assembly jmp to a line that doesn't exist
0
For the line that says "jmpq *0x400850", there is actually no such line has 0x400850. In this case, since I cannot jump to the place that it is mentioned, do I just skip this command and go to the command that is in the line below?
So the answers told me to type "objdump" in terminal, so I typed
objdump -d ./bin-lab-ref > output.txt
and I got no output in the terminal.
What should I do in this situation?
assembly x86 reverse-engineering att jmp
edited Nov 14 '18 at 19:28
Peter Cordes
127k18189326
asked Nov 14 '18 at 14:27
Juniper SohnJuniper Sohn
12
|
show 3 more comments
0
For the line that says "jmpq *0x400850", there is actually no such line has 0x400850. In this case, since I cannot jump to the place that it is mentioned, do I just skip this command and go to the command that is in the line below?
So the answers told me to type "objdump" in terminal, so I typed
objdump -d ./bin-lab-ref > output.txt
and I got no output in the terminal.
What should I do in this situation?
assembly x86 reverse-engineering att jmp
edited Nov 14 '18 at 19:28
Peter Cordes
127k18189326
asked Nov 14 '18 at 14:27
Juniper SohnJuniper Sohn
12
6
*means indirect jump, that is through a pointer in memory.0x400850is the address of that pointer not the target of the jump. PS: please don't use images for code, copy-paste it as text instead.
– Jester
Nov 14 '18 at 14:32
It's an unconditionaljmp; it never falls through. In machine code, thejmpdoesn't "search" for the target line or address, it just jumps there.
– Peter Cordes
Nov 14 '18 at 14:47
Note that assembly is made of instructions, not commands. Try to use the correct terminology, this makes it easier for others to help you.
– fuz
Nov 14 '18 at 15:06
Use Intel syntax and you might be able to read something ;)
– Trass3r
Nov 14 '18 at 15:12
For the next time: please do not post pictures of code. Always post code as text instead of as pictures!
– fuz
Nov 14 '18 at 15:33
|
show 3 more comments
0
0
0
For the line that says "jmpq *0x400850", there is actually no such line has 0x400850. In this case, since I cannot jump to the place that it is mentioned, do I just skip this command and go to the command that is in the line below?
So the answers told me to type "objdump" in terminal, so I typed
objdump -d ./bin-lab-ref > output.txt
and I got no output in the terminal.
What should I do in this situation?
assembly x86 reverse-engineering att jmp
edited Nov 14 '18 at 19:28
Peter Cordes
127k18189326
asked Nov 14 '18 at 14:27
Juniper SohnJuniper Sohn
12
For the line that says "jmpq *0x400850", there is actually no such line has 0x400850. In this case, since I cannot jump to the place that it is mentioned, do I just skip this command and go to the command that is in the line below?
So the answers told me to type "objdump" in terminal, so I typed
objdump -d ./bin-lab-ref > output.txt
and I got no output in the terminal.
What should I do in this situation?
assembly x86 reverse-engineering att jmp
assembly x86 reverse-engineering att jmp
edited Nov 14 '18 at 19:28
Peter Cordes
127k18189326
asked Nov 14 '18 at 14:27
Juniper SohnJuniper Sohn
12
edited Nov 14 '18 at 19:28
Peter Cordes
127k18189326
asked Nov 14 '18 at 14:27
Juniper SohnJuniper Sohn
12
edited Nov 14 '18 at 19:28
Peter Cordes
127k18189326
edited Nov 14 '18 at 19:28
Peter Cordes
127k18189326
edited Nov 14 '18 at 19:28
Peter Cordes
127k18189326
127k18189326
asked Nov 14 '18 at 14:27
Juniper SohnJuniper Sohn
12
asked Nov 14 '18 at 14:27
Juniper SohnJuniper Sohn
12
asked Nov 14 '18 at 14:27
Juniper SohnJuniper Sohn
12
12
6
*means indirect jump, that is through a pointer in memory.0x400850is the address of that pointer not the target of the jump. PS: please don't use images for code, copy-paste it as text instead.
– Jester
Nov 14 '18 at 14:32
It's an unconditionaljmp; it never falls through. In machine code, thejmpdoesn't "search" for the target line or address, it just jumps there.
– Peter Cordes
Nov 14 '18 at 14:47
Note that assembly is made of instructions, not commands. Try to use the correct terminology, this makes it easier for others to help you.
– fuz
Nov 14 '18 at 15:06
Use Intel syntax and you might be able to read something ;)
– Trass3r
Nov 14 '18 at 15:12
For the next time: please do not post pictures of code. Always post code as text instead of as pictures!
