [esp+70h+i]
mov    edx, [esp+eax*4+70h+i_2]
mov    eax, offset aADD ; "a[%d]=%d\n"
mov    [esp+70h+var_68], edx
mov    edx, [esp+70h+i]
mov    [esp+70h+var_6C], edx
mov    [esp+70h+var_70], eax
call   _printf
add    [esp+70h+i], 1
loc_8048441:
cmp    [esp+70h+i], 13h
jle     short loc_804841B
mov    eax, 0
leave 
retn
main   endp

C code

#include <stdio.h>
int main() {
    int a[20];
    int i;
    for (i=0; i<20; i++)
        a[i]=i*2;
    for (i=0; i<20; i++)
        printf ("a[%d]=%d\n", i, a[i]);
    return 0;
}

My questions are:

  1. Why is memory not allocated consecutively and why are some parts of the memory in between esp + 70h -54h and esp + 70h -68h not used?

  2. In sub esp, 70h, the number 70h seems to be a random number in a different program, and it is often larger than we need. Why don't the compiler just allocate what we need?

Tweeted twitter.com/#!/StackReverseEng/status/468106501861957632
Better usage of the wiki syntax
Source Link
perror
  • 19.2k
  • 29
  • 87
  • 150

Here is a sample function reversed from a easy program. My questions are that:

1 Why memory are not allocated consecutively and some parts of the memory in between (esp + 70h -54h, esp + 70h -68h) are not used?

2 In sub esp, 70h, the number 70h seems a random number in different program and it is often larger than we needs. Why not the compiler just allocated what we need?

main            proc near
var_70          = dword ptr -70h
var_6C          = dword ptr -6Ch
var_68          = dword ptr -68h
i_2             = dword ptr -54h
i               = dword ptr -4
push    ebp
mov     ebp, esp
and     esp, 0FFFFFFF0h
sub     esp, 70h
mov     [esp+70h+i], 0
jmp     short loc_804840A
loc_80483F7:
mov     eax, [esp+70h+i]
mov     edx, [esp+70h+i]
add     edx, edx
mov     [esp+eax*4+70h+i_2], edx
add     [esp+70h+i], 1
loc_804840A:
cmp     [esp+70h+i], 13h
jle     short loc_80483F7
mov     [esp+70h+i], 0
jmp     short loc_8048441
loc_804841B:
mov    eax, [esp+70h+i]
mov    edx, [esp+eax*4+70h+i_2]
mov    eax, offset aADD ; "a[%d]=%d\n"
mov    [esp+70h+var_68], edx
mov    edx, [esp+70h+i]
mov    [esp+70h+var_6C], edx
mov    [esp+70h+var_70], eax
call   _printf
add    [esp+70h+i], 1
loc_8048441:
cmp    [esp+70h+i], 13h
jle     short loc_804841B
mov    eax, 0
leave 
retn
main   endp

C code

#include <stdio.h>
int main() {
  int a[20];
  int i;
  for (i=0; i<20; i++)
    a[i]=i*2;
  for (i=0; i<20; i++)
  printf ("a[%d]=%d\n", i, a[i]);
  return 0; 
}

My questions are:

  1. Why is memory not allocated consecutively and why some parts of the memory in between esp + 70h -54h and esp + 70h -68h, are not used?

  2. In sub esp, 70h, the number 70h seems a random number in different program and it is often larger than we needs. Why not the compiler just allocated what we need ?

Here is a sample function reversed from a easy program. My questions are that:

1 Why memory are not allocated consecutively and some parts of the memory in between (esp + 70h -54h, esp + 70h -68h) are not used?

2 In sub esp, 70h, the number 70h seems a random number in different program and it is often larger than we needs. Why not the compiler just allocated what we need?

