Use GDB to track the changes of function stacks

The Code is as follows:

# Include <stdio. h> <br/> void Hello () <br/> {<br/> int I = 0; <br/> printf ("I = % d, hello World/N ", I); <br/>}< br/> int main () <br/>{< br/> Hello (); <br/> return 0; <br/>}

 

GDB generates debugging information and goes in to see it.

Set breakpoint 1 at hello and breakpoint 2 at main.

Run to breakpoint 2 to view the register information:

Breakpoint 2, 0x080483f4 in main ()
Missing separate debuginfos, use: debuginfo-install glibc. i686
(GDB) info registers
Eax 0x1 1
ECX 0xbfae89d0-1079080496
EdX 0 x bfae89f0-1079080464
EBX 0x2513ff4 38879220
ESP 0xbfae89b4 0xbfae89b4
EBP 0xbfae89b8 0xbfae89b8
ESI 0x0 0
EDI 0x8048310 134513424
EIP 0x80483f4 0x80483f4 <main + 14>
Eflags 0x286 [pf SF if]
CS 0x73 115
SS 0x7b 123
DS 0x7b 123
Es 0x7b 123
FS 0x0 0
GS 0x33 51

Continue to run at breakpoint 1 to view the register information:

(GDB) N
Single stepping until exit from function main,
Which has no line number information.

Breakpoint 1, 0x080483ca in Hello ()

(GDB) info registers
Eax 0x1 1
ECX 0xbfae89d0-1079080496
EdX 0 x bfae89f0-1079080464
EBX 0x2513ff4 38879220
ESP 0xbfae8990 0xbfae8990
EBP 0xbfae89a8 0xbfae89a8
ESI 0x0 0
EDI 0x8048310 134513424
EIP 0x80483ca 0x80483ca <Hello + 6>
Eflags 0x286 [pf SF if]
CS 0x73 115
SS 0x7b 123
DS 0x7b 123
Es 0x7b 123
FS 0x0 0
GS 0x33 51

Based on the changes in the registers in the two stacks, check the ESP-changed EBP before the change and obtain the following results:

(GDB) P 0xbfae89b4-0xbfae89a8
$1 = 12

Let's take a look at the data in hello * (EBP) and * (EBP + 4:

(GDB) x 0xbfae89a8
0xbfae89a8: 0xbfae89b8
(GDB) x 0xbfae89a8 + 4
0xbfae89ac: 0x080483fc

The first printed result 0xbfae89b8 is the EBP register data in the memory of the main stack.

The result of the disassembly of the main function is as follows:

(GDB) disassemble main
Dump of worker er code for function main:
0x080483e6 <main + 0>: Lea 0x4 (% ESP), % ECx
0x080483ea <main + 4>: and $0xfffffff0, % ESP
0x080483ed <main + 7>: pushl-0x4 (% ECx)
0x080483f0 <main + 10>: Push % EBP
0x080483f1 <main + 11>: mov % ESP, % EBP
0x080483f3 <main + 13>: Push % ECx
0x080483f4 <main + 14>: Sub $0x4, % ESP
0x080483f7 <main + 17>: Call 0x80483c4 <Hello>
0x080483fc <main + 22>: mov $0x0, % eax

0x08048401 <main + 27>: add $0x4, % ESP
0x08048404 <main + 30>: Pop % ECx
0x08048405 <main + 31>: Pop % EBP
0x08048406 <main + 32>: lea-0x4 (% ECx), % ESP
0x08048409 <main + 35>: Ret
End of worker er dump.

 

We can see that the address of the next command calling call Hello is 0x080483fc, which is the above

(GDB) x 0xbfae89a8 + 4
0xbfae89ac: 0x080483fc

.

When a program calls a function, the call command is executed, and the next command address to be executed is pushed to the stack.