#advanced

[Step-7] Printing contents of a variable

To view the contents of the variable (local_ch), we use the following instruction

px @memory-address

In this case, the corresponding memory address for local_ch will be rbp-0xc (from the first few lines of @pdf main)

This instruction prints the values of memory in hex

px @rbp-0xc

This shows that the variable currently doesn’t have anything stored in it - it’s just 0000 (row 1 - column 0).

Queries & suggestions @Revnexbot

#advanced

[Step-8] ds - step to next instruction

Let’s execute this instruction (i.e. mov dword [local_ch], 4) and go to the next one using the following command (which only goes to the next instruction)

ds

If we view the memory location after running this command, we get the above (screenshot) output

We can see that the first 2 bytes (row 1 - column 0) have the value 4.

Queries & suggestions @Revnexbot

100X KeepSolid VPN Unlimited + DNS Firewall + SmartDNS

- Emails verified

Send screenshots @Revnexbot

Thanks

Product Name:AceThinker Screen Grabber Pro(Yearly Subscription)
License Code:696B8-7A61Q-O12GD-8F2B5
Product Name:AceThinker Video Master
License Code:8B1E1-A8815-PA0GD-D3575
Product Name:AceThinker iPhone Screen Recorder
License Code:846E3-19F17-M02GD-1F6D4
Product Name:AceThinker PDF Writer(Yearly Subscription)
License Code:8D29B-3041P-PCFGD-238D9
Product Name:AceThinker Audio Recorder Online
License Code:59861-6941J-P72GD-A99C4
Product Name:AceThinker Screen Recorder Online
License Code:6DC53-45914-PDEGD-48F41
Product Name:AceThinker Video Converter Online(Yearly Subscription)
License Code:78CD9-5FC16-NA1GD-8E946
Product Name:AceThinker Music Recorder
License Code:9889C-D3D1I-O34GD-072D6
Product Name:AceThinker Video Keeper(Yearly Subscription)
License Code:86CE0-EB31F-M50GD-0D6F6
Product Name:AceThinker Screen Grabber Pro (Mac)
License Code:EA954-C881Q-P33GD-9CE28
Product Name:AceThinker Mac iPhone Screen Recorder
License Code:3E7B1-AF31N-N63GD-7858A
Product Name:AceThinker Disk Recovery(Yearly Subscription)
License Code:08C1A-F8C1F-QFFGD-F3E44
Product Name:AceThinker Rec
License Code:36904-CD21Q-M05GD-F9011
Product Name:AceThinker Video Editor(Yearly Subscription)
License Code:5B598-8EC1G-QC8GD-835B6
Product Name:AceThinker PDF Writer Mac
License Code:A4CCC-CFC1O-N1DGD-6A515
Product Name:AceThinker PDF Converter Pro(Yearly Subscription)
License Code:F0D7E-5BB1J-OC2GD-10C39
Product Name:AceThinker PDF Converter Pro Mac
License Code:2F7C1-9C91Q-P2BGD-B3542
Product Name:AceThinker iOS Recovery
License Code:96C1A-F6D1M-RA8GD-941A4
Product Name:AceThinker iOS Recovery
License Code:0B0EE-19817-R98GD-D2C45
Product Name:AceThinker Disk Recovery(Yearly Subscription)
License Code:E87E3-2161I-O2AGD-E0279
Product Name:AceThinker PDF Converter Lite
License Code:B8EB2-1561G-R82GD-6789D
Product Name:AceThinker PDF Writer
License Code:962CF-9271K-NF5GD-96CB8
Product Name:AceThinker Watermark Eraser(Yearly Subscription)
License Code:12279-5B51K-OC5GD-0468C
Product Name:AceThinker Mirror(Yearly Subscription)
License Code:9BA76-F9B15-R48GD-DBF4D
Product Name:AceThinker iOS Unlock(Yearly Subscription)
License Code:C2193-23F1P-QF1GD-66E2F
Product Name:AceThinker Video Editor Pro
License Code:5F97D-6531O-R0DGD-A43EB
Product Name:AceThinker Video Editor
License Code:1E4D7-1F014-M65GD-9C8F2

Send screenshots @Revnexbot

Apowersoft spoofer v1.3 (Update)

👉🏻 Link ~ @ApowersoftBot

~ Get license keys to all apowersoft products FREE

Send screenshots @Revnexbot

100X Avast Ultimate - 6 months

Send screenshots @Revnexbot

Thanks bro❤️

#advanced

[Step-9] Step to next instruction ~ mov dword [local_8h], 5

In this step, we're doing two things - (a) ds - command to step to next instruction (b) px @rbp-0x8 - command to view contents of variable (local_8h)

Remember rip, the instruction pointer?

Instruction pointer register (rip) points to the next instruction to execute. In previous screenshot (click), the rip is at instruction mov dword [local_ch], 4

This means when we use command "ds", instruction mov dword [local_ch], 4 should be executed

However, we have already executed command "ds" once in Step-8 (here)

... (continued)

Queries & suggestions @Revnexbot

#advanced

[Step-9] ds and px @rbp-0x8 explained

... continued from here

Hence our command "ds" in Step-9 (see screenshot) actually excutes instruction next to mov dword [local_ch], 4 which is mov dword [local_8h], 5 as seen from screenshot (box-3)

When mov dword [local_8h], 5 gets executed using "ds", the constant "5" is stored in variable "local_8h"

Let's examine the variable local_8h now using px @rbp-0x8 ~ screenshot (box-2)

Note: We're using @rbp-0x8 with "px" (alias for print hexadecimal) because rbp-0x8 is actual memory location of variable local_8h

We can confirm value of "local_8h" is indeed "5" see screenshot (box-3)

Queries & suggestions @Revnexbot

1520X Corel © Painter Essentials 7

Website: here

Send screenshots @Revnexbot

#advanced

[Step-10] pdf once again

Let's print the disassembly function using command "pdf"

Box-2 shows where our instruction pointer (rip) currently is i.e. just after mov dword [local_8h], 5 (box-3) - the instruction that we've executed in last step using "ds"

What if we run "ds" again?

Let's see

Queries & suggestions @Revnexbot

#advanced

[Step-11] dr[?]

Command "dr" is used to print 'gpr' (general purpose) registers

We can also print value of a specific register using dr <register>

In above screenshot, we run "ds" (box-1) again and it executes next instruction mov edx, dword [local_ch] (box-3)

What does "mov edx, dword [local_ch]" do?

Value of variable local_ch is moved to edx register

We know from here (click) local_ch is "4" and hence after "ds" is executed edx becomes "4" as well

After running next command "dr", we can see ¹rdx is indeed "4" (0x00000004) ~ see above screenshot

¹Note: edx is the low 32 bit of the rdx register, which is a 64 bit register

Queries & suggestions @Revnexbot

1X Tabnine pro

https://my.tabnine.com/login

John Doe
01071190096@student.uph.edu
Password: Qwerty-1234

Send screenshots @Revnexbot