Вопрос

I use objdump to disassemble some ELF file on 32 bit Linux.

The asm file are in Intel format.

In the disassemble file, I notice some memory slot like below:

80483ed:       c7 44 24 18 07 00 00    mov    DWORD PTR [esp+0x18],0x7
80483f4:       00
80483f5:       c7 44 24 1c 0c 00 00    mov    DWORD PTR [esp+0x1c],0xc
80483fc:       00
80483fd:       c7 44 24 20 01 00 00    mov    DWORD PTR [esp+0x20],0x1
8048404:       00
8048405:       c7 44 24 24 fe ff ff    mov    DWORD PTR [esp+0x24],0xfffffffe
804840c:       ff

and the original assemble file is :

mov     DWORD PTR [esp+24], 7
mov     DWORD PTR [esp+28], 12
mov     DWORD PTR [esp+32], 1
mov     DWORD PTR [esp+36], -2

Could anyone tell me what does the memory address like "80483f4","80483fc" do?

Is this issue related to the memory alignment?

Thank you!

Это было полезно?

Решение

These are part of the previous line's operands. The "immediate" (constant) numbers are encoded as 32-bits. So 0x07 takes up 4 bytes: 07 00 00 00. Whatever you're using to disable is showing you the last byte on a different line.

Лицензировано под: CC-BY-SA с атрибуция
Не связан с StackOverflow
scroll top