main            proc near
var_70          = dword ptr -70h
var_6C          = dword ptr -6Ch
var_68          = dword ptr -68h
i_2             = dword ptr -54h
i               = dword ptr -4
push    ebp
mov     ebp, esp
and     esp, 0FFFFFFF0h
sub     esp, 70h
mov     [esp+70h+i], 0
jmp     short loc_804840A
loc_80483F7:
mov     eax, [esp+70h+i]
mov     edx, [esp+70h+i]
add     edx, edx
mov     [esp+eax*4+70h+i_2], edx
add     [esp+70h+i], 1
loc_804840A:
cmp     [esp+70h+i], 13h
jle     short loc_80483F7
mov     [esp+70h+i], 0
jmp     short loc_8048441
loc_804841B:
mov    eax, [esp+70h+i]
mov    edx, [esp+eax*4+70h+i_2]
mov    eax, offset aADD ; "a[%d]=%d\n"
mov    [esp+70h+var_68], edx
mov    edx, [esp+70h+i]
mov    [esp+70h+var_6C], edx
mov    [esp+70h+var_70], eax
call   _printf
add    [esp+70h+i], 1
loc_8048441:
cmp    [esp+70h+i], 13h
jle     short loc_804841B
mov    eax, 0
leave 
retn
main   endp

C code

#include <stdio.h>
int main() {
  int a[20];
  int i;
  for (i=0; i<20; i++)
    a[i]=i*2;
  for (i=0; i<20; i++)
  printf ("a[%d]=%d\n", i, a[i]);
  return 0; 
}

Here is a sample function reversed from a easy program.

main            proc near
var_70          = dword ptr -70h
var_6C          = dword ptr -6Ch
var_68          = dword ptr -68h
i_2             = dword ptr -54h
i               = dword ptr -4
push    ebp
mov     ebp, esp
and     esp, 0FFFFFFF0h
sub     esp, 70h
mov     [esp+70h+i], 0
jmp     short loc_804840A
loc_80483F7:
mov     eax, [esp+70h+i]
mov     edx, [esp+70h+i]
add     edx, edx
mov     [esp+eax*4+70h+i_2], edx
add     [esp+70h+i], 1
loc_804840A:
cmp     [esp+70h+i], 13h
jle     short loc_80483F7
mov     [esp+70h+i], 0
jmp     short loc_8048441
loc_804841B:
mov    eax, [esp+70h+i]
mov    edx, [esp+eax*4+70h+i_2]
mov    eax, offset aADD ; "a[%d]=%d\n"
mov    [esp+70h+var_68], edx
mov    edx, [esp+70h+i]
mov    [esp+70h+var_6C], edx
mov    [esp+70h+var_70], eax
call   _printf
add    [esp+70h+i], 1
loc_8048441:
cmp    [esp+70h+i], 13h
jle     short loc_804841B
mov    eax, 0
leave 
retn
main   endp

C code

#include <stdio.h>
int main() {
  int a[20];
  int i;
  for (i=0; i<20; i++)
    a[i]=i*2;
  for (i=0; i<20; i++)
  printf ("a[%d]=%d\n", i, a[i]);
  return 0; 
}

My questions are:

  1. Why is memory not allocated consecutively and why some parts of the memory in between esp + 70h -54h and esp + 70h -68h, are not used?

  2. In sub esp, 70h, the number 70h seems a random number in different program and it is often larger than we needs. Why not the compiler just allocated what we need ?

added 21 characters in body
Source Link
upton
  • 226
  • 1
  • 9

Here is a sample function reversed from a easy program. My questions are that:

1 Why memory are not allocated consecutively and some parts of the memory in between (esp + 70h -54h, esp + 70h -68h) are not used?

2 In sub esp, 70h, the number 70h seems a random number in different program and it is often larger than we needs. Why not the compiler just allocated what we need?

main            proc near
var_70          = dword ptr -70h
var_6C          = dword ptr -6Ch
var_68          = dword ptr -68h
i_2             = dword ptr -54h
i               = dword ptr -4
push    ebp
mov     ebp, esp
and     esp, 0FFFFFFF0h
sub     esp, 70h
mov     [esp+70h+i], 0
jmp     short loc_804840A
loc_80483F7:
mov     eax, [esp+70h+i]
mov     edx, [esp+70h+i]
add     edx, edx
mov     [esp+eax*4+70h+i_2], edx
add     [esp+70h+i], 1
loc_804840A:
cmp     [esp+70h+i], 13h
jle     short loc_80483F7
mov     [esp+70h+i], 0
jmp     short loc_8048441
loc_804841B:
mov    eax, [esp+70h+i]
mov    edx, [esp+eax*4+70h+i_2]
mov    eax, offset aADD ; "a[%d]=%d\n"
mov    [esp+70h+var_68], edx
mov    edx, [esp+70h+i]
mov    [esp+70h+var_6C], edx
mov    [esp+70h+var_70], eax
call   _printf
add    [esp+70h+i], 1
loc_8048441:
cmp    [esp+70h+i], 13h
jle     short loc_804841B
mov    eax, 0
leave 
retn
main   endp

