ESP out of range of "Stack View" in IDA

Question

A very similar (or exact) question was asked here, though it was not answered properly.

I am debugging a process in IDA and am unable to view the dynamic contents of the stack because its value points beyond the address shown in IDA's Stack view. My ESP is shown as pointing to 0xFFFFD95C upon entry at main, while the largest address shown by IDA is 0xFEFFFFFC.

Is there a way to expand this memory range to the end of memory (i.e. 0xFFFFFFFF)?

For those interested, the binary under test is the ELF Crack Me 1 - Time to learn x86 ASM & gdb challenge over at ringzer0team.com.

Answer 1

It seems you're using the GDB debugger backend. It does not provide enough information to IDA about available memory ranges, about which you usually get a warning on startup:

---------------------------
Information
---------------------------
The current debugger backend (gdb) does not provide memory information to IDA.
Therefore the memory contents may be invisible by default.
Please use the Debugger/Manual memory regions menu item to configure the memory layout.
It is possible to define just one big region for the whole memory
(IDA will display question marks for missing memory regions in this case).
---------------------------
OK   
---------------------------

So IDA defaults to 0-0xFF000000 (addresses above 0xFF000000 are used by IDA for internal netnode IDs and may lead to issues if used in actual program). So there are two solutions:

1. Edit the memory regions made by IDA (Edit-Manual memory regions...) and add a new one covering the regions you need (e.g. 0 to 0xFFFFFFF0, or a few smaller ones).

2. Instead of GDB, use IDA's own Linux debugger which can properly query the OS about available memory regions.