I am workin on Overthewire narnia2(ctf game). Currently I am learning how to use the gdb and I have a simple question.
(gdb) x/200x $esp-0xac
0xffffd5a4: 0x08048534 0xffffd5c8 0xf7e5b7d0 0xffffd5c8
0xffffd5b4: 0xf7ffd920 0xf7e5b7d5 0x08048494 0x08048534
0xffffd5c4: 0xffffd5c8 0x6850c031 0x68732f2f 0x69622f68
0xffffd5d4: 0x50e3896e 0x89e18953 0xcd0bb0c2 0x41414180
0xffffd5e4: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffd5f4: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffd604: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffd614: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffd624: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffd634: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffd644: 0x41414141 0x62626262 0xf7e2a200 0x00000002
0xffffd654: 0xffffd6e4 0xffffd6f0 0x00000000 0x00000000
0xffffd664: 0x00000000 0xf7fc5000 0xf7ffdc0c 0xf7ffd000
0xffffd674: 0x00000000 0x00000002 0xf7fc5000 0x00000000
0xffffd684: 0x59e07c0a 0x6308501a 0x00000000 0x00000000
(gdb) x/200x $esp
0xffffd7a0: 0x000036b2 0x0000000e 0x000036b2 0x00000017
0xffffd7b0: 0x00000001 0x00000019 0xffffd7eb 0x0000001a
0xffffd7c0: 0x00000000 0x0000001f 0xffffdfe8 0x0000000f
0xffffd7d0: 0xffffd7fb 0x00000000 0x00000000 0x00000000
0xffffd7e0: 0x00000000 0x00000000 0x8b000000 0xb1cfbc04
0xffffd7f0: 0x91563e77 0xcb1ff506 0x6957e20c 0x00363836
0xffffd800: 0x00000000 0x00000000 0x00000000 0x72616e2f
0xffffd810: 0x2f61696e 0x6e72616e 0x00326169 0x41414141
0xffffd820: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffd830: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffd840: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffd850: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffd860: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffd870: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffd880: 0x41414141 0x31414141 0x2f6850c0 0x6868732f
0xffffd890: 0x6e69622f 0x5350e389 0xc289e189 0x80cd0bb0
what am I looking at when I do $esp-0xac? I've also seen other methods like $esp-0x14, but why not do plain $esp? what is the most used and why?
what am i looking at when i do $esp-0xac?
The $esp
register points to the boundary (in memory) between used and unused portion of the stack. On i*86
processors, stack grows to lower addresses, so anything above (at higher addresses) $esp
contains used portion of the stack (local variables, return addresses, saved registers, etc.) and anything below (at lower addresses) contains currently unused portion of the stack.
The command x/200x $esp-0xac
then examines contents of 43 32-bit words of currently used stack, and 157 words of unused portion of the stack.
ive also seen other methods like $esp-0x14, but why not do plain $esp?
The $esp-0x14
would let you look at the last 5 used words of the stack. Using $esp
would let you look at the unused portion of the stack. You could do that, but it's somewhat pointless.
what is the most used and why?
Examining stack is useful when you want to where some specific value is stored (e.g. during exploit / stack buffer overflow analysis), or when you are debugging at the machine instruction level.
User contributions licensed under CC BY-SA 3.0