Question

Hello im looking at an executable and don't have access to the source code. I haven't really come across this before and what I have found online, doesn't match the data that I am getting. Code:

0x08048d4c <+45>:   movsbl (%ebx,%eax,1),%esi
0x08048d50 <+49>:   and    $0xf,%esi
0x08048d53 <+52>:   add    (%ecx,%esi,4),%edx

My confusion is in the +52 line. "x/d $ecx" yields 2, and the value at %esi before the line is called, is 7. after that line is executed %edx is set to be equal to 3 (was zero before hand).

I thought that it would be 2 + (7*4), but that is not the case. Can someone please enlighten me. This is AT&T syntax i believe.

Was it helpful?

Solution

Yes it's at&t syntax and if you are confused by it, then switch gdb to intel syntax (set disassembly-flavor intel). You would see something like: add edx, [ecx + esi*4] Anyway, this fetches an operand from memory, from address ecx + esi*4. You can see what that is using x/d $ecx+$esi*4. x/d $ecx doesn't help you anything because the addition is to the address, not the value.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top