– fuz
Nov 14 '18 at 15:33
|
show 3 more comments
6
*means indirect jump, that is through a pointer in memory.0x400850is the address of that pointer not the target of the jump. PS: please don't use images for code, copy-paste it as text instead.
– Jester
Nov 14 '18 at 14:32
It's an unconditionaljmp; it never falls through. In machine code, thejmpdoesn't "search" for the target line or address, it just jumps there.
– Peter Cordes
Nov 14 '18 at 14:47
Note that assembly is made of instructions, not commands. Try to use the correct terminology, this makes it easier for others to help you.
– fuz
Nov 14 '18 at 15:06
Use Intel syntax and you might be able to read something ;)
– Trass3r
Nov 14 '18 at 15:12
For the next time: please do not post pictures of code. Always post code as text instead of as pictures!
– fuz
Nov 14 '18 at 15:33
6
6
* means indirect jump, that is through a pointer in memory. 0x400850 is the address of that pointer not the target of the jump. PS: please don't use images for code, copy-paste it as text instead.– Jester
Nov 14 '18 at 14:32
* means indirect jump, that is through a pointer in memory. 0x400850 is the address of that pointer not the target of the jump. PS: please don't use images for code, copy-paste it as text instead.– Jester
Nov 14 '18 at 14:32
It's an unconditional
jmp; it never falls through. In machine code, the jmp doesn't "search" for the target line or address, it just jumps there.– Peter Cordes
Nov 14 '18 at 14:47
It's an unconditional
jmp; it never falls through. In machine code, the jmp doesn't "search" for the target line or address, it just jumps there.– Peter Cordes
Nov 14 '18 at 14:47
Note that assembly is made of instructions, not commands. Try to use the correct terminology, this makes it easier for others to help you.
– fuz
Nov 14 '18 at 15:06
Note that assembly is made of instructions, not commands. Try to use the correct terminology, this makes it easier for others to help you.
– fuz
Nov 14 '18 at 15:06
Use Intel syntax and you might be able to read something ;)
– Trass3r
Nov 14 '18 at 15:12
Use Intel syntax and you might be able to read something ;)
– Trass3r
Nov 14 '18 at 15:12
For the next time: please do not post pictures of code. Always post code as text instead of as pictures!
– fuz
Nov 14 '18 at 15:33
For the next time: please do not post pictures of code. Always post code as text instead of as pictures!
– fuz
Nov 14 '18 at 15:33
|
show 3 more comments
1 Answer
1
active
oldest
votes
2
The instruction jmpq *0x400850(,%rax,8) jumps to the value stored at address 0x400850(,%rax,8), not to the address 0x400850(,%rax,8) itself. Likely, there is a jump table at this address and rax selects an entry from the jump table to jump to.
Inspect the memory around 0x400850 to find out what entries the jump table has and thus where the jump goes. You can get a dump of the executable's image using objdump -s.
answered Nov 14 '18 at 15:08
fuzfuz
58.5k14127257
2
@JuniperSohn The memory address400850is likely not part of the.textsection but rather of the.rodatasection. Since this section does not contain code (but rather data), it is not disassembled if you pass-d. Inspect the output ofobjdump -sto see the content of all sections.
– fuz
Nov 14 '18 at 15:23
1
@JuniperSohn: it's data, not code, soobjdump -dwon't show it. Butobjdump -sor-Dwill hexdump all sections. Or look at it in GDB while debugging a running process started from the executable. The address looks about right for.section .rodata, and it's in the same page as the instructions you're showing, so it definitely exists.
– Peter Cordes
Nov 14 '18 at 15:24
1
@JuniperSohn If you have trouble interpreting the output ofobjdump -s, feel free to post it and I can tell you what it means. Make sure to post it as text, not as an image. Never post images of text.
– fuz
Nov 14 '18 at 15:27
1
@Jester someone™ should make a canonical question/solution to all bomb labs just to get rid of these questions. They do get a bit annoying by the time.
– fuz
Nov 14 '18 at 15:28
2
I am guessing it's the 64 bit version of this
– Jester
Nov 14 '18 at 15:31
|
show 7 more comments
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53302503%2fassembly-jmp-to-a-line-that-doesnt-exist%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
2
The instruction jmpq *0x400850(,%rax,8) jumps to the value stored at address 0x400850(,%rax,8), not to the address 0x400850(,%rax,8) itself. Likely, there is a jump table at this address and rax selects an entry from the jump table to jump to.
Inspect the memory around 0x400850 to find out what entries the jump table has and thus where the jump goes. You can get a dump of the executable's image using objdump -s.
answered Nov 14 '18 at 15:08
fuzfuz
58.5k14127257
2
@JuniperSohn The memory address400850is likely not part of the.textsection but rather of the.rodatasection. Since this section does not contain code (but rather data), it is not disassembled if you pass-d. Inspect the output ofobjdump -sto see the content of all sections.
