a = byte ptr -19h
Why offset from stack base can be a negative number ? Can anyone explain this for me please?
The way IDA displays variables at the top of a function definition is by their offset from the stack base (ebp, rbp) at the function's beginning.
Unless there's something strange going on, negative offsets mean the function itself allocated stack space for local variables (or, depending on compiler and calling convention for argument passing as well).
When stack space is allocated by subtracting the stack pointer (esp, rsp), whether the stack base register is used or not, the base stack does not change. Therefore, memory below the stack base register becomes available. When the stack base register is unused, IDA will still display the stack offset relative to the stack base, by explicitly splitting the stack base offset (from the current stack position) and the variable offset from the stack base.
For example, take a look at the following function prelog:
var_448= qword ptr -448h
var_438= word ptr -438h
var_436= byte ptr -436h
var_434= byte ptr -434h
var_38= qword ptr -38h
var_28= qword ptr -28h
arg_0= qword ptr 8
arg_10= qword ptr 18h
mov r11, rsp
push rbp
push rsi
push r14
push r15
sub rsp, 448h
mov rax, cs:__security_cookie
xor rax, rsp
mov [rsp+468h+var_38], rax
You can see var_38 is at offset -38 from the stack base, but because rsp is used to access var_38, IDA displays the 468h+var_38 instead of the immediate offset used. That's done to show the variable being accessed regardless of the current stack position.
The adding rsp and 468h gives us the stack base as a computation using the current stack pointer and the stack delta from the function's start. That's how the compiler avoids using the stack base register, by computing it from the stack register and delta.
-
Can one make sure about the variable size from
var_a - var_bvalue? – Biswapriyo Aug 31 '18 at 19:08 -
Not necessarily, because variables may be padded and IDA may missing certain variables (think of a stack allocated structure that has only few of it's member used in the allocating function, but other members used in other functions). A better way would probably be reading the code and seeing how the variables are used. – NirIzr Aug 31 '18 at 19:20
