It's not the first time I see code like the following in assembly:

mov [ebp - 4], eax
mov edx, [ebp - 4]

Which makes myself wonder why it hasn't been optimized to be:

mov edx, eax

Why is this? (With partial answers)

  • Can it be because the optimize option wasn't set during compilation?
    • In fact, if we set in GCC compiler the -O2 option, the code changes to a more efficient version
  • Is it a common trace from known compilers which one can look for when reverse engineering?
    • It's a trace in the sense that, the compiler, if set to add all debugging symbols and information, will give us the change to debug line by line in the original source code (this can only be true if I understood Peter's comment well). Still remains totally unanswered.


Browse other questions tagged or ask your own question.