IDA Pro displays certain buffer or padding above (at lower addresses) local variables in stack frame view. For instance:
The following screen shot of stack frame view shows 12 bytes (included in the red box) buffer:
The following screen shot of a different stack frame view shows 12 bytes buffer again:
I understand that IDA marked it as
db ?; undefined because it couldn't figure out how it was used. I also realize that IDA automatically calculates size of a stack frame by monitoring ESP. I would assume it might have something to do with non-volitile register save area. However, in Example 1 it clearly shows
Saved regs: 0 and in Example 2 it shows
Saved regs: 4. I am puzzled, and here go my questions:
Why does IDA Pro display certain buffer or padding above (at lower addresses) local variables in stack frame view? Is it a coincidence that both views show exactly 12 bytes buffer? Is it something particular to certain calling convention or complier?