Question

I am reverse engineering a C MIPS application, in some places I can see negative offsets in lw opcode, like:

80032910                 lw      $v0, -4($s4)

Positive offsets usually indicate some kind of structure, where one of the members is being accessed, but what code can lead to a negative offset?

Answer 1

For example, it can be generated if you read the previous value of a pointer, e.g. traversing an array from the end to the beginning

int *myDataEnd;

... code ...

while(*myDataEnd > *(myDataEnd-1))
  myDataEnd--;

Referencing the integer pointed by myDataEnd-1 may generate that instruction.