15213 Recitation Section C Shimin Chen Sept 16 2002 Outline Assembly Review C ASM using GDB ASM C Assembly Review Machine Model CPU E I P Registers Condition Codes Addresses Data Instruction s Memory Object Code Program Data Stack 15213 Recitation C 2 Shimin Chen Assembly Format Op Src Dest add eax ebx sub eax ebx ebx eax ebx eax Op Arg jmp 0x87654321 jge 0x87654321 15213 Recitation C unconditional branch branch if in signed comparison 3 Shimin Chen Memory Addressing Mode Generic form D R1 R2 S Address Reg R1 Reg R2 S D e g 0x8 eax ebx 0x4 the address is eax ebx 0x4 0x8 Special forms omit D R1 R2 or S R1 D R1 R1 R2 D R1 R2 15213 Recitation C 4 Shimin Chen Exercise What do the ASM mean 1 2 3 4 5 6 sub ecx edx cmp ecx 0x4 jge 0x12345678 mov ebx eax mov ebx esi 0x4 edi lea ebx esi 0x4 edi xor ecx ecx 15213 Recitation C 5 Shimin Chen Procedure Related Instructions int a func int arg1 int arg2 int arg3 Get arguments arg1 mov 8 ebp ecx arg2 mov 12 ebp ecx arg3 mov 16 ebp ecx Set return value mov 0x1 eax 15213 Recitation C return 1 6 Shimin Chen C ASM Compilation and GDB basics C ASM Examples 15213 Recitation C 7 Shimin Chen Compiling and Debugging C Code Generating ASM with gcc gcc O S Wall example c generate example s Debugging C code gcc O g o example Wall example c gdb example 15213 Recitation C 8 Shimin Chen What if compiling without g gcc O o example Wall example c gdb will not know the C code for assembly the same as in L2 bomb lab use gdb to examine the object code Other tools objdump etc see L2 description 15213 Recitation C 9 Shimin Chen Example func1 int func1 int a int b int x y x a b y 2 x b return x y 15213 Recitation C 10 Shimin Chen ASM of func1 Dump of assembler code for function func1 0x8048420 func1 push ebp 0x8048421 func1 1 mov esp ebp 0x8048423 func1 3 mov 0xc ebp eax 0x8048426 func1 6 mov 0x8 ebp ecx 0x8048429 func1 9 add eax ecx 0x804842b func1 11 lea ecx ecx 1 edx 0x804842e func1 14 sub eax edx 0x8048430 func1 16 mov ecx eax 0x8048432 func1 18 imul edx eax 0x8048435 func1 21 mov ebp esp 0x8048437 func1 23 pop ebp 0x8048438 func1 24 ret 0x8048439 func1 25 lea 0x0 esi esi End of assembler dump 15213 Recitation C 11 Shimin Chen ASM of func1 Dump of assembler code for function func1 0x8048420 func1 push ebp 0x8048421 func1 1 mov esp ebp 0x8048423 func1 3 mov 0xc ebp eax eax b 0x8048426 func1 6 mov 0x8 ebp ecx ecx a 0x8048429 func1 9 add eax ecx ecx a b 0x804842b func1 11 lea ecx ecx 1 edx edx 2 ecx 0x804842e func1 14 sub eax edx edx b 0x8048430 func1 16 mov ecx eax eax x 0x8048432 func1 18 imul edx eax return x y 0x8048435 func1 21 mov ebp esp 0x8048437 func1 23 pop ebp 0x8048438 func1 24 ret 0x8048439 func1 25 lea 0x0 esi esi End of assembler dump 15213 Recitation C 12 Shimin Chen Using GDB to run the program Let s use gdb to run the program and examine registers and memory locations break func1 run p x ebp x 2wx ebp 8 15213 Recitation C 13 Shimin Chen Example 2 int func2 int a int b if a b return a else return b 15213 Recitation C 14 Shimin Chen ASM of func2 Dump of assembler code