2

I am new to assembly. When I was disassembling some code, I encounter some strange instruction here. The instruction shows that (RBP + -0x40) is equal to local_48, however at the beginning of the code, we can see that (RBP + -0x48) is equal to local_48. Also, I know that this is a struct. Is there something wrong here or am I looking at it wrong?

The instruction I was talking about:

Assembly Instruction

And the beginning of the code:

Beginning Of The Code

1 Answer 1

2

Without seeing the full function, I suspect what you're seeing is a result of how Ghidra identifies a stack-based variable, as described in the answer to this question.

The Stack[-0x##] numbers in your screenshot are likely not relative to RBP, but rather the stack pointer RSP at the function start. Since RBP might have been set to the value of RSP after some pushes occurred, it could be a slightly different offset than the stack offset at the entry point of the function. This can take some getting used to as it is unintuitive.

If you are still learning assembly, a good exercise is to follow the changes made to the stack pointer via pushes/pops in the function start, and verify that you understand why the offset of RBP later in the function body would be slightly different than the offset to RSP at the beginning of the function for the same stack address.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.