2

I have code in C:

int a() {

     char string[100];
}

When I compile this I get code in assembly:

a:
    push    rbp
    mov rbp, rsp
    sub rsp, 112
    mov rax, QWORD PTR fs:40  <----
    mov QWORD PTR [rbp-8], rax <----
    xor eax, eax
    nop
    mov rdx, QWORD PTR [rbp-8]
    xor rdx, QWORD PTR fs:40
    je  .L2
    call    __stack_chk_fail

What make lines that I checked ? What is it "fs:40" ? (always when I make a array in c) and what is in rbp-12 ? nothing ?

  • i started writing an answer and then i relaised your paste is messed up did you copy paste correctly ? the line xor rdx . qword ptr fs:40 doesnt look correct it must be xor rdx, rax or something else (if it xorred with 0 then fs:40 is stack canary (read up on the smashing the stack canary stack gaurd etc – blabb Aug 15 '16 at 18:27
  • compiled again, it is the same , I used the command "gcc -S -fno - asynchronous - unwind -tables -masm = intel sock.c " – Wallers Jason Aug 15 '16 at 20:15
  • try adding -fno-stack-protector to that and see – blabb Aug 15 '16 at 20:37
  • thanks, all incomprehensible lines were gone :D and now I know what they did – Wallers Jason Aug 15 '16 at 20:56
2

I would start out by looking at this previous topic Good reference for Assembler here on stack overflow. From the sound of it you probably don't have much assembler experience and that's ok. Assembler is just a way of getting the cpu to understand what you want it to do.

before things can be explained you have to understand the convention of the use of the registers and what they all mean. for example the base pointer of the stack is saved at entry of a function (push rbp) so it can be restored when the function ends. in your c code you have int a()

the start of the function defines a new stack frame with no parameters and a return result. we'll be returning a variable and it by convention will be returned in the A register (usually RAX).

Once RBP has been preserved the current stack pointer (RSP) is set to the base pointer RBP and things get manipulated from there. Think of the stack as just a structure of memory that has been pre-allocated for special computational use.

the instructions will bounce back and forth relative to the RBP to reference variables, (local, global, etc) as the function progresses and as needed.

Depending on the OS and chip, FS might be referring to a thread local storage block, or it might be referring to a memory segment on the cpu. Its dependent on your OS and architecture. the :40 is an offset into the segment or block.

typically, and it depends on your OS, when you see something like rbp-8 or whatever it means to take the current value of RBP and subtract 8 from it. however on some implementations and depending on where the scalar is placed it can mean take that many byte segments (words) as an offset from RBP and use that effective address.

that's all I have for now. I'd start with the other topic and go from there.

Or just run it in a debugger and look at the values of the registers as it moves through each step.

  • thanks for your reply, I am very grateful. Very me wonder what is put on the stack in these two lines (checked in code) , they are repeated each time only when I create arrays and always it is value from fg:40 other interesting thing is that when I put something at first byte of array I get code: mov QWORD PTR [rbp-8], rax xor eax, eax mov DWORD PTR [rbp-16], 97 What is in rbp - 12 ? empty space ? – Wallers Jason Aug 15 '16 at 20:28
  • probably I know what is it, stack protector, compilator check if someone overwrite stack – Wallers Jason Aug 15 '16 at 20:57
  • If you can get your hands on a debugger, an easy way to find out whats going on is step through one instruction at a time. At each point, examine the registers and memory locations (such as rbp-16) and see whats there before the 97 gets moved there and after it gets moved there. Note this varies by OS but the numbers aren't necessarily base 10. It was the compiler's job to translate the original C source to assembler and it had to keep track variable storage. The cpu is using the stack area to store its calculations and that's why its storing things at various points along the way. – Div Aug 19 '16 at 12:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.