linux - Find the absolute size of an array/buffer on the stack -
I hope the title is not too much missile (I am quite new in the assembly) I play around with gdb debugger And some assembly code that goes as follows:
  0x00000000004005d7 & lt; + 0>: push% RBP 0x00000000004005d8 & lt; + 1>: mov% rp,% rbp 0x000000004005db & lt; + 4>: $ 0xffffffffff80,% rsp 0x00000000004005df & lt; + 8>: mov% rdi, -0x78 (% rbp) 0x00000000004005e3 & lt; + 12>: mov -0x78 (% RBP),% rdx 0x00000000004005e7 & lt; + 16>: Lea AX, [APB-101] 0x00000000004005eb : mov% rdx,% rsi 0x00000000004005ee & lt; + 23>: mov% rax,% rdi 0x00000000004005f1 & lt; +6>: callq 0x400480 & lt; Strcpy @ plt & gt; 0x000000004005f6 & lt; + 31>: leaveq 0x00000000004005f7 & lt; + 32>: retq    The thing I want to store is to find out the buffer size "[EPB-120]". The thing I have tryed was to set up a breakpoint: 0x00000000004005e7 and if the code runs, then I did the same and said that value to 0x120 decrease the price of EPB to inspect ... but that is the result Is that the full size of the buffer? Or is there a better way to find the size of that indicator? Thank you in advance
First of all, the size of an indicator is always the same.
 I'm assuming that you want to know how big a buffer is on the stack  strcpy () . 
. Buffer Can you tell that he is as follows
  0x00000000004005d7 & Lt; + 0>: push% RBP 0x00000000004005d8 & lt; + 1>: mov% rp,% rbp 0x00000000004005db & lt; 4>: StackPointer has been reduced by introduction 128 (0xffffffffffffff80 = -128) after the function $ 0 Xffffffffffff80,% rsp   adding. . That's why we have space for 128 bits of local variables
  0x00000000004005e7 & lt; + 16>: Li eax, [EPB-120] 0x00000000004005eb & LT; + 20>: mov% RDX,% RSI 0x00000000004005ee & LT; + 23>: mov% rax,% RDI 0x00000000004005f1 & lt; + 26>: callq 0x400480 & lt; Strcpy @ plt & gt;    Now, the address of % ebp-120  before  strcpy ()  will be loaded in % eax  > Which is carried on % rdi , which is used to call  strcpy () . 
 % ebp-120  tells us that the buffer starts at 120 bytes below % ebp . So if there is no other variable between % ebp  and  ebp-120 , we can assume that buffer size is 120 bytes. 
Please comment it is not clear and I will try to improve clarification.
Comments
Post a Comment