Why IDA define negative offset?

Question

a = byte ptr -19h

Why offset from stack base can be a negative number ? Can anyone explain this for me please?

Answer 1

The way IDA displays variables at the top of a function definition is by their offset from the stack base (ebp, rbp) at the function's beginning.

Unless there's something strange going on, negative offsets mean the function itself allocated stack space for local variables (or, depending on compiler and calling convention for argument passing as well).

When stack space is allocated by subtracting the stack pointer (esp, rsp), whether the stack base register is used or not, the base stack does not change. Therefore, memory below the stack base register becomes available. When the stack base register is unused, IDA will still display the stack offset relative to the stack base, by explicitly splitting the stack base offset (from the current stack position) and the variable offset from the stack base.

For example, take a look at the following function prelog:

var_448= qword ptr -448h
var_438= word ptr -438h
var_436= byte ptr -436h
var_434= byte ptr -434h
var_38= qword ptr -38h
var_28= qword ptr -28h
arg_0= qword ptr  8
arg_10= qword ptr  18h

mov     r11, rsp
push    rbp
push    rsi
push    r14
push    r15
sub     rsp, 448h
mov     rax, cs:__security_cookie
xor     rax, rsp
mov     [rsp+468h+var_38], rax

You can see var_38 is at offset -38 from the stack base, but because rsp is used to access var_38, IDA displays the 468h+var_38 instead of the immediate offset used. That's done to show the variable being accessed regardless of the current stack position.

The adding rsp and 468h gives us the stack base as a computation using the current stack pointer and the stack delta from the function's start. That's how the compiler avoids using the stack base register, by computing it from the stack register and delta.