I try to use IDA dissembler and I don't really understand the following text paragraphs appearing at the head of functions:
arg_0 = dword ptr 4
Can anyone explain their meaning?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
That's not a command, and not really part of the assembly language. IDA uses those markers to ease the reading of assembly instructions relating to the stack.
Once IDA detects an offset would point into the function's stack as either an internal variable or an argument, it'll assign a name to the specific stack offsets each parameter and/or argument points to from the base of the stack.
It then calculates all offsets to the same position regardless of stack growth/shrinking and will use the stack offset names where-ever they're possible.
The syntax is the following:
<argument/variable name> = <size> ptr <offset from stack base>
So in your example, IDA identified the first argument to the function and named it
arg_0 (you can change the name by pressing n when your cursor is on it). The argument is a dword and the function's base stack offset is 4.
Because the offset is positive IDA identified the stack address as an argument. Negative offsets will be recognized as variables and will have the
var_ prefix instead.