CODEWITHSUNDEEP
cassemblyx86att
Red Icing
Red Icing

Reputation: 37

How to determine what is in the address Assembly is calling

I'm trying to decipher simple Assembly code, but I'm not very experienced in the language. If I have the following block of code in main:

 push   %ebp
 8048a45:       89 e5                   mov    %esp,%ebp
 8048a47:       53                      push   %ebx
 8048a48:       83 e4 f0                and    $0xfffffff0,%esp
 8048a4b:       83 ec 10                sub    $0x10,%esp
 8048a4e:       8b 45 08                mov    0x8(%ebp),%eax
 8048a51:       8b 5d 0c                mov    0xc(%ebp),%ebx
 8048a54:       83 f8 01                cmp    $0x1,%eax
 8048a57:       75 0c                   jne    8048a65 <main+0x21>
 8048a59:       a1 c4 d7 04 08          mov    0x804d7c4,%eax ??
 8048a5e:       a3 f0 d7 04 08          mov    %eax,0x804d7f0 ??
 8048a63:       eb 74                   jmp    8048ad9 <main+0x95>
 8048a65:       83 f8 02                cmp    $0x2,%eax
 8048a68:       75 49                   jne    8048ab3 <main+0x6f>
 8048a6a:       c7 44 24 04 e8 a2 04    movl   $0x804a2e8,0x4(%esp)

On lines 8048a59 and 048a5e, where I've put the question marks, I'm assuming it's trying to set whatever is in address 0x804d7f0 to what is in address 0x804d7c4, but how do I know what specifically is in those addresses?

Upvotes: 0

Views: 266

Answers (1)

nopasara
nopasara

Reputation: 536

First of all you'll need to determine to which section corresponds this address. You can do this with objdump like this objdump -h

Then you can disassemble section you interested in like its done here.

Here some useful information about viewing sections and their addresses.

Other way is to use run time debugger and just print out memory e.g. x addr for gdb.

P.S. if you like to recover variable name, it may be impossible because compiler usually removes that kind of information for most symbols.

Upvotes: 1

Related Questions