User-Determined Zero Location In Stack Pane

[utkonos]

In this function, there is a stack alignment at 1 which results in one or two stack slots. Also, at 2 a frame pointer is established which is subsequently used to refer to stack variables in the frame of the previous function as shown at 3. In the Stack pane, the distances shown are static.

Over in x64dbg-land, there is an elegant feature in the stack view where double clicking on a location in the stack sets that as zero and then marks the slots north and south of that location with the appropriate distance. I was reliably informed that this feature dates back to OllyDbg: https://twitter.com/Hexacorn/status/1764068094811529495 How I missed that I don't know, but it is super useful.

This should happen when I double click one of the distance values in the first colunm of the Stack pane shown in red in the following screenshot.

[xusheng6]

This is an interesting feature request. However, I am not sure the way x64dbg does it is the best. Could you please let me know why you would wish to set alternative "zero" for the stack? I know the code adjusted the stack twice at the prologue, but since our stack view is ebp-based, that does not really affect the layout of the stack.

[utkonos]

Sorry for not making this more clear. Let me try again.

First, you are correct that the stack is ebp based in most cases. However, in this particular function the stack's numbering is based on the frame pointer established at location 2 in the first screenshot above. I am using a fresh database to avoid any confusion caused by user struct types on the stack.

Here is an instruction mov byte [ebp-0x44 {var_54}], 0x0

Looking at the Stack pane at the location numbered 1: this arrow shows the actual distance from the base pointer ebp. See instruction above: ebp-0x44. This is one instance where being able to change the numbering via a double click would allow me to orient the Stack pane with instructions in the function that are relative to ebp.

Looking at location 2: this unused stack slot does or does not exist based on the actual stack addresses during execution. It is a design decision in Binary Ninja to display this value in the Stack pane, which I agree with. However, when the stack alignment instructions from the first screenshot above in location 1 result in this location not existing, again it would be helpful to be able to shift the numbering in the Stack pane so that it matches what I have in the debugger and all the distances match up.

Lastly, because all input parameters for the function located on the stack are referred to relative to the frame pointer established as noted above and held in ebx even the distances shown going down are off by one stack slot vs what the instructions show. Here is one example with ebx+0x8 vs what is show in the Stack pane at location 4: 0x004.

00404e63  8d5308             lea     edx, [ebx+0x8 {arg_4}]

I understand that everything shown in the Stack pane right now is correct. It would just help me visually if I were able to change where the zero point is so that it lines up precisely with these register+distance instructions in the disassembly view.

Lastly, I understand that these small mental arithmetic calculations are easy for some people. It would just save a bit of time if the GUI could be changed slightly just to save time.

[xusheng6]

I kinda get what you mean. This is a different workflow tham my personal one, but I believe we should add this feature to support yours

[xusheng6]

Also, do you think this would help your workflow: #5269?

[utkonos]

That will help my workflow, yes, but it would not solve what the above would. It is separate (I submitted that one too, however).

[utkonos]

Thanks for all your help @xusheng6 !

[xusheng6]

Thx for filing the issues and having the discussion with me!

[CouleeApps]

This has since been handled! In builds >= 4.1.5256 you can double click the offset side of the stack view and it will base the others off where you clicked.