I tried to fix the size of both the saved registers and the local variable area using IDA's "Edit function" option as IDA could not recognize it properly by itself.

Unedited function:

Unedited function (no red marks) Wrong sizes

Corrected function:

Edited function (red marks) Correct sizes

I can't see anything wrong with [rsp+20h] as it points into the fixed allocation of 0x48 bytes. So what does that red mark indicate and what causes it?

  • Hi and welcome to RE.SE! What it indicates, to my knowledge, is that it points to something invalid. Since you "corrected" the "local variables area" value, that's arguably the cause. But I'm not sure, doesn't it also point in the middle of a qword there? – 0xC0000022L May 28 at 6:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.