1

I'm investigating an iOS app Mach-O binary in IDA and noticed it's using a fixed constant as an offset to the SP to denote the start of the stack frame instead of a register. Is this normal? ARM already has so many registers at its disposal this seems like a strange optimization. Are the instructions shorter in this case, or what's the purpose of it?

3

This is not really an RE question but anyway...

On x86, the advantage of using dedicated EBP was that the instructions using it are smaller than those using ESP. It also makes it easier for a compiler (or a human when writing assembly) to track accesses to the stack frame - when using ESP you always need to compensate for every stack pointer adjustment.

With recent advances in compiler development many of those reasons do not really apply so there’s less need for a dedicated frame pointer register, especially on platforms like ARM where there’s no real advantage of using it over SP. That said, the frame pointer (X29) is still used. You can usually see it being saved and copied from SP in function prologs, even if it’s not actually referenced in the function’s body. This is done so that there’s a proper chain of stack frames linked by the frame pointers in every function. This eases debugging and stack unwinding in case of exceptions. And sometimes it is used explicitly inside the function, for example when there is a variable adjustment of the stack pointer due to an alloca or a variable length array. In such situation the compiler has to use FP or another register to address the variables in the fixed part of the frame since SP offset is not known anymore.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.