What does the gdb 'x' command do?

2

In my quest to learn more about the computer in general, I stumbled upon a book which has some chapters about disassembling, the x86 assembly language, and the relationship between C and x86 assembly. Now I have been reading this GDB command but I am unable to fully understand it.

The command, along with its results, follows:

(gdb) x/32xw $esp
0xbffff7e0:    0xb8000ce0 0x08048510 0xbffff848 0xb7eafebc
0xbffff7f0:    0x00000002 0xbffff874 0xbffff880 0xb8001898
0xbffff800:    0x00000000 0x00000001 0x00000001 0x00000000
0xbffff810:    0xb7fd6ff4 0xb8000ce0 0x00000000 0xbffff848
0xbffff820:    0x40f5f7f0 0x48e0fe81 0x00000000 0x00000000
0xbffff830:    0x00000000 0xb7ff9300 0xb7eafded 0xb8000ff4
0xbffff840:    0x00000002 0x08048350 0x00000000 0x08048371
0xbffff850:    0x08048474 0x00000002 0xbffff874 0x08048510

Now, from what I understand, the command that I issue tells the debugger to:

  • x (first one): examine the memory
  • 32: get 32 of what follows
  • x: enable hexadecimal representation
  • w: show me Word size data.
  • **Note:** I know that I ask about the esp register, but I don't quite fully understand what $ is doing in front of it. When I try not to use it, I get a missing symbol error, so I get it has something to do with reference/de-reference?

What has been bugging me is how did I find all those bytes? Since I am examining a register, who's size is 32 bit, shouldn't I get only 32 bits, or 4 bytes (only 1 row of the above)? If I am correct with my assumption, then were did we find the rest of the data? Does it have to do something with the stack, and a particular stack frame, which I currently am unaware of?

I would appreciate your input so that I can clarify things in my mind.

memory
assembly
gdb
cpu-registers
asked on Stack Overflow Aug 9, 2012 by NlightNFotis • edited Feb 13, 2018 by jww

3 Answers

3
(gdb) help x   
Examine memory: x/FMT ADDRESS.

Giving $esp as the address will make gdb fetch whatever is in that register and use that as the memory address for the x command - and will show you the following 32 words in memory starting at that address.

variables within gdb itself are names prefixed with a $ , gdb sets up predefined variables for all the cpu registers.

If you want to inspect the esp register, use the command info registers esp, as you'll see with your example (x/32xw $esp), the esp register contains the first address shown, 0xbffff7e0

answered on Stack Overflow Aug 9, 2012 by nos
2

It's giving you 32 words of memory where the esp register is pointing (apparently that register contains the address 0xbffff7e0).

answered on Stack Overflow Aug 9, 2012 by MRAB
0

(gdb) x/32xw $esp it means show me the 32 words field where esp points.

pieces:32, format:hex , size:word (1 word= 32 bit on gdb)

show me the 32 words field where esp points (hex)0xbffff7e0 - (hex)0xbffff7f0 = (dec)3221223392 - (dec)3221223408 = 16bytes=4words

answered on Stack Overflow Aug 15, 2019 by nuri yavuz

User contributions licensed under CC BY-SA 3.0