Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Type "show copying" to see the conditions.<br />
There is absolutely no warranty for GDB. Type "show warranty" for<br />
details.<br />
This GDB was configured as "i386-slackware-linux"...<br />
(gdb) disas main<br />
Dump of assembler code for function main:<br />
0x8048314 : push %ebp<br />
0x8048315 : mov %esp,%ebp<br />
0x8048317 : sub $0x8,%esp<br />
0x804831a : and $0xfffffff0,%esp<br />
0x804831d : mov $0x0,%eax<br />
0x8048322 : sub %eax,%esp<br />
0x8048324 : xor %eax,%eax<br />
0x8048326 : xor %ebx,%ebx<br />
0x8048328 : mov $0x1,%bl<br />
0x804832a : push $0xa<br />
0x804832c : push $0x7362614c<br />
0x8048331 : push $0x44544f4d<br />
0x8048336 : mov %esp,%ecx<br />
0x8048338 : xor %edx,%edx<br />
0x804833a : mov $0xa,%dl<br />
0x804833c : mov $0x4,%al<br />
0x804833e : int $0x80<br />
0x8048340 : xor %eax,%eax<br />
0x8048342 : xor %ebx,%ebx<br />
0x8048344 : mov $0x1,%al<br />
0x8048346 : int $0x80<br />
0x8048348 : leave<br />
0x8048349 : ret<br />
0x804834a : nop<br />
0x804834b : nop<br />
0x804834c : nop<br />
0x804834d : nop<br />
0x804834e : nop<br />
0x804834f : nop<br />
End of assembler dump.<br />
(gdb)<br />
Repare que agora o código começa em , como antes, mas<br />
agora termina em . A retirada dos null's bytes fez o<br />
programa fica menor ainda. Vamos capturar os opcodes novamente.:<br />
(gdb) x/xb main+16<br />
0x8048324 : 0x31<br />
(gdb)<br />
0x8048325 : 0xc0<br />
(gdb)<br />
0x8048326 : 0x31<br />
(gdb)<br />
0x8048327 : 0xdb<br />
(gdb)<br />
0x8048328 : 0xb3<br />
(gdb)<br />
...<br />
...<br />
...<br />
0x8048343 : 0xdb<br />
71
Change language