Question

I use objdump to disassemble some ELF file on 32 bit Linux.

The asm file are in Intel format.

In the disassemble file, I notice some memory slot like below:

80483ed:       c7 44 24 18 07 00 00    mov    DWORD PTR [esp+0x18],0x7
80483f4:       00
80483f5:       c7 44 24 1c 0c 00 00    mov    DWORD PTR [esp+0x1c],0xc
80483fc:       00
80483fd:       c7 44 24 20 01 00 00    mov    DWORD PTR [esp+0x20],0x1
8048404:       00
8048405:       c7 44 24 24 fe ff ff    mov    DWORD PTR [esp+0x24],0xfffffffe
804840c:       ff

and the original assemble file is :

mov     DWORD PTR [esp+24], 7
mov     DWORD PTR [esp+28], 12
mov     DWORD PTR [esp+32], 1
mov     DWORD PTR [esp+36], -2

Could anyone tell me what does the memory address like "80483f4","80483fc" do?

Is this issue related to the memory alignment?

Thank you!

Was it helpful?

Solution

These are part of the previous line's operands. The "immediate" (constant) numbers are encoded as 32-bits. So 0x07 takes up 4 bytes: 07 00 00 00. Whatever you're using to disable is showing you the last byte on a different line.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top