C code

#include <stdio.h>
int main() {
  int a[20];
  int i;
  for (i=0; i<20; i++)
    a[i]=i*2;
  for (i=0; i<20; i++)
  printf ("a[%d]=%d\n", i, a[i]);
  return 0; 
}

Here is a sample function reversed from a easy program. My questions are that:

1 Why memory are not allocated consecutively and some parts of the memory in between (-54h -68h) are not used?

2 In sub esp, 70h, the number 70h seems a random number in different program and it is often larger than we needs. Why not the compiler just allocated what we need?

main            proc near
var_70          = dword ptr -70h
var_6C          = dword ptr -6Ch
var_68          = dword ptr -68h
i_2             = dword ptr -54h
i               = dword ptr -4
push    ebp
mov     ebp, esp
and     esp, 0FFFFFFF0h
sub     esp, 70h
mov     [esp+70h+i], 0
jmp     short loc_804840A
loc_80483F7:
mov     eax, [esp+70h+i]
mov     edx, [esp+70h+i]
add     edx, edx
mov     [esp+eax*4+70h+i_2], edx
add     [esp+70h+i], 1
loc_804840A:
cmp     [esp+70h+i], 13h
jle     short loc_80483F7
mov     [esp+70h+i], 0
jmp     short loc_8048441
loc_804841B:
mov    eax, [esp+70h+i]
mov    edx, [esp+eax*4+70h+i_2]
mov    eax, offset aADD ; "a[%d]=%d\n"
mov    [esp+70h+var_68], edx
mov    edx, [esp+70h+i]
mov    [esp+70h+var_6C], edx
mov    [esp+70h+var_70], eax
call   _printf
add    [esp+70h+i], 1
loc_8048441:
cmp    [esp+70h+i], 13h
jle     short loc_804841B
mov    eax, 0
leave 
retn
main   endp

C code

#include <stdio.h>
int main() {
  int a[20];
  int i;
  for (i=0; i<20; i++)
    a[i]=i*2;
  for (i=0; i<20; i++)
  printf ("a[%d]=%d\n", i, a[i]);
  return 0; 
}

Here is a sample function reversed from a easy program. My questions are that:

1 Why memory are not allocated consecutively and some parts of the memory in between (esp + 70h -54h, esp + 70h -68h) are not used?

2 In sub esp, 70h, the number 70h seems a random number in different program and it is often larger than we needs. Why not the compiler just allocated what we need?

main            proc near
var_70          = dword ptr -70h
var_6C          = dword ptr -6Ch
var_68          = dword ptr -68h
i_2             = dword ptr -54h
i               = dword ptr -4
push    ebp
mov     ebp, esp
and     esp, 0FFFFFFF0h
sub     esp, 70h
mov     [esp+70h+i], 0
jmp     short loc_804840A
loc_80483F7:
mov     eax, [esp+70h+i]
mov     edx, [esp+70h+i]
add     edx, edx
mov     [esp+eax*4+70h+i_2], edx
add     [esp+70h+i], 1
loc_804840A:
cmp     [esp+70h+i], 13h
jle     short loc_80483F7
mov     [esp+70h+i], 0
jmp     short loc_8048441
loc_804841B:
mov    eax, [esp+70h+i]
mov    edx, [esp+eax*4+70h+i_2]
mov    eax, offset aADD ; "a[%d]=%d\n"
mov    [esp+70h+var_68], edx
mov    edx, [esp+70h+i]
mov    [esp+70h+var_6C], edx
mov    [esp+70h+var_70], eax
call   _printf
add    [esp+70h+i], 1
loc_8048441:
cmp    [esp+70h+i], 13h
jle     short loc_804841B
mov    eax, 0
leave 
retn
main   endp

C code

#include <stdio.h>
int main() {
  int a[20];
  int i;
  for (i=0; i<20; i++)
    a[i]=i*2;
  for (i=0; i<20; i++)
  printf ("a[%d]=%d\n", i, a[i]);
  return 0; 
}
added 981 characters in body
Source Link
upton
  • 226
  • 1
  • 9
Loading
Source Link
upton
  • 226
  • 1
  • 9
Loading