2

I'm using the IDApro free version and I was wondering why sometimes there could be a instruction like...

mov [esp + 1140h + var_1234], ebx

and if you click inside the bracket, and hit the letter K (Stands for the stack variable view)

it can become something like

mov [esp], ebx

or

mov [esp+4], ebx

Why is there a huge jump from 1140h to suddenly nothing? What is happening here?

Thank you in advance.

1
  • We'd need to see a bigger piece of the function to tell you the reason (most likely the ESP was adjusted by 1140 or a similar amount).
    – Igor Skochinsky
    Nov 25 '16 at 19:19
1

IDA declares local variables as var_XXX at the start of function

In the paste below var_108 is declared as dword ptr -108h

So 0x10c - 108 = 4 If You hit K ida would show you

.text:0040115C                 lea     eax, [esp+4]

If I find it confusing and prefer [esp+4] to [esp + x + (-y) ] I use the script in my answer to this question

https://stackoverflow.com/questions/23199403/differences-in-ollydbg-and-ida-pro-for-movsx-edx-byte-ptr-especx8-command/23604013#23604013

.text:00401150 sub_401150      proc near               ; CODE XREF: sub_4011BC+53p
.text:00401150
.text:00401150 var_108         = dword ptr -108h
.text:00401150 arg_0           = dword ptr  8
.text:00401150
.text:00401150                 push    ebx
.text:00401151                 add     esp, 0FFFFFEF8h
.text:00401157                 push    105h
.text:0040115C                 lea     eax, [esp+10Ch+var_108]

As RedLexus commented there is a reason why the local vars are negative

when you push arguments and call a function the stack layout will be like this

esp+0x00 -> return addrss
esp+0x04 _. arguments that were pushed follows from here

every thing that are negative like
esp-0x4 upto stack top address viz esp - 0xxxx are utilizable by the function to store temporary variables that are specific only in the scope of function

that is if you have a function

rettype calling convention somefunction (args 1.2,....,n)
{
local vars 
char foo[0x100] 
ulong blah
int bar;
function body follows

}

the compiler/assembler would theoretically provide space for int bar at esp -0x108

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.