I recently started reading a book about reverse engineering. In one of the examples it uses gdb (debugger) to disassemble the main. So I did it, and the output is below
(gdb) disass main
Dump of assembler code for function main:
0x0000118d <+0>: lea ecx,[esp+0x4]
0x00001191 <+4>: and esp,0xfffffff0
0x00001194 <+7>: push DWORD PTR [ecx-0x4]
0x00001197 <+10>: push ebp
0x00001198 <+11>: mov ebp,esp
0x0000119a <+13>: push ebx
0x0000119b <+14>: push ecx
0x0000119c <+15>: sub esp,0x10
0x0000119f <+18>: call 0x1090 <__x86.get_pc_thunk.bx>
0x000011a4 <+23>: add ebx,0x2e5c
0x000011aa <+29>: mov DWORD PTR [ebp-0xc],0x0
0x000011b1 <+36>: jmp 0x11c9 <main+60>
0x000011b3 <+38>: sub esp,0xc
0x000011b6 <+41>: lea eax,[ebx-0x1ff8]
0x000011bc <+47>: push eax
0x000011bd <+48>: call 0x1030 <puts@plt>
0x000011c2 <+53>: add esp,0x10
0x000011c5 <+56>: add DWORD PTR [ebp-0xc],0x1
0x000011c9 <+60>: cmp DWORD PTR [ebp-0xc],0x9
0x000011cd <+64>: jle 0x11b3 <main+38>
--Type <RET> for more, q to quit, c to continue without paging--
0x000011cf <+66>: mov eax,0x0
0x000011d4 <+71>: lea esp,[ebp-0x8]
0x000011d7 <+74>: pop ecx
0x000011d8 <+75>: pop ebx
0x000011d9 <+76>: pop ebp
0x000011da <+77>: lea esp,[ecx-0x4]
0x000011dd <+80>: ret
End of assembler dump.
And now I put a breakpoint at main to check the eip register value and compare it with address at main function as shown below
(gdb) info register eip
eip 0x565561aa 0x565561aa <main+29>
And here comes the problem, eip register value is not matching with the address at main in my case (shown below),
0x000011aa <+29>: mov DWORD PTR [ebp-0xc],0x0
whereas in the example it was mentioned that it will match. Please help me in solving this. Thanks in advance.
Update : examining instruction at eip , address matches with eip but not with address in the memory dumb shown above
(gdb) x/i $eip
=> 0x565561aa <main+29>: mov DWORD PTR [ebp-0xc],0x0