2

I am new to assembly. When I was disassembling some code, I encounter some strange instruction here. The instruction shows that (RBP + -0x40) is equal to local_48, however at the beginning of the code, we can see that (RBP + -0x48) is equal to local_48. Also, I know that this is a struct. Is there something wrong here or am I looking at it wrong?

The instruction I was talking about:

Assembly Instruction

And the beginning of the code:

Beginning Of The Code

1 Answer 1

2

Without seeing the full function, I suspect what you're seeing is a result of how Ghidra identifies a stack-based variable, as described in the answer to this question.

The Stack[-0x##] numbers in your screenshot are likely not relative to RBP, but rather the stack pointer RSP at the function start. Since RBP might have been set to the value of RSP after some pushes occurred, it could be a slightly different offset than the stack offset at the entry point of the function. This can take some getting used to as it is unintuitive.

If you are still learning assembly, a good exercise is to follow the changes made to the stack pointer via pushes/pops in the function start, and verify that you understand why the offset of RBP later in the function body would be slightly different than the offset to RSP at the beginning of the function for the same stack address.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.