I'm disassembling a Microsoft dll in IDA Pro, and there's one point where a value is loaded to a register from a location that has never been written to (it's the first location on the variables stack):

mov     rsi, [rbp+0]

When debugging I can see that the location is cleared (zero), but how can this be assumed?

Here's the entry point:

char __fastcall untfs_NTFS_SA::CreateElementaryStructures(NTFS_SA *this, struct NTFS_BITMAP *bmp_1, unsigned int sectors_per_cluster, unsigned int bytes_per_record_1, unsigned int sector_size_param, unsigned int a6_always_0, const struct NUMBER_SET *number_set, char NoUpgrade, unsigned __int8 ShortNames, char TxF, unsigned __int8 always_0?, char DAX, unsigned int HeatGatheringDisableFlag, struct MESSAGE *a14, struct BIOS_PARAMETER_BLOCK *a15, const struct WSTRING *a16, unsigned __int8 RepairLogs)
 push    rbp
 push    rbx
 push    rsi
 push    rdi
 push    r12
 push    r13
 push    r14
 push    r15
 lea     rbp, [rsp-1DC8h]
 mov     eax, 1EC8h
 call    _alloca_probe
 sub     rsp, rax
 mov     rax, cs:__security_cookie
 xor     rax, rsp
 mov     [rbp+1E00h+var_50], rax
 mov     eax, dword ptr [rbp+1E00h+a6_always_0]
  • A single instruction without any context at all does not help us help you. – Jongware Aug 9 '20 at 9:28
  • provide context or check this thread for similar context reverseengineering.stackexchange.com/questions/25490/… – blabb Aug 9 '20 at 13:56
  • @usr2564301 - What context should I provide? It's a very large function in untfs.dll. The function prototype should be correct - it's using the MS symbol server. – Reinstate Monica Aug 9 '20 at 19:21
  • show the instructions from the function entry point and maybe a few afterwards – Igor Skochinsky Aug 10 '20 at 11:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.