Is there a way to adjust local variables when a function doesn't utilize ebp?

Question

I have a problem just like in the question. Modern compilers don't use ebp to handle local variables and arguments, they just calculate and add hard=coded offsets to esp. Example:

sub     esp, 5Eh  
...     
mov     [esp+5Eh+var_1], 123h
mov     [esp+5Eh+var_2], 456h
call    some_func            ; var_1 and var_2 point to actual addresses
cmp     eax, 0               ; esp changed (stdcall), var_1 and var_2 point to wrong addresses

...

;  creation of a "fake" variable example:
;  var_3 = -8h
;  var_4 = -12h 
mov     [esp+5Eh+var_3], 78h  ; var_3 at: esp + 5Eh -8h
pop     eax                   ; esp = esp + 4  
mov     [esp+5Eh+var_4], 89h  ; var_4 at: esp + 4  + 5eh -12h = esp + 5Eh -8h = var_3
; desireable fix:
mov     [esp+62h+var_3], 89h 

This results in a lot of overhead: IDA creates "fake" local variables (i.e. several names for one and the same address), you can't freely check variables whenever you want to, you have to create additional comments, etc. So I was wondering is there any way to fix that ?

PS. I'm using IDA Pro Free. Tell me if it is possible only in IDA Pro (full version).

Answer 1

The variable names that IDA is generating aren't "fake"; they are exactly the same as they would be labeled had the function been ebp-based. The problem you describe is only really an issue when debugging since that's the only time you can inspect the values pointed to. I'm not aware of any built-in way to get IDA to display what you want. When you hover over an operand, IDA just takes the current value of the register and adds the offset. If esp has changed, then it will show you the wrong address, which is what you're seeing in your example.

Since IDA does know the correct stack offset, one way to do what you're asking is to write an IDC script that checks eip and adjusts for the difference in esp values before calculating the final target address. The IDC function that gets the stack offset at a given address is GetSpd(). The algorithm would go something like this:

1. Calculate the target address of the operand you are interested in (i.e. esp+5Eh+var_1 -> 0x10000000)
2. Get the stack pointer delta (SPD) of the line containing the operand you're interested in (i.e. 5Eh)
3. Get the SPD of eip (i.e. 6Eh)
4. Calculate the difference of the two SPDs and add (or subtract) that amount from the target address you calculated in step 1 (i.e. 0x10000000 + (6Eh-5Eh) = 0x10000010)
5. Go to your calculated address ([0x10000010] contains the variable you are after)

Answer 2

With your cursor inside of the given function, press Alt+P to edit the function properties. In the Edit function window, uncheck BP based frame and press OK.