I've wrote a simple program to print something on the screen as below:
ebra@him:/tmp/tuts$ cat sample.c
#include <stdio.h>
int main()
{
puts("Sample!");
}
ebra@him:/tmp/tuts$ gcc sample.c -o sample
ebra@him:/tmp/tuts$
ebra@him:/tmp/tuts$ ./sample
Sample!
And then I disassmbled the executable to see what is going on under the hood:
ebra@him:/tmp/tuts$ objdump -M intel --disassemble-all sample | grep "<main>:" -A 10
0000000000001149 <main>:
1149: f3 0f 1e fa endbr64
114d: 55 push rbp
114e: 48 89 e5 mov rbp,rsp
1151: 48 8d 3d ac 0e 00 00 lea rdi,[rip+0xeac] # 2004 <_IO_stdin_used+0x4>
1158: e8 f3 fe ff ff call 1050 <puts@plt>
115d: b8 00 00 00 00 mov eax,0x0
1162: 5d pop rbp
1163: c3 ret
1164: 66 2e 0f 1f 84 00 00 nop WORD PTR cs:[rax+rax*1+0x0]
116b: 00 00 00
As you see above, right before calling puts
function, we have lea rdi,[rip+0xeac]
. I assume that [rip+0xeac]
is the address of the hardcoded text (i.e. "Sample!").
Since rip
is equal to 0x1151
while exucuting the mov
line, the value of [rip + 0xeac]
will be 0x1151 + 0xeac = 0x1ffd
.
But I can't find this address in the disassembled program:
ebra@him:/tmp/tuts$ objdump -M intel --disassemble-all sample | grep -i 1ffd
ebra@him:/tmp/tuts$ objdump -M intel --disassemble-all sample | grep -i "Sample!"
ebra@him:/tmp/tuts$
Why?