Question

I use objdump to disassemble some ELF file on 32 bit Linux.

The asm file are in Intel format.

In the disassemble file, I notice some memory slot like below:

80483ed:       c7 44 24 18 07 00 00    mov    DWORD PTR [esp+0x18],0x7
80483f4:       00
80483f5:       c7 44 24 1c 0c 00 00    mov    DWORD PTR [esp+0x1c],0xc
80483fc:       00
80483fd:       c7 44 24 20 01 00 00    mov    DWORD PTR [esp+0x20],0x1
8048404:       00
8048405:       c7 44 24 24 fe ff ff    mov    DWORD PTR [esp+0x24],0xfffffffe
804840c:       ff

and the original assemble file is :

mov     DWORD PTR [esp+24], 7
mov     DWORD PTR [esp+28], 12
mov     DWORD PTR [esp+32], 1
mov     DWORD PTR [esp+36], -2

Could anyone tell me what does the memory address like "80483f4","80483fc" do?

Is this issue related to the memory alignment?

Thank you!

Était-ce utile?

La solution

These are part of the previous line's operands. The "immediate" (constant) numbers are encoded as 32-bits. So 0x07 takes up 4 bytes: 07 00 00 00. Whatever you're using to disable is showing you the last byte on a different line.

Licencié sous: CC-BY-SA avec attribution
Non affilié à StackOverflow
scroll top