for function func2 0x804843c func2 push ebp 0x804843d func2 1 mov esp ebp 0x804843f func2 3 mov 0x8 ebp edx 0x8048442 func2 6 mov 0xc ebp eax 0x8048445 func2 9 cmp eax edx 0x8048447 func2 11 jle 0x804844b func2 15 0x8048449 func2 13 mov edx eax 0x804844b func2 15 mov ebp esp 0x804844d func2 17 pop ebp 0x804844e func2 18 ret 0x804844f func2 19 nop End of assembler dump 15213 Recitation C 15 Shimin Chen ASM of func2 Dump of assembler code for function func2 0x804843c func2 push ebp 0x804843d func2 1 mov esp ebp 0x804843f func2 3 mov 0x8 ebp edx edx a 0x8048442 func2 6 mov 0xc ebp eax eax b 0x8048445 func2 9 cmp eax edx edx eax 0x8048447 func2 11 jle 0x804844b func2 15 0x8048449 func2 13 mov edx eax eax a 0x804844b func2 15 mov ebp esp 0x804844d func2 17 pop ebp 0x804844e func2 18 ret 0x804844f func2 19 nop End of assembler dump 15213 Recitation C 16 Shimin Chen Example 3 int func3 int a int b int r 0xDEADBEEF switch a case 0 case 1 r b break case 2 r a b break case 3 r a b break case 4 r a b break default return r 15213 Recitation C 17 Shimin Chen ASM of func3 Dump of assembler code for function func3 0x8048450 func3 push ebp 0x8048451 func3 1 mov esp ebp 0x8048453 func3 3 mov 0x8 ebp edx 0x8048456 func3 6 mov 0xc ebp ecx 0x8048459 func3 9 mov 0xdeadbeef eax 0x804845e func3 14 cmp 0x4 edx 0x8048461 func3 17 ja 0x804848b func3 59 0x8048463 func3 19 jmp 0x8048598 edx 4 0x804846a func3 26 lea 0x0 esi esi 0x8048470 func3 32 mov ecx eax 0x8048472 func3 34 jmp 0x804848b func3 59 0x8048474 func3 36 lea ecx edx 1 eax 0x8048477 func3 39 jmp 0x804848b func3 59 15213 Recitation C 18 Shimin Chen ASM of func3 0x8048479 func3 41 0x8048480 func3 48 0x8048482 func3 50 0x8048484 func3 52 0x8048486 func3 54 0x8048488 func3 56 0x804848b func3 59 0x804848d func3 61 0x804848e func3 62 lea mov sub jmp mov imul mov pop ret 0x0 esi 1 esi edx eax ecx eax 0x804848b func3 59 edx eax ecx eax ebp esp ebp gdb x 5wx 0x8048598 0x8048598 IO stdin used 4 0x08048470 0x08048474 0x08048480 0x80485a8 IO stdin used 20 0x08048486 15213 Recitation C 19 0x08048470 Shimin Chen ASM of func3 Dump of assembler code for function func3 0x8048450 func3 push ebp 0x8048451 func3 1 mov esp ebp 0x8048453 func3 3 mov 0x8 ebp edx edx a 0x8048456 func3 6 mov 0xc ebp ecx ecx b 0x8048459 func3 9 mov 0xdeadbeef eax eax is r 0x804845e func3 14 cmp 0x4 edx a 4 0x8048461 func3 17 ja 0x804848b func3 59 0x8048463 func3 19 jmp 0x8048598 edx 4 jmp table 0x804846a func3 26 lea 0x0 esi esi nop 0x8048470 func3 32 mov ecx eax r b 0x8048472 func3 34 jmp 0x804848b func3 59 0x8048474 func3 36 lea ecx edx 1 eax r a b 0x8048477 func3 39 jmp 0x804848b func3 59 15213 Recitation C 20 Shimin Chen ASM of func3 0x8048479 func3 41 0x8048480 func3 48 0x8048482 func3 50 0x8048484 func3 52 0x8048486 func3 54 0x8048488 func3 56 0x804848b func3 59 0x804848d func3 61 0x804848e func3 62 lea mov sub jmp mov imul mov pop ret 0x0 esi 1 esi edx eax ecx eax 0x804848b func3 59 edx eax ecx eax ebp esp ebp gdb x 5wx 0x8048598 0x8048598 IO stdin used 4 0x08048470 …
View Full Document
Unlocking...