Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
IDA Pro uses a syntax like Var_A4 = dword ptr -0A4h when declaring stack variables at the top of a x86 assembly routine as shown:
However, I would expect it to refer to such local variables and arguments using an EBP offset syntax. What is the meaning of the dword ptr syntax and why is this syntax used?
an argument is positive from stackpointer (esp+xxx) a local is negative from stackpointer (esp-xxx)
ida renames all locals ie DWORD ptr ss:[esp-xx] as var_xxx
and all argumts ie DWORD PTR SS:[esp+xxx] as arg_XX
you can mass rename them with a script or use K keyboard shortcut to see a single instance
i had a few posts on how you can mass rename it here and here
EDIT
or you can change the ANALYSIS kernel option 1 uncheck create stack var
or open ida.cfg and change the analysis option = 0xffff to 0xfbff and ida wont create those vars and args
:\>echo %cd%
E:\IDA_FREE_5\cfg
:\>grep -n ANA.*FBFF *
ida.cfg:194:ANALYSIS = 0xFBFF // This value is combination of the bits defined
