Incorrect address generated by LEA instruction

Question

In this OS/X NASM code I want to count positive, negative and zeros inside an array defined in .data section. I want to store the results accordingly.

SECTION .data
    align 4
    numdata db 0x12, 0x88, 0x82, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x87, 0x89
    len equ $-numdata
    positive db 0
    negative db 0
    zeros db 0
    sum dw 0, 0 ; 32bits

SECTION .text
    align 16
    DEFAULT REL
    GLOBAL start
start:
    push rbp
    mov rbp, rsp
    lea rax, [numdata] ; INCORRECT ADDRESS
    mov rcx, len
    lea rsi, [positive] ; INCORRECT ADDRESS
.Lloop1
    xor rbx, rbx
    mov bl, [rax]
    add [rsi+3], rbx
    test bl, bl
    jnz .Lnotzero
    inc dword [rsi+2]; inc zeros
    jmp .Lendloop
.Lnotzero:
    jns .Lpos
    inc dword [rsi+1]; inc negative
.Lpos:
    inc dword [rsi]; inc positive
.Lendloop
    inc eax
    loop .Lloop1
    mov rax, 0x2000001
    mov rdi, 0
    syscall
    ret

My OS is Mac OS X 10.11, and I assemble code above by:

nasm -f macho64 -g exp02.asm && ld -o exp02 exp02.o

However when I inspect the executable:

otool -tdV exp02

I got

exp02:
(__TEXT,__text) section
start:
0000000000001fb0    pushq    %rbp
0000000000001fb1    movq    %rsp, %rbp
0000000000001fb4    xorl    %eax, %eax
0000000000001fb6    leaq    0x143(%rip), %rax <- NOTE ADDR
0000000000001fbd    movl    $0xd, %ecx
0000000000001fc2    leaq    0x144(%rip), %rsi <- NOTE ADDR
start.Lloop1:
0000000000001fc9    xorq    %rbx, %rbx
0000000000001fcc    movb    (%rax), %bl
0000000000001fce    addq    %rbx, 0x3(%rsi)
0000000000001fd2    testb    %bl, %bl
0000000000001fd4    jne    start.Lnotzero
0000000000001fd6    incl    0x2(%rsi)
0000000000001fd9    jmp    start.Lendloop
start.Lnotzero:
0000000000001fdb    jns    start.Lpos
0000000000001fdd    incl    0x1(%rsi)
0000000000001fe0    jmp    start.Lendloop
start.Lpos:
0000000000001fe2    incl    (%rsi)
start.Lendloop:
0000000000001fe4    incl    %eax
0000000000001fe6    loop    start.Lloop1
0000000000001fe8    movl    $0x2000001, %eax        ## imm = 0x2000001
0000000000001fed    movl    $0x0, %edi
0000000000001ff2    syscall
0000000000001ff4    retq
(__DATA,__data) section
0000000000002000    12 88 82 01 02 03 04 05 06 07 08 09 10 00 00 00 
0000000000002010    00 00 00 00

And when I debug this program with gdb, the address loaded into rax and rsi is also incorrect (for rax, should be 0x2000 in this case but I got 0x2100).

My problem is how to load correct address of numdata and positive into rax and rsi in this case and am I right by using LEA this way?

What version of NASM? I ask because it might be related to this: http://stackoverflow.com/questions/30385380/awkward-data-section-behavior-with-nasm — Michael Petch, Nov 26 '15 at 02:29
@MichaelPetch Unfortunately I installed 2.11.08 on my machine, thanks for mentioning that. I'll reverse to 2.11.06 instead — quarterest, Nov 26 '15 at 02:48
No problem, I am voting to close your question as a duplicate of the other. — Michael Petch, Nov 26 '15 at 02:48
Probably a NASM bug caused by multiple "db" directives, try changing the counters to "dw" so you only have one "db" (for the data bytes) - http://stackoverflow.com/questions/32469149/nasm-compiling-x86-64-asm-label-addresses-off-by-256-bytes-in-mach-o-when-using — amdn, Nov 26 '15 at 02:51
@c0r3d3v: there's a new NASM with a fix for the bug. Get that instead of reverting to an old pre-bug version. Err, actually it's still only a release-candidate, but still probably a better choice. Or get YASM instead. — Peter Cordes, Nov 26 '15 at 03:03

Incorrect address generated by LEA instruction

0 Answers0