2

IDA Pro uses a syntax like Var_A4 = dword ptr -0A4h when declaring stack variables at the top of a x86 assembly routine as shown:

enter image description here

However, I would expect it to refer to such local variables and arguments using an EBP offset syntax. What is the meaning of the dword ptr syntax and why is this syntax used?

7

an argument is positive from stackpointer (esp+xxx) a local is negative from stackpointer (esp-xxx)

ida renames all locals ie DWORD ptr ss:[esp-xx] as var_xxx
and all argumts ie DWORD PTR SS:[esp+xxx] as arg_XX

you can mass rename them with a script or use K keyboard shortcut to see a single instance

i had a few posts on how you can mass rename it here and here

EDIT

or you can change the ANALYSIS kernel option 1 uncheck create stack var

or open ida.cfg and change the analysis option = 0xffff to 0xfbff and ida wont create those vars and args

:\>echo %cd%
E:\IDA_FREE_5\cfg

:\>grep -n ANA.*FBFF *
ida.cfg:194:ANALYSIS        = 0xFBFF // This value is combination of the bits defined
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.