Programming 25which are commonly used to point to the source and destination when data
needs to be read from or written to. There are load and store instructions
that use these registers, but for the most part, these registers can be thought
of as just simple general-purpose registers.
The EIP register is the Instruction Pointer register, which points to the
current instruction the processor is reading. Like a child pointing his finger
at each word as he reads, the processor reads each instruction using the EIP
register as its finger. Naturally, this register is quite important and will be used
a lot while debugging. Currently, it points to a memory address at 0x804838a.
The remaining EFLAGS register actually consists of several bit flags that
are used for comparisons and memory segmentations. The actual memory is
split into several different segments, which will be discussed later, and these
registers keep track of that. For the most part, these registers can be ignored
since they rarely need to be accessed directly.
0x253 Assembly Language.......................................................................
Since we are using Intel syntax assembly language for this book, our tools
must be configured to use this syntax. Inside GDB, the disassembly syntax
can be set to Intel by simply typing set disassembly intel or set dis intel,
for short. You can configure this setting to run every time GDB starts up by
putting the command in the file .gdbinit in your home directory.
reader@hacking:~/booksrc $ gdb -q
(gdb) set dis intel
(gdb) quit
reader@hacking:~/booksrc $ echo "set dis intel" > ~/.gdbinit
reader@hacking:~/booksrc $ cat ~/.gdbinit
set dis intel
reader@hacking:~/booksrc $
Now that GDB is configured to use Intel syntax, let’s begin understanding
it. The assembly instructions in Intel syntax generally follow this style:
operation
The destination and source values will either be a register, a memory
address, or a value. The operations are usually intuitive mnemonics: The mov
operation will move a value from the source to the destination, sub will
subtract, inc will increment, and so forth. For example, the instructions
below will move the value from ESP to EBP and then subtract 8 from ESP
(storing the result in ESP).
8048375: 89 e5 mov ebp,esp
8048377: 83 ec 08 sub esp,0x8