Whenever I attach a process in OllyDbg v1.10 on my Windows 7 64-bit machine, I notice that the first saved EBP on the stack doesn't point to the very base of the stack. Instead it points 16 bytes before it.
To illustrate what I mean, see the following screenshot:
The EBP (highlighted in gray), which is right above the RETURN to ntdll.76FC9F45
, is pointing to 1B05FFEC
. Note that this address ends with EC
, not FC
.
Question 1: Why isn't the EBP pointing to 1B05FFFC
?
Question 2: What do the first 16 bytes on the stack represent?
Question 3: Is the number of bytes (16), which are between StackBase
and the address to where the first EBP
points to, fixed for Windows OSs?