#advanced
[Step-9] Step to next instruction ~ mov dword [local_8h], 5
In this step, we're doing two things - (a) ds - command to step to next instruction (b) px @rbp-0x8 - command to view contents of variable (local_8h)
Remember rip, the instruction pointer?
Instruction pointer register (rip) points to the next instruction to execute. In previous screenshot (click), the rip is at instruction mov dword [local_ch], 4
This means when we use command "ds", instruction mov dword [local_ch], 4 should be executed
However, we have already executed command "ds" once in Step-8 (here)
... (continued)
Queries & suggestions @Revnexbot
[Step-9] Step to next instruction ~ mov dword [local_8h], 5
In this step, we're doing two things - (a) ds - command to step to next instruction (b) px @rbp-0x8 - command to view contents of variable (local_8h)
Remember rip, the instruction pointer?
Instruction pointer register (rip) points to the next instruction to execute. In previous screenshot (click), the rip is at instruction mov dword [local_ch], 4
This means when we use command "ds", instruction mov dword [local_ch], 4 should be executed
However, we have already executed command "ds" once in Step-8 (here)
... (continued)
Queries & suggestions @Revnexbot
#advanced
[Step-9] ds and px @rbp-0x8 explained
... continued from here
Hence our command "ds" in Step-9 (see screenshot) actually excutes instruction next to mov dword [local_ch], 4 which is mov dword [local_8h], 5 as seen from screenshot (box-3)
When mov dword [local_8h], 5 gets executed using "ds", the constant "5" is stored in variable "local_8h"
Let's examine the variable local_8h now using px @rbp-0x8 ~ screenshot (box-2)
Note: We're using @rbp-0x8 with "px" (alias for print hexadecimal) because rbp-0x8 is actual memory location of variable local_8h
We can confirm value of "local_8h" is indeed "5" see screenshot (box-3)
Queries & suggestions @Revnexbot
[Step-9] ds and px @rbp-0x8 explained
... continued from here
Hence our command "ds" in Step-9 (see screenshot) actually excutes instruction next to mov dword [local_ch], 4 which is mov dword [local_8h], 5 as seen from screenshot (box-3)
When mov dword [local_8h], 5 gets executed using "ds", the constant "5" is stored in variable "local_8h"
Let's examine the variable local_8h now using px @rbp-0x8 ~ screenshot (box-2)
Note: We're using @rbp-0x8 with "px" (alias for print hexadecimal) because rbp-0x8 is actual memory location of variable local_8h
We can confirm value of "local_8h" is indeed "5" see screenshot (box-3)
Queries & suggestions @Revnexbot
#advanced
[Step-10] pdf once again
Let's print the disassembly function using command "pdf"
Box-2 shows where our instruction pointer (rip) currently is i.e. just after mov dword [local_8h], 5 (box-3) - the instruction that we've executed in last step using "ds"
What if we run "ds" again?
Let's see
Queries & suggestions @Revnexbot
[Step-10] pdf once again
Let's print the disassembly function using command "pdf"
Box-2 shows where our instruction pointer (rip) currently is i.e. just after mov dword [local_8h], 5 (box-3) - the instruction that we've executed in last step using "ds"
What if we run "ds" again?
Let's see
Queries & suggestions @Revnexbot
#advanced
[Step-11] dr[?]
Command "dr" is used to print 'gpr' (general purpose) registers
We can also print value of a specific register using dr <register>
In above screenshot, we run "ds" (box-1) again and it executes next instruction mov edx, dword [local_ch] (box-3)
What does "mov edx, dword [local_ch]" do?
Value of variable local_ch is moved to edx register
We know from here (click) local_ch is "4" and hence after "ds" is executed edx becomes "4" as well
After running next command "dr", we can see ¹rdx is indeed "4" (0x00000004) ~ see above screenshot
¹Note: edx is the low 32 bit of the rdx register, which is a 64 bit register
Queries & suggestions @Revnexbot
[Step-11] dr[?]
