0

I'm trying to decipher simple Assembly code, but I'm not very experienced in the language. If I have the following block of code in main:

 push   %ebp
 8048a45:       89 e5                   mov    %esp,%ebp
 8048a47:       53                      push   %ebx
 8048a48:       83 e4 f0                and    $0xfffffff0,%esp
 8048a4b:       83 ec 10                sub    $0x10,%esp
 8048a4e:       8b 45 08                mov    0x8(%ebp),%eax
 8048a51:       8b 5d 0c                mov    0xc(%ebp),%ebx
 8048a54:       83 f8 01                cmp    $0x1,%eax
 8048a57:       75 0c                   jne    8048a65 <main+0x21>
 8048a59:       a1 c4 d7 04 08          mov    0x804d7c4,%eax ??
 8048a5e:       a3 f0 d7 04 08          mov    %eax,0x804d7f0 ??
 8048a63:       eb 74                   jmp    8048ad9 <main+0x95>
 8048a65:       83 f8 02                cmp    $0x2,%eax
 8048a68:       75 49                   jne    8048ab3 <main+0x6f>
 8048a6a:       c7 44 24 04 e8 a2 04    movl   $0x804a2e8,0x4(%esp)

On lines 8048a59 and 048a5e, where I've put the question marks, I'm assuming it's trying to set whatever is in address 0x804d7f0 to what is in address 0x804d7c4, but how do I know what specifically is in those addresses?

zx485
  • 28,498
  • 28
  • 50
  • 59
Red Icing
  • 37
  • 2
  • 9
  • You don't if you don't know what the program is and what it is doing. – Hannu Nov 04 '16 at 12:44
  • 1
    If you can get the linker to spit out a map file, you should get a list of all absolute addresses for your variables. – Lundin Nov 04 '16 at 12:45

1 Answers1

1

First of all you'll need to determine to which section corresponds this address. You can do this with objdump like this objdump -h

Then you can disassemble section you interested in like its done here.

Here some useful information about viewing sections and their addresses.

Other way is to use run time debugger and just print out memory e.g. x addr for gdb.

P.S. if you like to recover variable name, it may be impossible because compiler usually removes that kind of information for most symbols.

Community
  • 1
  • 1
nopasara
  • 538
  • 3
  • 10
  • 1
    Use `objdump -d -r` to print symbol info ("Relocations") for addresses, when it's available. It tacks on a comment like `# 61d0c8 `. Beware of cases like this where it's really nothing to do with stderr, just that was the nearest symbol still present in the final binary. It works a lot better on `.o` files than executables, since the linker hasn't yet thrown away symbol info for non-global static data. – Peter Cordes Nov 06 '16 at 14:55
  • I actually use `alias disas='objdump -drwC -Mintel'`, to do that, de-mangle C++ names, and use Intel-style syntax. (And not line-wrap the machine code for long instructions). – Peter Cordes Nov 06 '16 at 14:55