0

I am working on an assignment where I need to understand the compiled C Program using GDB. I'm trying to follow the instructions but am having difficulty understanding exactly what the jmp command is doing when it is jumping to an address preceded by *. I've looked where the address is located but it falls between two words. After the jump, there is a push command of a hex value. I'm only assuming that this is basically like using a pointer and the push command overwrites the byte value with hex value being pushed onto it. I'm not sure how far off I am. Here is a portion of the code I'm looking at. Since it is compiled, I've been using the x/10i $pc command (changing the amount of instructions to display depending on where I am) to view the next instructions in line. 

=> 0x08048334 <+0>:     jmp    *0x8049798
   0x0804833a <+6>:     push   $0x10
   0x0804833f <+11>:    jmp    0x8048304

The second jmp proceeds to begin a chain of similar events. This is the address location that the jmp is pointing to. This is the only time I see this address in the byte-dump of the compiled C file:

 8049795:   83 04 08 3a             addl   $0x3a,(%eax,%ecx,1)
 8049799:   83 04 08 4a             addl   $0x4a,(%eax,%ecx,1)

I'd appreciate some helpful insight on if the value is actually be placed into memory location 8049798 and if so, what is it changing it to?

1201ProgramAlarm
  • 32,384
  • 7
  • 42
  • 56
Pwrcdr87
  • 935
  • 3
  • 16
  • 36
  • `push $0x10` just pushes the value 16 onto the stack and decrements the stack pointer `esp` – MFisherKDX Oct 31 '17 at 00:14
  • I know that `push` and `pop` are stack related commands, but couldn't understand what the asterisk was doing since that address falls between two words. Not sure what the `jmp` command in that instance does. And how is it decrementing the stack pointer? – Pwrcdr87 Oct 31 '17 at 00:16
  • *"And how is it decrementing the stack pointer?"* It just does. That's what the instruction is defined to do. Just like the `jmp` instruction is defined to set the instruction pointer `eip`. – MFisherKDX Oct 31 '17 at 00:41
  • good point.... wasn't thinking about certain instructions innately altering other values by design. – Pwrcdr87 Oct 31 '17 at 00:43

1 Answers1

2

I'm trying to follow the instructions but am having difficulty understanding exactly what the jmp command is doing

It appears that you are looking at the PLT jump stub. You can find detailed description here (look for "lazy binding optimization"), but this a very advanced topic, and you likely shouldn't be trying to understand that code (at least not yet).

This instruction:

jmp    *0x8049798

means: read value at location 0x8049798 and jump there.

Employed Russian
  • 199,314
  • 34
  • 295
  • 362
  • hahaha thanks. Glad my ineptitude in C and GDB is so apparent! I appreciate your honest – Pwrcdr87 Oct 31 '17 at 00:47
  • I noticed it was jumping there, because when I do `x/d
    ` it is producing the decimal value of the hex value there. But I'm not entirely sure what it is doing with it
     – Pwrcdr87 Oct 31 '17 at 00:50