I'm reversing an x86 executable with IDA pro. Here is the beginning of the function causing problems to IDA stack pointer analysis. I'm showing the stack pointer value in the second column:
.text:002C35B0 000 push ebp
.text:002C35B1 004 mov ebp, esp
.text:002C35B3 004 and esp, 0FFFFFFF8h
.text:002C35B6 004 push 0FFFFFFFFh
.text:002C35B8 008 push offset sub_75B75D
.text:002C35BD 00C mov eax, large fs:0
In the third line, the and
is not changing the esp
value for IDA and I suppose this is the reason for having unknown esp
offsets throughout the function. I have the following questions:
- what is the purpose of this operation? Why not a normal
sub
oradd
here? - what is the value of the stack pointer after that?