5

Im newbie at reverse engineering and I was wondering what is the meaning of declaration var_18 = byte ptr -18 and the others like it in the picture.

IDA Pro screenshot

I know that byte ptr means it is a pointer to a byte variable, but why does it have negative value. And also why do all of them have the same address?

Improve this question
3
  • 1
    They are not variables, but assembler directives. Ida PRO displays them as 'belonging' to the first line of the function they are part of. (This is specifically Ida PRO's notation, not a general "reverse engineering" thing.)
    – Jongware
    Sep 17, 2014 at 14:48
  • You can think of those values as being added to ESP - the stack pointer (adding negative values = subtracting, refer to your accepted answer).
    – user4520
    Sep 17, 2014 at 17:06
  • generally, positive = passed as parameters, negative is 'local' storage (on the stack.. should not be accessed by anything after the function returns)
    – evlncrn8
    Sep 17, 2014 at 19:38

1 Answer 1

Reset to default
6

The dis-assembler display all the variables as having the same address, which is the function's first command (004014CE push ebp in this case).

variable with a positive offset is a parameter to the function, where a variable with a negative offset is usually a local variable. This is of course not always the case but you can take it as a general rule of thumb.

Improve this answer
3
  • "not always the case" -- are you sure? It's how standard stack frames work, and the OP must be getting these variables because he told Ida PRO to treat this function as such. (Which is either a default setting, or flagged to do so for this particular function.)
    – Jongware
    Sep 18, 2014 at 20:23
  • It's a default.
    – Milind R
    Sep 19, 2014 at 8:57
  • 1
    It is true when you are reversing standard compiler output. But in case someone tampered with the assembly, or if the code is self modifying, or you extracted image from memory after modifications (such as patching), IDA might not interpret variables properly.
    – Omer
    Sep 19, 2014 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.