1

This question already has an answer here:

I am debugging a 32-bit ELF executable using remote GDB debugging option of IDA Pro. However, I am unable to view the contents of stack in the stack view. Also, the stack pointer value is: 0xFFFFD328

In the hex dump view, if I press G and enter the above address, it does not display. Similarly, in the stack view, I cannot scroll to this address or view it either.

The function prolog in the main function initializes the stack pointer as shown below:

lea     ecx, [esp+4]
and     esp, 0FFFFFFF8h
push    dword ptr [ecx-4]
push    ebp
mov     ebp, esp
push    ecx
sub     esp, 0Ch

marked as duplicate by Igor Skochinsky Aug 14 '17 at 15:37

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Is that a userland or a kernel executable? – Dillinur Apr 21 '16 at 16:43
0

Right click on the Stack View and you can sync with ESP or jump to ESP.

The second instruction may be misleading, but it's subtracting 8 from ESP not adding a very large value.

In Hex view, as with many windows in IDA, you can use register names instead of a linear address when you use the Go To command. You can press 'G', input 'esp' and press ENTER to jump to ESP.

  • The second instruction applies a bitmask to round esp down – Nordwald Feb 15 '17 at 5:50
  • This does not seem to answer the OP's question. I am encountering the same thing right now. Upon entry to main, the stack pointer is 0xFFFFD95C, while the stack view only shows up through 0xFEFFFFFC. Attempting to "sync with esp" or jump to esp will fail. Is there a way to add more memory such that the contents of the stack can be viewed? – sherrellbc Aug 10 '17 at 4:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.