0

I got an x86 binary for linux and I use gdb to disassemble the main function. I see this:

   0x08048080 <+0>:     push   0x8049128
   0x08048085 <+5>:     call   0x804810f
   0x0804808a <+10>:    call   0x804809f
   0x0804808f <+15>:    cmp    eax,0x10f
   0x08048094 <+20>:    je     0x80480dc
   0x0804809a <+26>:    call   0x8048103

I could not understand it since the regular main that I disassemble normally looks like the one below with some preambles.

   0x0804841d <+0>:     push   %ebp
   0x0804841e <+1>:     mov    %esp,%ebp
   0x08048420 <+3>:     and    $0xfffffff0,%esp
   0x08048423 <+6>:     sub    $0x10,%esp
   0x08048426 <+9>:     movl   $0x80484d0,(%esp)
   0x0804842d <+16>:    call   0x80482f0 <puts@plt>
   0x08048432 <+21>:    leave  
   0x08048433 <+22>:    ret

Questions: Can someone explain the first disassembly?

Improve this question
2
  • How do you know the first disassembly is the main function?
    – Guntram Blohm
    Commented Jun 18, 2016 at 8:47
  • (gdb) disassemble main
    – drdot
    Commented Jun 18, 2016 at 15:45

1 Answer 1

Reset to default
1

This looks like a normal main function. Its just that your addresses have not been resolved properly in the first disassembly, while they have been in the second one. You can do

info symbol 0x804810f

in gdb and it would output something like

puts in section .lib

This way you can resolve all the functions being called. Alternatively you can use the nm utility.

The second disassembly has prolog and epilog for stack management and function returns because it has been auto generated by the compiler. However in the first disassembly, it looks like the program author assembled the file with nasm and author used minimal code to do so.

Improve this answer
4
  • This really helps. I have resolved all the function names in this program. However, I still dont understand "push $0x8049128". Is this pushing the ebp? if it is, why is ebp a fix value and how did the programmer find out this fix value?
    – drdot
    Commented Jun 18, 2016 at 16:07
  • Another question: The first call resolves to function puts, the second call resolves to fscanf. je resolves to YouWin. The last call resolves to exit. fscanf requires a file pointer normally created by fopen. Why I dont see a call to fopen in this program?
    – drdot
    Commented Jun 18, 2016 at 16:15
  • Stdin maybe did you try providing say i waaana winnnn and chek a compare
    – blabb
    Commented Aug 17, 2016 at 14:09
  • @dannycrane The function parameters are passed on to the stack. So "push 0x8049128" will push 0x8049128 to the stack which is probably address of a string in the memory, as a parameter to puts. So is something like puts(0x8049128).
    – sudhackar
    Commented Sep 6, 2016 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.