a = byte ptr -19h
Why offset from stack base can be a negative number ? Can anyone explain this for me please?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this communitya = byte ptr -19h
Why offset from stack base can be a negative number ? Can anyone explain this for me please?
The way IDA displays variables at the top of a function definition is by their offset from the stack base (ebp
, rbp
) at the function's beginning.
Unless there's something strange going on, negative offsets mean the function itself allocated stack space for local variables (or, depending on compiler and calling convention for argument passing as well).
When stack space is allocated by subtracting the stack pointer (esp
, rsp
), whether the stack base register is used or not, the base stack does not change. Therefore, memory below the stack base register becomes available. When the stack base register is unused, IDA will still display the stack offset relative to the stack base, by explicitly splitting the stack base offset (from the current stack position) and the variable offset from the stack base.
For example, take a look at the following function prelog:
var_448= qword ptr -448h
var_438= word ptr -438h
var_436= byte ptr -436h
var_434= byte ptr -434h
var_38= qword ptr -38h
var_28= qword ptr -28h
arg_0= qword ptr 8
arg_10= qword ptr 18h
mov r11, rsp
push rbp
push rsi
push r14
push r15
sub rsp, 448h
mov rax, cs:__security_cookie
xor rax, rsp
mov [rsp+468h+var_38], rax
You can see var_38
is at offset -38
from the stack base, but because rsp
is used to access var_38
, IDA displays the 468h+var_38
instead of the immediate offset used. That's done to show the variable being accessed regardless of the current stack position.
The adding rsp
and 468h
gives us the stack base as a computation using the current stack pointer and the stack delta from the function's start. That's how the compiler avoids using the stack base register, by computing it from the stack register and delta.
var_a - var_b
value?
– Biswapriyo
Aug 31 '18 at 19:08