1

I am debugging a 32-bit ELF executable using remote GDB debugging option of IDA Pro. However, I am unable to view the contents of stack in the stack view. Also, the stack pointer value is: 0xFFFFD328

In the hex dump view, if I press G and enter the above address, it does not display. Similarly, in the stack view, I cannot scroll to this address or view it either.

The function prolog in the main function initializes the stack pointer as shown below:

lea     ecx, [esp+4]
and     esp, 0FFFFFFF8h
push    dword ptr [ecx-4]
push    ebp
mov     ebp, esp
push    ecx
sub     esp, 0Ch
Improve this question
1
  • Is that a userland or a kernel executable?
    – user2823000
    Apr 21, 2016 at 16:43

1 Answer 1

Reset to default
0

Right click on the Stack View and you can sync with ESP or jump to ESP.

The second instruction may be misleading, but it's subtracting 8 from ESP not adding a very large value.

In Hex view, as with many windows in IDA, you can use register names instead of a linear address when you use the Go To command. You can press 'G', input 'esp' and press ENTER to jump to ESP.

Improve this answer
2
  • The second instruction applies a bitmask to round esp down
    – Nordwald
    Feb 15, 2017 at 5:50
  • This does not seem to answer the OP's question. I am encountering the same thing right now. Upon entry to main, the stack pointer is 0xFFFFD95C, while the stack view only shows up through 0xFEFFFFFC. Attempting to "sync with esp" or jump to esp will fail. Is there a way to add more memory such that the contents of the stack can be viewed?
    – sherrellbc
    Aug 10, 2017 at 4:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.