0

Here is my objdump -d snippet with the malloc call and surrounding code. This binary is stripped.

dbgLab.bin:     file format elf32-i386


080483d0 <malloc@plt>:
 80483d0:   ff 25 04 a0 04 08       jmp    *0x804a004
 80483d6:   68 08 00 00 00          push   $0x8
 80483db:   e9 d0 ff ff ff          jmp    80483b0 <printf@plt-0x10>


Disassembly of section .text:


 804853e:   55                      push   %ebp
 804853f:   89 e5                   mov    %esp,%ebp
 8048541:   83 e4 f0                and    $0xfffffff0,%esp
 8048544:   83 ec 20                sub    $0x20,%esp
 8048547:   c6 44 24 1f cf          movb   $0xcf,0x1f(%esp)
 804854c:   c7 04 24 0d 00 00 00    movl   $0xd,(%esp)
 8048553:   e8 78 fe ff ff          call   80483d0 <malloc@plt>
 8048558:   89 44 24 18             mov    %eax,0x18(%esp)
 804855c:   83 7d 08 02             cmpl   $0x2,0x8(%ebp)
 8048560:   7f 0c                   jg     804856e <strncmp@plt+0x12e>
 8048562:   c7 04 24 ff ff ff ff    movl   $0xffffffff,(%esp)
 8048569:   e8 92 fe ff ff          call   8048400 <exit@plt>
 804856e:   8b 45 0c                mov    0xc(%ebp),%eax
 8048571:   83 c0 04                add    $0x4,%eax
 8048574:   8b 00                   mov    (%eax),%eax
 8048576:   c7 44 24 08 0d 00 00    movl   $0xd,0x8(%esp)

closed as off-topic by Jason Geffner, DCoder, 0xea, ixje, jvoisin Apr 30 '14 at 0:40

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking for help reverse-engineering a specific system are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Jason Geffner, DCoder, 0xea, ixje, jvoisin
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    Sorry, but I think you should first start learning the very-very-very basics before making questions that are vague and unclear. – joxeankoret Apr 28 '14 at 16:01
5

A call to malloc returns the address of the allocated memory in the eax register on x86, rax on x86_64, and r0 on ARM. Nothing is pushed on the stack. Check the line following the call to malloc & you'll understand ! You should check the calling conventions of your platform too.

Suppose you have this in your code :

      int *p = malloc(sizeof(int) * 4);

If you translate this line into assembly you'll get what follows :

      call   80483d0 <malloc@plt>
      mov    %eax,0x18(%esp)

The malloc call returns in eax the address of allocated memory block. In the C code, this address is assigned to p which is a local variable located on the stack. And that's what the following assembly does : mov %eax,0x18(%esp).

  • so the line after the malloc says this mov %eax,0x18(%esp). Where is the location 0x18(%esp) what address in memory is this? I can use gdb to find out what esp is at that point in the program by setting a break point. – will Apr 28 '14 at 15:44
  • You're gonna have to debug your program by setting a breakpoint at 804855c and printing the register values. What you want is the value in eax, that's what the malloc function returned. 0x18(%esp) is the address of the pointer variable used in the program. – yaspr Apr 28 '14 at 15:50
  • So the value in eax that malloc returns is not stored in memory anywhere or moved to a memory location? – will Apr 28 '14 at 15:59
  • The malloc return value is the address where the allocated memory is. The mov %eax, 0x18(%esp) stores the value in eax (the malloc return value) in 0x18(esp) which is the location of the pointer variable (which is on the stack) used to store the return value of malloc in the program. – yaspr Apr 28 '14 at 16:02
  • thank you very much for your help. I was wondering if you would be willing to assist me with a homework assignment for my digital forensics class but I do not want to post all my questions publicly is there another way I can contact you without flooding stackexchange 24/7? I do not want you to give me the answers I just want to be able to ask questions and have you guide me with hints/tips. – will Apr 28 '14 at 19:32
4

Normally, return values are stored in eax. Structures and Floats/Doubles may be exceptions, depending on the ABI & the compiler used, but for malloc, eax is the return value. So nowhere on the stack.

In your specific case:

 8048553:   e8 78 fe ff ff          call   80483d0 <malloc@plt>
 8048558:   89 44 24 18             mov    %eax,0x18(%esp)

The eax register is stored on the stack, in some local variable that is 24 (hex 18) bytes "above" the stack pointer. There is no way to determine the name of that local variable name from the objdump.

Please, next time, try to ask your question in a way that is better to understand - for example "My function that calls malloc stores the result somewhere, what does that instruction do ?" and post only the relevant code.

  • thank you very much I will edit the question so it is a better reflection of what I want. – will Apr 28 '14 at 15:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.