I am new to GDB and how software works on a low level.
Currently I am reading book «HACKING the art of expoitation» by Jon Erickson.
I know what is stack, what is stack pointer, base pointer and etc. I can easily understarnd info stack
command, but what is x/[n][x] $[reg]
?
Example from book:
0x08048344 <test_function+0>: push ebp
0x08048345 <test_function+1>: mov ebp,esp
0x08048347 <test_function+3>: sub esp,0x28
0x0804834a <test_function+6>: mov DWORD PTR [ebp-12],0x7a69
0x08048351 <test_function+13>: mov BYTE PTR [ebp-40],0x41
0x08048355 <test_function+17>: leave
0x08048356 <test_function+18>: ret
...
(gdb) x/16xw $esp
0xbffff7c0: 0x00000000 0x08049548 0xbffff7d8 0x08048249
0xbffff7d0: 0xb7f9f729 0xb7fd6ff4 0xbffff808 0x080483b9
0xbffff7e0: 0xb7fd6ff4 0xbffff89c 0xbffff808 0x0804838b
0xbffff7f0: 0x00000001 0x00000002 0x00000003 0x00000004
What is that? As I know this command shows 16 last var's addresses stored in stack.
But what is 0xbffff7c0 0xbffff7d0 0xbffff7ce
? How to read it? and why there is a 10 byte shift always?
Explain please.
0xbffff7c0 is memory address
0x00000000 0x08049548 0xbffff7d8 0x08048249 is the content of the 0xbffff7c0 in hexa format
in general :
x/nfu addr
n, f, and u are all optional parameters that specify how much memory to display and how to format it; addr is an expression giving the address where you want to start displaying memory. If you use defaults for nfu, you need not type the slash `/'. Several commands set convenient defaults for addr.
Read moore here
User contributions licensed under CC BY-SA 3.0