We will now execute a single instruction by entering:
si
|-Register group: general------------------------------------------------------------------------------------------------------------------------------------------------|
|eax 0x4 4 ecx 0x0 0 edx 0x0 0 |
|ebx 0x0 0 esp 0xffffd950 0xffffd950 ebp 0x0 0x0 |
|esi 0x0 0 edi 0x0 0 eip 0x8049005 0x8049005 <_start+5> |
|eflags 0x202 [ IF ] cs 0x23 35 ss 0x2b 43 |
|ds 0x2b 43 es 0x2b 43 fs 0x0 0 |
|gs 0x0 0 k0 0x0 0 k1 0x0 0 |
|k2 0x0 0 k3 0x0 0 k4 0x0 0 |
|k5 0x0 0 k6 0x0 0 k7 0x0 0 |
|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|B+ 0x8049000 <_start> mov eax,0x4 |
| > 0x8049005 <_start+5> mov ebx,0x1 |
| 0x804900a <_start+10> lea ecx,ds:0x804a000 |
| 0x8049010 <_start+16> mov edx,0xd |
| 0x8049015 <_start+21> int 0x80 |
| 0x8049017 <print_hex_message> mov eax,0x4 |
| 0x804901c <print_hex_message+5> mov ebx,0x1 |
| 0x8049021 <print_hex_message+10> lea ecx,ds:0x804a00d |
| 0x8049027 <print_hex_message+16> mov edx,0xd |
| 0x804902c <print_hex_message+21> int 0x80 |
| 0x804902e <exit_program> mov eax,0x1 |
| 0x8049033 <exit_program+5> mov ebx,0x0 |
| 0x8049038 <exit_program+10> int 0x80 |
| 0x804903a add BYTE PTR [eax],al |
| 0x804903c add BYTE PTR [eax],al |
| 0x804903e add BYTE PTR [eax],al |
| 0x8049040 add BYTE PTR [eax],al |
| 0x8049042 add BYTE PTR [eax],al |
| 0x8049044 add BYTE PTR [eax],al |
| 0x8049046 add BYTE PTR [eax],al |
|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
native process 84922 In: _start L?? PC: 0x8049005
(gdb) lay reg
(gdb) break _start
Breakpoint 1 at 0x8049000
(gdb) run
Starting program: /home/pete/Documents/ASM/hello_world/x86/hello_x86
Breakpoint 1, 0x08049000 in _start ()
(gdb) si
0x08049005 in _start ()
(gdb)
The first instruction was executed, and looking at the registers, we can see that now eax holds the value 0x4,
and eip holds the address of the next instruction at 0x08049005. This is also highlighted in our assembly frame
and pointed to with the > symbol.
The >_start+5< tag indicates that this memory location is offset 5 bytes from the beginning of our _start label, which means our first instruction was 5 bytes long. Or gdb command window indicates we are at memory address 0x08049005 in the _start label.
The >_start+5< tag indicates that this memory location is offset 5 bytes from the beginning of our _start label, which means our first instruction was 5 bytes long. Or gdb command window indicates we are at memory address 0x08049005 in the _start label.