Question

According to internet's tutorials, when i disassemble a program, i should see code like this: (c hello world)

0x8048384     push ebp                     
0x8048385     mov ebp,esp               
0x8048387     sub esp,0x8                
0x804838a     and esp,0xfffffff0          
0x804838d     mov eax,0x0                 
0x8048392     sub esp,eax                 
0x8048394     mov DWORD PTR [esp],0x80484c4    
0x804839b     call 0x80482b0 <_init+56>                     
0x80483a0     mov eax,0x0                 
0x80483a5     leave                             
0x80483a6     ret       

However, what i see is:

   0x0804860c <+0>: push   %ebp
   0x0804860d <+1>: mov    %esp,%ebp
   0x0804860f <+3>: and    $0xfffffff0,%esp
   0x08048612 <+6>: sub    $0x10,%esp
   0x08048615 <+9>: movl   $0x8048720,0x4(%esp)
   0x0804861d <+17>:    movl   $0x804a040,(%esp)
   0x08048624 <+24>:    call   0x8048500 <_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc@plt>
   0x08048629 <+29>:    mov    $0x0,%eax
   0x0804862e <+34>:    leave  
   0x0804862f <+35>:    ret 

in which parameters(? no idea how it is called, i mean the %esp, %ebp thingies) are in exact opposite to what is in the first code. Is it due to '%' marks? What do they even mean? (and what does '$' mean here?)

Was it helpful?

Solution

These are 2 different syntaxes for x86 assembly. The first is called "intel syntax" and the second is called "at&t syntax". More on wikipedia about this issue.

Your disassembler should have an option to change the flavour of the assembly it generates. For example objdump supports a -M intel switch.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top