Command "dr" is used to print 'gpr' (general purpose) registers
We can also print value of a specific register using dr <register>
In above screenshot, we run "ds" (box-1) again and it executes next instruction mov edx, dword [local_ch] (box-3)
What does "mov edx, dword [local_ch]" do?
Value of variable local_ch is moved to edx register
We know from here (click) local_ch is "4" and hence after "ds" is executed edx becomes "4" as well
After running next command "dr", we can see ¹rdx is indeed "4" (0x00000004) ~ see above screenshot
¹Note: edx is the low 32 bit of the rdx register, which is a 64 bit register
Queries & suggestions @Revnexbot
1X Tabnine pro
https://my.tabnine.com/login
John Doe
01071190096@student.uph.edu
Password: Qwerty-1234
Send screenshots @Revnexbot
https://my.tabnine.com/login
John Doe
01071190096@student.uph.edu
Password: Qwerty-1234
Send screenshots @Revnexbot
#advanced
[Step-12] step read repeat
1. Step to next instruction
Let's step to next instruction "mov eax, dword [local_8h]" with "ds" ("local_8h" i.e. "5" is moved to eax)
2. Read general purpose registers
Print gpr using "dr" and confirm value of rax is indeed "5" 0x00000005
3. Repeat steps 1 and 2
Running "ds" once again should now execute "add eax, edx" ~ adds rax "5" and rdx "4" stores the sum in rax
Using "dr", we can see rax is "9" 0x00000009 as expected
4. End
Before executing next instruction "mov dword [local_4h], eax", print the variable "local_4h" using "px @rbp-0x4"
We get "00"
Next instruction is "mov dword [local_4h], eax"
Execute it using "ds" and run "px @rbp-0x4" again, we get "09" expected as value of rax was 0x00000009
Queries & suggestions @Revnexbot
[Step-12] step read repeat
1. Step to next instruction
Let's step to next instruction "mov eax, dword [local_8h]" with "ds" ("local_8h" i.e. "5" is moved to eax)
2. Read general purpose registers
Print gpr using "dr" and confirm value of rax is indeed "5" 0x00000005
3. Repeat steps 1 and 2
Running "ds" once again should now execute "add eax, edx" ~ adds rax "5" and rdx "4" stores the sum in rax
Using "dr", we can see rax is "9" 0x00000009 as expected
4. End
Before executing next instruction "mov dword [local_4h], eax", print the variable "local_4h" using "px @rbp-0x4"
We get "00"
Next instruction is "mov dword [local_4h], eax"
Execute it using "ds" and run "px @rbp-0x4" again, we get "09" expected as value of rax was 0x00000009
Queries & suggestions @Revnexbot
#advanced
[Step-13] "end" ?
Recall that the binary is actually a program that adds up two variables "a" and "b" and stores the result in another variable "c" where "a" and "b" are constants "4" and "5" respectively
Explanation
To get an insight of actual program structure, we reversed "run" using radare
Source code breakdown
Integer a "local_ch" is declared
"var int local_ch @ rbp-0xc"
Similarly, variables b "local_8h" and c "local_4h" are declared
Variable a is assigned constant 4 "mov dword [local_ch], 4" and b is assigned constant "5"
To add them together, we utilised the unused registers "eax" and "edx"
Variables a and b are added as edx and eax respectively "add eax, edx", and result is assigned to variable c "local_4h" afterwards "mov dword [local_4h], eax"
Queries & suggestions @Revnexbot
[Step-13] "end" ?
Recall that the binary is actually a program that adds up two variables "a" and "b" and stores the result in another variable "c" where "a" and "b" are constants "4" and "5" respectively
Explanation
To get an insight of actual program structure, we reversed "run" using radare
Source code breakdown
Integer a "local_ch" is declared
"var int local_ch @ rbp-0xc"
Similarly, variables b "local_8h" and c "local_4h" are declared
Variable a is assigned constant 4 "mov dword [local_ch], 4" and b is assigned constant "5"
To add them together, we utilised the unused registers "eax" and "edx"
Variables a and b are added as edx and eax respectively "add eax, edx", and result is assigned to variable c "local_4h" afterwards "mov dword [local_4h], eax"
Queries & suggestions @Revnexbot