Reverse Engineering for Beginners

CHAPTER 52. NEGATIVE ARRAY INDICES CHAPTER 52. NEGATIVE ARRAY INDICES

Listing 52.2: Non-optimizing MSVC 2010

CPU Stack
Address Value
001DFBCC /001DFBD3 ; fakearray pointer
001DFBD0 |11223344 ; random_value
001DFBD4 |03020100 ; 4 bytes of array[]
001DFBD8 |07060504 ; 4 bytes of array[]
001DFBDC |00CB0908 ; random garbage + 2 last bytes of array[]
001DFBE0 |0000000A ; last i value after loop was finished
001DFBE4 |001DFC2C ; saved EBP value
001DFBE8 \00CB129D ; Return Address

The pointer to thefakearray is indeed the address ofarray[]in the stack (0x001DFBD4), but minus
1 byte.

It’s still very hackish and dubious trick. Doubtfully anyone should use it in production code, but as a demonstration, it fits
perfectly here.