Examples
1. Print "hello world!"
Disassembly of "main" function from objdump
objdump Instructions to take note of
a. The first line simply pushes the pointer of the string (to be printed by the puts() function) onto the stack
Remember that x86 (32-bit) assembly passes function arguments via the stack
b. The second line calls the puts() function
Rest of the instructions
The rest of the instructions deals with moving the
ESPandEBParound for stack frame setup and restoration, preparing spaces for local variables, and stack alignment
Debugging with GDB
Refer to the following GDB notes for more information on the available commands
We can use gdb to better understand the binary (with the gef extension).
Disassemble the
mainfunction:
Set a breakpoint on the
mainfunction
We notice that the breakpoint is set at
0x8048409, which corresponds with the following line (from thedisass maincommand):
This is the instruction to be executed next
Run
We can view a bunch of information:
a. Registers
b. Stack
c. Current position in the code
d. Threads
e. Trace
Navigate through the next instruction with
nexti
Let's focus on the register esp. We can see the following line from the "stack" section before running the nexti instruction:
4.1 1st nexti
Now, we can move through the program with the nexti command, which will simply execute the next instruction:
Updated esp value:
The stack value is decremented by 0x4 from the previous value
4.2 2nd nexti
Updated esp value:
The stack value is decremented by 0xC (decimal value of 12) from the previous value
4.3 3rd nexti
Now, the next instruction will push a new address into the stack:
After running nexti again for the 3rd time, updated esp value:
We can see that the esp is decremented by 0x4, with the value 0x080484b0 pushed onto the stack. The automatic decrement of the esp value is expected from the push command. We can also see that the stored address contains the value "hello world!".
We can confirm this with gdb:
Last updated