how to does this instruction work: `mov qword ptr [rbp-0x30], 0x4020c5`

Question

The following is the code snippet (shown partially) I have:

q = strrchr(resolved, '/');     /* given /home/misha/docs.txt, q now pts to the last slash */
    if (q != NULL) {
      p = q + 1;                   /* p points to docs.txt */

      if (q == resolved)
        q = "/";
      else {
        do {
          --q;
        } while (q > resolved && *q == '/');

The generated output with -S flag using objdump:

401789:       e8 7a fb ff ff          call   401308 <strrchr>
  40178e:       48 89 45 d0             mov    QWORD PTR [rbp-0x30],rax
    if (q != NULL) {
  401792:       48 83 7d d0 00          cmp    QWORD PTR [rbp-0x30],0x0
  401797:       0f 84 12 01 00 00       je     4018af <fb_realpath+0x22d>
      p = q + 1;                   /* p points to docs.txt */
  40179d:       48 8b 45 d0             mov    rax,QWORD PTR [rbp-0x30]
  4017a1:       48 83 c0 01             add    rax,0x1
  4017a5:       48 89 45 d8             mov    QWORD PTR [rbp-0x28],rax

      if (q == resolved)
  4017a9:       48 8b 45 d0             mov    rax,QWORD PTR [rbp-0x30]
  4017ad:       48 3b 85 e0 fe ff ff    cmp    rax,QWORD PTR [rbp-0x120]
  4017b4:       75 0a                   jne    4017c0 <fb_realpath+0x13e>
        q = "/";
  4017b6:       48 c7 45 d0 c5 20 40    mov    QWORD PTR [rbp-0x30],0x4020c5
  4017bd:       00
  4017be:       eb 33                   jmp    4017f3 <fb_realpath+0x171>
      else {
        do {
          --q;
  4017c0:       48 83 6d d0 01          sub    QWORD PTR [rbp-0x30],0x1
        } while (q > resolved && *q == '/');
  4017c5:       48 8b 45 d0             mov    rax,QWORD PTR [rbp-0x30]
  4017c9:       48 3b 85 e0 fe ff ff    cmp    rax,QWORD PTR [rbp-0x120]
  4017d0:       76 0b                   jbe    4017dd <fb_realpath+0x15b>
  4017d2:       48 8b 45 d0             mov    rax,QWORD PTR [rbp-0x30]
  4017d6:       0f b6 00                movzx  eax,BYTE PTR [rax]
  4017d9:       3c 2f                   cmp    al,0x2f
  4017db:       74 e3                   je     4017c0 <fb_realpath+0x13e>

Now, I have a question about q = "/"; instruction. q is defined as a char* and as seen from this examples, it contains a value returned by strrchr fucntion. Then it is assigned to a string - q = "/"; further in the code. Now, the instruction which represents that in assembly is - mov QWORD PTR [rbp-0x30],0x4020c5. I have very hard time understanding this instruction. Now, my understanding is that, it supposed to move the string "/" to the location pointed by q. But how does it know the location pointed by q? i.e. rbp-0x30 is a location on the stack where q is stored. And this location is supposed to contain the address of the object where q is pointing. But, I interpret mov QWORD PTR [rbp-0x30],0x4020c5 as move string 0x4020c5 to rbp-0x30 i.e. the address of q. That is where I am confused as that location is supposed to contain the address and not the string.

Thanks for reading and your help is appreciated.

Answer 1

mov QWORD PTR [rbp-0x30],0x4020c5 means exactly "move 0x4020c5 to a memory location rbp-0x30 and treat this number as qword" (8 - byte number).

But q is at the memory location rbp - 0x30, so anything you write into that address, will be written into q. So, the number 0x4020c5 was written into q. The number 0x4020c5 is not a string itself - it's a memory address of a string (just a pointer). So q points to a string at 0x4020c5, hence q[0] == '/' and q[1] == NULL.

And that's the behaviour that we expect from instruction q = "/" - it doesn't change the memory the q points at, but changes the q itself.

Answer 2

you can add some print address of variable debug aid in your source to get a grip of these addresses

see the disassembly of line no 5 in the paste below

#include <stdio.h>

int main (void) {
    char * q;
    q = "/";
    printf("%p\n",&q);
}

disassembly

slashaddr!main:
    3 01141000 55              push    ebp
    3 01141001 8bec            mov     ebp,esp
    3 01141003 51              push    ecx
    5 01141004 c745fc90011801  mov     dword ptr [ebp-4], (01180190)