When I looking on Ida with static analyze I see that buffer pass to function/ function fill data in buffer.
How can I know if this buffer allocate in stack/ heap?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
If it's address is above or equal to the stack pointer (esp/rsp), it's on the stack
otherwise, it's on the heap or was on a previous stack-frame (and now is out of scope and should not be used)
If you want to know but just looking at the address: if the address starts with
0x7f, it's on the stack.
That might not always be right though, a program can control the value of the stack pointer and can decide to change it (not likely but feasible)
If you want to find out statically, you have to inspect the call site to your function and see where the buffer argument comes from.
You may have to go back multiple layers until you either clearly see it's on the stack (if the address of a local memory area is passed in), or it comes from a call like
HeapAlloc (VirtualAlloc and HeapAlloc being Windows-specific APIs), in which case the memory is located on the heap.