0

i have the following function with three arguments:

 sub_602667B proc near 

 arg_0 = dword ptr 4
 arg_4 = dword ptr 8
 arg_8 = dword ptr 0Ch

 push    [esp+arg_8]
 push    [esp+4+arg_4]
 push    15
 push    [esp+0Ch+arg_0]

Then I make the following sketch :

 esp, ebp -> | Old EBP        |  +0
             | Return Address |  +4
             | Argument 1     |  +8
             | Argument 2     |  +12
             | Argument 3     |  +16

And now I have the following on my paper:

   push    [esp+arg_8]     => is Argument 2,( because esp + 12(=0Ch) = Argument 2
   push    [esp+4+arg_4]   => is Argument 2,( because esp + 4 + 8 = Argument 2 )
   push    15
   push    [esp+0Ch+arg_0] => is Argument 3,( because esp + 12 + 4 = 16 = Argument 3

So my question would be : Is that sketch ok? I wanted to ask because the point that Argument 2 is pushed twice and Argument 1 is not taken surprises me

1

Your code snippet does not contain push esp, ebp, so why would there be an "old EBP" on the stack? At the beginning of the function, your stack should look like this:

esp + 00 | return address
esp + 04 | Argument 1 (arg_0)
esp + 08 | Argument 2 (arg_4)
esp + 0C | Argument 3 (arg_8)

After that, remember that esp changes after each push. IDA is already doing the maths for you and splitting the displacement into the +4 and +arg_4 parts — they represent "balance esp back to its initial value" and "convert the remaining offset to a local variable", respectively. The function is pushing exactly those variables which are referenced:

push    [esp+arg_8]      ; Argument 3
push    [esp+4+arg_4]    ; Argument 2
push    15
push    [esp+0Ch+arg_0]  ; Argument 1

If you want to find out more, you can highlight the [esp+4+arg_4] part in the disassembly and press Q to convert the displacement to a single number.

Then go to Options > General... > Disassembly and enable the Display disassembly line parts: [x] Stack pointer setting.

Now you see the difference between the esp value at the start of the function and the esp value in the current line.

Subtract that difference from the displacement in the push, and you should get the right local variable.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.