3

I try to use IDA dissembler and I don't really understand the following text paragraphs appearing at the head of functions:

arg_0 = dword ptr 4

Can anyone explain their meaning?

2

That's not a command, and not really part of the assembly language. IDA uses those markers to ease the reading of assembly instructions relating to the stack.

Once IDA detects an offset would point into the function's stack as either an internal variable or an argument, it'll assign a name to the specific stack offsets each parameter and/or argument points to from the base of the stack.

It then calculates all offsets to the same position regardless of stack growth/shrinking and will use the stack offset names where-ever they're possible.

The syntax is the following:

<argument/variable name> = <size> ptr <offset from stack base>

So in your example, IDA identified the first argument to the function and named it arg_0 (you can change the name by pressing n when your cursor is on it). The argument is a dword and the function's base stack offset is 4.

Because the offset is positive IDA identified the stack address as an argument. Negative offsets will be recognized as variables and will have the var_ prefix instead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.