– fuz
Nov 14 '18 at 15:23
1
@JuniperSohn: it's data, not code, soobjdump -dwon't show it. Butobjdump -sor-Dwill hexdump all sections. Or look at it in GDB while debugging a running process started from the executable. The address looks about right for.section .rodata, and it's in the same page as the instructions you're showing, so it definitely exists.
– Peter Cordes
Nov 14 '18 at 15:24
1
@JuniperSohn If you have trouble interpreting the output ofobjdump -s, feel free to post it and I can tell you what it means. Make sure to post it as text, not as an image. Never post images of text.
– fuz
Nov 14 '18 at 15:27
1
@Jester someone™ should make a canonical question/solution to all bomb labs just to get rid of these questions. They do get a bit annoying by the time.
– fuz
Nov 14 '18 at 15:28
2
I am guessing it's the 64 bit version of this
– Jester
Nov 14 '18 at 15:31
|
show 7 more comments
2
The instruction jmpq *0x400850(,%rax,8) jumps to the value stored at address 0x400850(,%rax,8), not to the address 0x400850(,%rax,8) itself. Likely, there is a jump table at this address and rax selects an entry from the jump table to jump to.
Inspect the memory around 0x400850 to find out what entries the jump table has and thus where the jump goes. You can get a dump of the executable's image using objdump -s.
answered Nov 14 '18 at 15:08
fuzfuz
58.5k14127257
2
@JuniperSohn The memory address400850is likely not part of the.textsection but rather of the.rodatasection. Since this section does not contain code (but rather data), it is not disassembled if you pass-d. Inspect the output ofobjdump -sto see the content of all sections.
– fuz
Nov 14 '18 at 15:23
1
@JuniperSohn: it's data, not code, soobjdump -dwon't show it. Butobjdump -sor-Dwill hexdump all sections. Or look at it in GDB while debugging a running process started from the executable. The address looks about right for.section .rodata, and it's in the same page as the instructions you're showing, so it definitely exists.
– Peter Cordes
Nov 14 '18 at 15:24
1
@JuniperSohn If you have trouble interpreting the output ofobjdump -s, feel free to post it and I can tell you what it means. Make sure to post it as text, not as an image. Never post images of text.
– fuz
Nov 14 '18 at 15:27
1
@Jester someone™ should make a canonical question/solution to all bomb labs just to get rid of these questions. They do get a bit annoying by the time.
– fuz
Nov 14 '18 at 15:28
2
I am guessing it's the 64 bit version of this
– Jester
Nov 14 '18 at 15:31
|
show 7 more comments
2
2
2
The instruction jmpq *0x400850(,%rax,8) jumps to the value stored at address 0x400850(,%rax,8), not to the address 0x400850(,%rax,8) itself. Likely, there is a jump table at this address and rax selects an entry from the jump table to jump to.
Inspect the memory around 0x400850 to find out what entries the jump table has and thus where the jump goes. You can get a dump of the executable's image using objdump -s.
answered Nov 14 '18 at 15:08
fuzfuz
58.5k14127257
The instruction jmpq *0x400850(,%rax,8) jumps to the value stored at address 0x400850(,%rax,8), not to the address 0x400850(,%rax,8) itself. Likely, there is a jump table at this address and rax selects an entry from the jump table to jump to.
Inspect the memory around 0x400850 to find out what entries the jump table has and thus where the jump goes. You can get a dump of the executable's image using objdump -s.
answered Nov 14 '18 at 15:08
fuzfuz
58.5k14127257
edited Nov 14 '18 at 15:14
answered Nov 14 '18 at 15:08
fuzfuz
58.5k14127257
answered Nov 14 '18 at 15:08
fuzfuz
58.5k14127257
answered Nov 14 '18 at 15:08
fuzfuz
58.5k14127257
58.5k14127257
2
@JuniperSohn The memory address400850is likely not part of the.textsection but rather of the.rodatasection. Since this section does not contain code (but rather data), it is not disassembled if you pass-d. Inspect the output ofobjdump -sto see the content of all sections.
– fuz
Nov 14 '18 at 15:23
1
@JuniperSohn: it's data, not code, soobjdump -dwon't show it. Butobjdump -sor-Dwill hexdump all sections. Or look at it in GDB while debugging a running process started from the executable. The address looks about right for.section .rodata, and it's in the same page as the instructions you're showing, so it definitely exists.
– Peter Cordes
Nov 14 '18 at 15:24
1
@JuniperSohn If you have trouble interpreting the output ofobjdump -s, feel free to post it and I can tell you what it means. Make sure to post it as text, not as an image. Never post images of text.
