2

The following is the code snippet (shown partially) I have:

q = strrchr(resolved, '/');     /* given /home/misha/docs.txt, q now pts to the last slash */
    if (q != NULL) {
      p = q + 1;                   /* p points to docs.txt */

      if (q == resolved)
        q = "/";
      else {
        do {
          --q;
        } while (q > resolved && *q == '/');

The generated output with -S flag using objdump:

401789:       e8 7a fb ff ff          call   401308 <strrchr>
  40178e:       48 89 45 d0             mov    QWORD PTR [rbp-0x30],rax
    if (q != NULL) {
  401792:       48 83 7d d0 00          cmp    QWORD PTR [rbp-0x30],0x0
  401797:       0f 84 12 01 00 00       je     4018af <fb_realpath+0x22d>
      p = q + 1;                   /* p points to docs.txt */
  40179d:       48 8b 45 d0             mov    rax,QWORD PTR [rbp-0x30]
  4017a1:       48 83 c0 01             add    rax,0x1
  4017a5:       48 89 45 d8             mov    QWORD PTR [rbp-0x28],rax

      if (q == resolved)
  4017a9:       48 8b 45 d0             mov    rax,QWORD PTR [rbp-0x30]
  4017ad:       48 3b 85 e0 fe ff ff    cmp    rax,QWORD PTR [rbp-0x120]
  4017b4:       75 0a                   jne    4017c0 <fb_realpath+0x13e>
        q = "/";
  4017b6:       48 c7 45 d0 c5 20 40    mov    QWORD PTR [rbp-0x30],0x4020c5
  4017bd:       00
  4017be:       eb 33                   jmp    4017f3 <fb_realpath+0x171>
      else {
        do {
          --q;
  4017c0:       48 83 6d d0 01          sub    QWORD PTR [rbp-0x30],0x1
        } while (q > resolved && *q == '/');
  4017c5:       48 8b 45 d0             mov    rax,QWORD PTR [rbp-0x30]
  4017c9:       48 3b 85 e0 fe ff ff    cmp    rax,QWORD PTR [rbp-0x120]
  4017d0:       76 0b                   jbe    4017dd <fb_realpath+0x15b>
  4017d2:       48 8b 45 d0             mov    rax,QWORD PTR [rbp-0x30]
  4017d6:       0f b6 00                movzx  eax,BYTE PTR [rax]
  4017d9:       3c 2f                   cmp    al,0x2f
  4017db:       74 e3                   je     4017c0 <fb_realpath+0x13e>

Now, I have a question about q = "/"; instruction. q is defined as a char* and as seen from this examples, it contains a value returned by strrchr fucntion. Then it is assigned to a string - q = "/"; further in the code. Now, the instruction which represents that in assembly is - mov QWORD PTR [rbp-0x30],0x4020c5. I have very hard time understanding this instruction. Now, my understanding is that, it supposed to move the string "/" to the location pointed by q. But how does it know the location pointed by q? i.e. rbp-0x30 is a location on the stack where q is stored. And this location is supposed to contain the address of the object where q is pointing. But, I interpret mov QWORD PTR [rbp-0x30],0x4020c5 as move string 0x4020c5 to rbp-0x30 i.e. the address of q. That is where I am confused as that location is supposed to contain the address and not the string.

Thanks for reading and your help is appreciated.

4

mov QWORD PTR [rbp-0x30],0x4020c5 means exactly "move 0x4020c5 to a memory location rbp-0x30 and treat this number as qword" (8 - byte number).

But q is at the memory location rbp - 0x30, so anything you write into that address, will be written into q. So, the number 0x4020c5 was written into q. The number 0x4020c5 is not a string itself - it's a memory address of a string (just a pointer). So q points to a string at 0x4020c5, hence q[0] == '/' and q[1] == NULL.

And that's the behaviour that we expect from instruction q = "/" - it doesn't change the memory the q points at, but changes the q itself.

1
  • Nitpick: q[1] == 0 and coincidentally q[1] == NULL, but 0 and NULL should not be confused.
    – enedil
    Sep 1 '20 at 21:21
1

you can add some print address of variable debug aid in your source to get a grip of these addresses

see the disassembly of line no 5 in the paste below

#include <stdio.h>

int main (void) {
    char * q;
    q = "/";
    printf("%p\n",&q);
}

disassembly

slashaddr!main:
    3 01141000 55              push    ebp
    3 01141001 8bec            mov     ebp,esp
    3 01141003 51              push    ecx
    5 01141004 c745fc90011801  mov     dword ptr [ebp-4], (01180190)
1
  • thanks so much @blabb
    – R4444
    Sep 2 '20 at 0:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.