0

I went to stack view and named it counter, and now it appears at the top of my function, although it didn't until I named it. enter image description here

The name didn't propagate over to the program, as you can see in the mov instruction in this block.

enter image description here

  • IDA doesn't look like it's resolving stack variable references. Try to right click on one of the [esp+XXh] operands and see if you can select variable – Avery3R Jul 17 at 19:32
0

First of all, [esp+5Ch] is not the value of counter. The numbers next to the names of variables / arguments on stack are offsets with respect to ebp.

So [ebp-5Ch] is the value of the variable counter.

And since the variables are accessed via esp, not rbp and there is stack aligning instruction (and esp, FFFFFFF0), I guess IDA is not sure if that instruction will change esp or not, so it won't rename [esp + offset] to an argument or variable, since esp could have different values modulo 16 (i.e. and esp, FFFFFFF0 will not change esp if esp = 11111110, but will change it when esp = 11111118) and thus different values with respect to ebp.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.