Skip to content
Advertisement

Tag: disassembly

Linux perf_events annotation frame pointer confusion

I ran sudo perf record -F 99 find / followed by sudo perf report and selected “Annotate fdopendir” and here are the first seven instructions: push %rbp push %rbx mov %edi,%esi mov %edi,%ebx mov $0x1,%edi sub $0xa8,%rsp mov %rsp,%rbp The first instruction appears to be saving the caller’s base frame pointer. I believe instructions 2 through 5 are irrelevant to

how to disassebled binary with source line and file name using gcc-linaro-arm-linux-gnueabihf-objdump?

I want to get the disassebled binary files with source line and file name. I have added option -g as a compilation option,following is the setting in cmake files. And following is my objdump bash script: From the instructions, I should have a asm file with source line and file name just as https://manpages.debian.org/testing/binutils-arm-linux-gnueabihf/arm-linux-gnueabihf-objdump.1.en.html it says: –line-numbers Label the display

Strange pointer position in the stack

I wrote this simple code: and I’ve disassembled it to see what the compiler does. Using objdump I obtain: I can understand everything except for the mov QWORD PTR [rbp-0x10],0x0, this correspond (I think)to p=NULL; but from mov QWORD PTR [rbp-0x8],rax I know that my pointer is on rbp-0x8 and it seems correct (the size of a pointer is 8bytes).

(GDB) Breakpoints and Disassemble

I’ve been recently interested in reading books and articles about hacking and I found out that Hacking:The art of exploitation is just a must read title. I am following the basic tutorials on how to work with standard Linux tools and analyze your code (Programming chapter). I am not a beginner in programming but working with Linux terminal is quite

GCC compiled code: why integer declaration needs several statements?

I’m learning AT&T assembly,I know arrays/variables can be declared using .int/.long, or using .equ to declare a symbol, that’s to be replaced by assembly. They’re declared insided either .data section(initialzed),or .bss section(uninitialzed). But when I used gcc to compiled a very simple .c file with ‘-S’ command line option to check the disassembly code, I noticed that: (1) .s is

Advertisement