I have a problem just like in the question. Modern compilers don't use
ebp to handle local variables and arguments, they just calculate and add hard=coded offsets to
sub esp, 5Eh ... mov [esp+5Eh+var_1], 123h mov [esp+5Eh+var_2], 456h call some_func ; var_1 and var_2 point to actual addresses cmp eax, 0 ; esp changed (stdcall), var_1 and var_2 point to wrong addresses ... ; creation of a "fake" variable example: ; var_3 = -8h ; var_4 = -12h mov [esp+5Eh+var_3], 78h ; var_3 at: esp + 5Eh -8h pop eax ; esp = esp + 4 mov [esp+5Eh+var_4], 89h ; var_4 at: esp + 4 + 5eh -12h = esp + 5Eh -8h = var_3 ; desireable fix: mov [esp+62h+var_3], 89h
This results in a lot of overhead: IDA creates "fake" local variables (i.e. several names for one and the same address), you can't freely check variables whenever you want to, you have to create additional comments, etc. So I was wondering is there any way to fix that ?
PS. I'm using IDA Pro Free. Tell me if it is possible only in IDA Pro (full version).