I have a function with the first few instructions defined as follows:
sub rsp, 0x80 lea rbp, [rsp + 0x20] mov qword [rbp + 0x58], rsi mov qword [rbp + 0x50], rbx mov qword [rbp + 0x70], rcx mov dword [rbp + 0x78], edx mov eax, dword [rbp + 0x78] test eax, eax
So, in order we have:
- stack frame of 0x80 -- fine
- Some kind of structure at RSP+0x20 -- probably
- set some member of RBP at offset 0x58 to RSI
- same for offset 0x50
- Same for offset 0x70 -- wait what? RBP+0x70 is 0x10 bytes beyond our stack frame.
It seems like we have an on-stack structure at RBP yet it's accessing data from the caller's frame. If we were accessing data from the caller I would have expected the compiler to use one base register for the current function (as we saw with the RBP usage) and then another register for the the caller's data offsets, say some offset from RSP. I understand the compiler isn't required to follow that pattern, so my question is: Is there some C or C++ that could generate this assembly sequence in practice or am I looking at weird obfuscated code?
EDIT: This is a windows binary. There are two parameters to this function, RCX and RDX.