5

Im newbie at reverse engineering and I was wondering what is the meaning of declaration var_18 = byte ptr -18 and the others like it in the picture.

IDA Pro screenshot

I know that byte ptr means it is a pointer to a byte variable, but why does it have negative value. And also why do all of them have the same address?

perror
  • 19,083
  • 29
  • 87
  • 150
newbie
  • 139
  • 2
  • 9
  • 1
    They are not variables, but assembler directives. Ida PRO displays them as 'belonging' to the first line of the function they are part of. (This is specifically Ida PRO's notation, not a general "reverse engineering" thing.) – Jongware Sep 17 '14 at 14:48
  • You can think of those values as being added to ESP - the stack pointer (adding negative values = subtracting, refer to your accepted answer). – user4520 Sep 17 '14 at 17:06
  • generally, positive = passed as parameters, negative is 'local' storage (on the stack.. should not be accessed by anything after the function returns) – evlncrn8 Sep 17 '14 at 19:38

1 Answers1

6

The dis-assembler display all the variables as having the same address, which is the function's first command (004014CE push ebp in this case).

variable with a positive offset is a parameter to the function, where a variable with a negative offset is usually a local variable. This is of course not always the case but you can take it as a general rule of thumb.

Omer
  • 256
  • 1
  • 5
  • "not always the case" -- are you sure? It's how standard stack frames work, and the OP must be getting these variables because he told Ida PRO to treat this function as such. (Which is either a default setting, or flagged to do so for this particular function.) – Jongware Sep 18 '14 at 20:23
  • It's a default. – Milind R Sep 19 '14 at 08:57
  • 1
    It is true when you are reversing standard compiler output. But in case someone tampered with the assembly, or if the code is self modifying, or you extracted image from memory after modifications (such as patching), IDA might not interpret variables properly. – Omer Sep 19 '14 at 12:46