Whenever I attach a process in OllyDbg v1.10 on my Windows 7 64-bit machine, I notice that the first saved EBP on the stack doesn't point to the very base of the stack. Instead it points 16 bytes before it.To illustrate what I mean, see the following screenshot:The EBP (highlighted in gray), which is right above the RETURN to ntdll.76FC9F45, is pointing to 1B05FFEC. Note that this address ends with EC, not FC.Question 1: Why isn't the EBP pointing to 1B05FFFC?Question 2: What do the first 16 bytes on the stack represent?Question 3: Is the number of bytes (16), which are between StackBase and the address to where the first EBP points to, fixed for Windows OSs?
What do the first 16 bytes on the stack represent?
windows;ollydbg;debuggers;x86;callstack
Question 1: Why isn't the EBP pointing to 1B05FFFC?Because 1B05FFFC is not the base address of the stack frame.The only reason that OllyDbg shows 1B05FFFC as the last address in the stack-view is that it's the address of the last DWORD in the stack's memory page.Question 2: What do the first 16 bytes on the stack represent?It depends on the debugger.For example, from my limited testing...When attaching WinDbg to a 32-bit EXE on Windows 7 x64, [ESP] is the return address back into ntdll!DbgUiRemoteBreakin from the call to ntdll!DbgBreakPoint.When attaching OllyDbg v2.01 to a 32-bit EXE on Windows 7 x64 or Windows 7 x86, the debugger suspends the debuggee in the middle of an executing debuggee thread, so the value of ESP is whatever ESP was in the debuggee's thread at the moment OllyDbg attached to it.