– fuz
Nov 14 '18 at 15:27
1
@Jester someone™ should make a canonical question/solution to all bomb labs just to get rid of these questions. They do get a bit annoying by the time.
– fuz
Nov 14 '18 at 15:28
2
I am guessing it's the 64 bit version of this
– Jester
Nov 14 '18 at 15:31
|
show 7 more comments
2
@JuniperSohn The memory address400850is likely not part of the.textsection but rather of the.rodatasection. Since this section does not contain code (but rather data), it is not disassembled if you pass-d. Inspect the output ofobjdump -sto see the content of all sections.
– fuz
Nov 14 '18 at 15:23
1
@JuniperSohn: it's data, not code, soobjdump -dwon't show it. Butobjdump -sor-Dwill hexdump all sections. Or look at it in GDB while debugging a running process started from the executable. The address looks about right for.section .rodata, and it's in the same page as the instructions you're showing, so it definitely exists.
– Peter Cordes
Nov 14 '18 at 15:24
1
@JuniperSohn If you have trouble interpreting the output ofobjdump -s, feel free to post it and I can tell you what it means. Make sure to post it as text, not as an image. Never post images of text.
– fuz
Nov 14 '18 at 15:27
1
@Jester someone™ should make a canonical question/solution to all bomb labs just to get rid of these questions. They do get a bit annoying by the time.
– fuz
Nov 14 '18 at 15:28
2
I am guessing it's the 64 bit version of this
– Jester
Nov 14 '18 at 15:31
2
2
@JuniperSohn The memory address
400850 is likely not part of the .text section but rather of the .rodata section. Since this section does not contain code (but rather data), it is not disassembled if you pass -d. Inspect the output of objdump -s to see the content of all sections.– fuz
Nov 14 '18 at 15:23
@JuniperSohn The memory address
400850 is likely not part of the .text section but rather of the .rodata section. Since this section does not contain code (but rather data), it is not disassembled if you pass -d. Inspect the output of objdump -s to see the content of all sections.– fuz
Nov 14 '18 at 15:23
1
1
@JuniperSohn: it's data, not code, so
objdump -d won't show it. But objdump -s or -D will hexdump all sections. Or look at it in GDB while debugging a running process started from the executable. The address looks about right for .section .rodata, and it's in the same page as the instructions you're showing, so it definitely exists.– Peter Cordes
Nov 14 '18 at 15:24
@JuniperSohn: it's data, not code, so
objdump -d won't show it. But objdump -s or -D will hexdump all sections. Or look at it in GDB while debugging a running process started from the executable. The address looks about right for .section .rodata, and it's in the same page as the instructions you're showing, so it definitely exists.– Peter Cordes
Nov 14 '18 at 15:24
1
1
@JuniperSohn If you have trouble interpreting the output of
objdump -s, feel free to post it and I can tell you what it means. Make sure to post it as text, not as an image. Never post images of text.– fuz
Nov 14 '18 at 15:27
@JuniperSohn If you have trouble interpreting the output of
objdump -s, feel free to post it and I can tell you what it means. Make sure to post it as text, not as an image. Never post images of text.– fuz
Nov 14 '18 at 15:27
1
1
@Jester someone™ should make a canonical question/solution to all bomb labs just to get rid of these questions. They do get a bit annoying by the time.
– fuz
Nov 14 '18 at 15:28
@Jester someone™ should make a canonical question/solution to all bomb labs just to get rid of these questions. They do get a bit annoying by the time.
– fuz
Nov 14 '18 at 15:28
2
2
I am guessing it's the 64 bit version of this
– Jester
Nov 14 '18 at 15:31
I am guessing it's the 64 bit version of this
– Jester
Nov 14 '18 at 15:31
|
show 7 more comments
draft saved
draft discarded
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53302503%2fassembly-jmp-to-a-line-that-doesnt-exist%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
6
*means indirect jump, that is through a pointer in memory.0x400850is the address of that pointer not the target of the jump. PS: please don't use images for code, copy-paste it as text instead.– Jester
Nov 14 '18 at 14:32
It's an unconditional
jmp; it never falls through. In machine code, thejmpdoesn't "search" for the target line or address, it just jumps there.– Peter Cordes
Nov 14 '18 at 14:47
Note that assembly is made of instructions, not commands. Try to use the correct terminology, this makes it easier for others to help you.
– fuz
Nov 14 '18 at 15:06
Use Intel syntax and you might be able to read something ;)
– Trass3r
Nov 14 '18 at 15:12
For the next time: please do not post pictures of code. Always post code as text instead of as pictures!
– fuz
Nov 14 '18 at 15:33