You are charged with maintaining a large C program, and you come across the foll

Question

You are charged with maintaining a large C program, and you come across the following code: typedef struct { int first; a_struct a[CNT]; int last; } b_struct; void test(long i, b_struct *bp) { int n = bp first + bp last; a_struct *ap = &bp a[i] ; ap x[ap idx] = n; } The declarations of the compile-time constant CMT and the structure a_struct are in a file for which you do not have the necessary access privilege. Fortunately, you have a copy of the, o version of code, which you are able to disassemble with the objdump program, yielding the following disassembly; Void test (long i, b_struct *bp) i in %rdi, bp in %rsi 0000000000000000 : 0: 8b 8e 20 01 00 00 mov 0x120(%rsi), %ecx 6: 03 0e add (%rsi), %ecz 8: 48 8d 04 bf lea (%rdi, %rdi, 4), %rax c: 48 8d 04 c6 lea (%rsi, %rax, 8), %rax 10: 48 8b 50 08 mov 0x8(%rax), %rdx 14: 48 63 c9 movslq %ecx, %rcx 17: 48 89 4c d0 10 mov %rcx, 0x10(%rax, %rdx, 8) ac: c3 retq Using your reverse engineering skills, deduce the following: The value of CNT. A complete declaration of structure a_struct. Assume that the only fields in this structure are idx and x, and that both of these contain signed values.

Explanation / Answer

Value of CNT: For finding the value of CNT we have the knowledge of b_struct.As we know the variables in left and right are integers and take 4 byte each.So,array a[] is of unknown size.The structure is as follows .In above structure,bp is address of left and left is a 4 byte integer.

bp+4 is at point a[0]

Since address of each element of a[] will be bp+4+zi..where z=Size of each element and i=number of element in array.

In asembly code ,bp+4+20...so z=20.

and 0xb8(%ecx)translated into bp=184.Determine this is in right location.

Therefore,184 - 4=Total size of a[] i.e 180 byte.

CNT=Total size ofa[]/size of each element = 180/z=180/20=9

Defining a_struct: As we know that a_struct only contains two elements i.e idx & x.

if a[i]=bp+4+20; then x[idx]=(bp+4+20i)+4(bp+4+20i)+4

since the address of x[i]=1(bp+4+20i)+4+4(idx)

therefore a[i] is as follows:

20bytes - 4(idx) = 16/4 bytes = 4 elements

Therefor array x[] has 4 elements in each array.

a-struct formula as follows:

typedef struct

{

int idx;

intx[4];

}a_struct;

Related Questions

Navigate

• Browse (All)
• Browse Y
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.