I'm disassembling a Microsoft dll in IDA Pro, and there's one point where a value is loaded to a register from a location that has never been written to (it's the first location on the variables stack):

mov     rsi, [rbp+0]

When debugging I can see that the location is cleared (zero), but how can this be assumed?

Here's the entry point:

char __fastcall untfs_NTFS_SA::CreateElementaryStructures(NTFS_SA *this, struct NTFS_BITMAP *bmp_1, unsigned int sectors_per_cluster, unsigned int bytes_per_record_1, unsigned int sector_size_param, unsigned int a6_always_0, const struct NUMBER_SET *number_set, char NoUpgrade, unsigned __int8 ShortNames, char TxF, unsigned __int8 always_0?, char DAX, unsigned int HeatGatheringDisableFlag, struct MESSAGE *a14, struct BIOS_PARAMETER_BLOCK *a15, const struct WSTRING *a16, unsigned __int8 RepairLogs)
 push    rbp
 push    rbx
 push    rsi
 push    rdi
 push    r12
 push    r13
 push    r14
 push    r15
 lea     rbp, [rsp-1DC8h]
 mov     eax, 1EC8h
 call    _alloca_probe
 sub     rsp, rax
 mov     rax, cs:__security_cookie
 xor     rax, rsp
 mov     [rbp+1E00h+var_50], rax
 mov     eax, dword ptr [rbp+1E00h+a6_always_0]
  • A single instruction without any context at all does not help us help you.
    – Jongware
    Aug 9, 2020 at 9:28
  • provide context or check this thread for similar context reverseengineering.stackexchange.com/questions/25490/…
    – blabb
    Aug 9, 2020 at 13:56
  • @usr2564301 - What context should I provide? It's a very large function in untfs.dll. The function prototype should be correct - it's using the MS symbol server. Aug 9, 2020 at 19:21
  • show the instructions from the function entry point and maybe a few afterwards
    – Igor Skochinsky
    Aug 10, 2020 at 11:42


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.