2

I have found myself confused while reversing some programs (specifically the IOLI Crackme challenges). I have no trouble solving them, but I have come across something that I do not understand and it irks me.

I have a function call to, in this example, sub_80484B4. The caller is sub_8048542. It pushes to values on the stack, (arg_4 and num). However, As you can see in the disassembly of sub_80484B4, it only shows one argument, arg_4.

What happened to num? Is Ida just saying arg_4 only because num's value is not referenced in the callee?

I use Radare2 and it showed the same thing. Am I missing something or are the tools just simplifying?

Caller pushes two values onto stackCallee shows one argument

Improve this question

2 Answers 2

Reset to default
3

Yes, the disassembler is not including it since [ebp+8] is not referenced anywhere in the procedure.

Improve this answer
0

The function at sub_80484B4 does however return its value in eax, so the push could be to preserve the original value of eax. Which isn't used either from what can be seen in the disassembly. Probably wasn't compiled with optimisation in that case

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.