4

IDA Pro uses a syntax like Var_A4 = dword ptr -0A4h when declaring stack variables at the top of a x86 assembly routine as shown:

enter image description here

However, I would expect it to refer to such local variables and arguments using an EBP offset syntax. What is the meaning of the dword ptr syntax and why is this syntax used?

1 Answer 1

9

an argument is positive from stackpointer (esp+xxx) a local is negative from stackpointer (esp-xxx)

ida renames all locals ie DWORD ptr ss:[esp-xx] as var_xxx
and all argumts ie DWORD PTR SS:[esp+xxx] as arg_XX

you can mass rename them with a script or use K keyboard shortcut to see a single instance

i had a few posts on how you can mass rename it here and here

EDIT

or you can change the ANALYSIS kernel option 1 uncheck create stack var

or open ida.cfg and change the analysis option = 0xffff to 0xfbff and ida wont create those vars and args

:\>echo %cd% E:\IDA_FREE_5\cfg :\>grep -n ANA.*FBFF * ida.cfg:194:ANALYSIS = 0xFBFF // This value is combination of the bits defined 

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.