CODEWITHSUNDEEP
cassemblyx86gdbatt
Pwrcdr87
Pwrcdr87

Reputation: 965

Asterisk before an address and push instructions, where is it being pushed to?

I am working on an assignment where I need to understand the compiled C Program using GDB. I'm trying to follow the instructions but am having difficulty understanding exactly what the jmp command is doing when it is jumping to an address preceded by *. I've looked where the address is located but it falls between two words. After the jump, there is a push command of a hex value. I'm only assuming that this is basically like using a pointer and the push command overwrites the byte value with hex value being pushed onto it. I'm not sure how far off I am. Here is a portion of the code I'm looking at. Since it is compiled, I've been using the x/10i $pc command (changing the amount of instructions to display depending on where I am) to view the next instructions in line. 

=> 0x08048334 <+0>:     jmp    *0x8049798
   0x0804833a <+6>:     push   $0x10
   0x0804833f <+11>:    jmp    0x8048304

The second jmp proceeds to begin a chain of similar events. This is the address location that the jmp is pointing to. This is the only time I see this address in the byte-dump of the compiled C file:

 8049795:   83 04 08 3a             addl   $0x3a,(%eax,%ecx,1)
 8049799:   83 04 08 4a             addl   $0x4a,(%eax,%ecx,1)

I'd appreciate some helpful insight on if the value is actually be placed into memory location 8049798 and if so, what is it changing it to?

Upvotes: 0

Views: 403

Answers (1)

Employed Russian
Employed Russian

Reputation: 213416

I'm trying to follow the instructions but am having difficulty understanding exactly what the jmp command is doing

It appears that you are looking at the PLT jump stub. You can find detailed description here (look for "lazy binding optimization"), but this a very advanced topic, and you likely shouldn't be trying to understand that code (at least not yet).

This instruction:

jmp    *0x8049798

means: read value at location 0x8049798 and jump there.

Upvotes: 2

Related Questions