ooo AT&T; 69% 10:16 K Wk7 Tuesday Exercises CS271 Week Tuesday la class Evercise
ID: 3797388 • Letter: O
Question
ooo AT&T; 69% 10:16 K Wk7 Tuesday Exercises CS271 Week Tuesday la class Evercises Name lere's complete nonsense program with totally take addresses shown in the leftmost column. The idea is to trace the execution showing every change in the indicated registers and memory after each is executed. You only need to fill in the cells where a value changes fram its previous valae. The first two instructions have been traced for you. All numeric values should be shown as 2- or 3 digit hes. 2. If we don't use pushad popad in a procedure, we use some form of the following code with ebp asthe stack frame pointer. Since ebpis set equal don't we just use espas the stack frame pointer? 1/2 push ebp ebp,esp.Explanation / Answer
To understand how the values in red color came, let's start understand each and every row, starting form the frist row.
The first row defines the data section (indicated by .data). Each data section has a base address. All the variables declared in the data section will use an offset from this base address to identify their location, instead of using actual complete address.
.data
A4
A8
AB
x
y
z
DWORD
DWORD
DWORD
15
11
?
0F
0B
?
Suppose that the the start address of the data section is 0xA0. In the above row, the variable x is at an offset of 0xA4 (= 16410) from the address 0xA0(=16010). Therefore, the actual address of x will be [0xA0+0xA4 = 0x144 = (324)10 ].
In the above row
1. first column defines offset,
2. second column has variable name,
3. fourth column shows the value (in decimal) assigned to that variable,
4. fifth column shows the value in hexadecimal.
So finally,
x = 15 = 0F, and is at an offset of 0xA4 from base address of data section
y = 11 = 0B, and an offset of 0xA8 from base address of data section
z's value is not given, and is at an offset of 0xAB
Now coming to the code section,
EIP = holds the adress of the next instruction to be executed
EBP = holds the address of the base of the stack (bottom of the stack)
ESP = holds the address of the top of the stack
[ESP] = content of the top of the stack. Note that [X] means the content of the memory location X
In order to avoid complexity, i will not go into the details of EDI, EAX, EBX. Let us just assume that these are some registers that can be used to store some values. EAX and EBX are general purpose registers. EDI is destination index register. [EDI] indicates the contents at memory location pointed by EDI.
Note that the first column in the .code section holds the address of the instruction. And keep in mind that all the values are in hexadecimal.
Initial values :
EIP=10 EBP=2F ESP=F0 [ESP]=0 EDI=0 [EDI]=0 EAX=0 EBX = 0
EIP register tells that the next instruction to be executed is at address 10. So, we fetch the instruction at 0x10, push x, which says to push the value of x on the top of the stack. We have defined the variable x in the data section to be 0F. So we have to push the value 0F on the top of the stack. The top of the stack pointer is available at ESP.
In memory, the stack grows in opposite direction, from top to bottom. So, instead of incrementing the pointer, we decrement it and store the new value. We decrement the top of the stack by 8 [F0 - 8 = EC] and store the value 0F at the location pointed by stack pointer.
Therefore, ESP (top of the stack pointer) now points to location = 0xEC and it's content are [ESP]= 0F. It means that the value 0F is stored at the location 0xEC, which is nothing but address of the top of the stack.
So, the new values are
EIP=15 EBP=2F ESP=EC [ESP]=0F EDI=0 [EDI]=0 EAX=0 EBX = 0
EIP register points to instruction at address 15. So, we fetch the instruction at 0x15, push y, and the push the content of y, which is 0B, on the top of the stack. Decrement the stack pointer address and store the new value 0x0B.
ESP => 0xEC - 0x08 => 0xE8
[ESP] = [0xE8] = 0x0B
Therefore, now, the top of the stack is 0xE8 and the content of the top of the stack is 0x0B
New contents are
EIP=1A EBP=2F ESP=E8 [ESP]=0B EDI=0 [EDI]=0 EAX=0 EBX = 0
Instruction to be executed is at 1A, push OFFSET z, which says to push the offset value of variable z on to the top of the stack. The offset of variable z as defined in the data section is 0xAB. So we have to push this value on the top of the stack. Decrement the stack pointer address,
ESP => 0xE8 - 0x08 => 0xE4
[ESP] = [0xE4] = 0xAB
Therefore, now, the top of the stack is 0xE4 and the content of the top of the stack is 0xAB.
New contents are
EIP=1F EBP=2F ESP=E4 [ESP]=AB EDI=0 [EDI]=0 EAX=0 EBX = 0
The next instruction is at 1F, call whatzit. This instruction stores the address of the immediate next instruction in the sequence, onto the top of the stack and then updates the instruction pointer, EIP, with the address of whatzit function, so that it will be called next. The reason for storing immediate next instruction on the top of the stack is that after completion of whatzit function, immediate next instruction in the sequence will be executed.
storing address of the next instruction, 0x30, on the stack top
ESP => 0xE4 - 0x08 => 0xE0
[ESP] = [0xE0] = 0x30
Updating the stack pointer, EIB, with the address of whatzit function, 0x40
EID = 0x40
New contents are
EIP=40 EBP=2F ESP=E0 [ESP]=30 EDI=0 [EDI]=0 EAX=0 EBX = 0
EIP says to execute instruction at 0x40, push ebp, which says to push the content of EBP register, which is 2F, to the top of the stack. Therefore,
ESP = 0xE0-0x08 = 0xDC
[ESP] = [0xDC] = 2F
New contents are
EIP=45 EBP=2F ESP=DC [ESP]=2F EDI=0 [EDI]=0 EAX=0 EBX = 0
EIP says to execute instruction at 0x45, push ebp esp, which says to push the content of ESP register, which is 0xDC, to the EBP register. Therefore,
EBP <== ESP (=0xDC)
New contents are
EIP=4A EBP=DC ESP=DC [ESP]=2F EDI=0 [EDI]=0 EAX=0 EBX = 0
EIP says to execute instruction at 0x4A, push edi [esp+8], which says to push the content of memory location ESP+0x08 = 0xDC + 0x08 = 0xE4, to the EDI register. If you note carefully at the 4th instruction we executed (at address 1A), the location 0xE4 points to an element of the stack, and it's content are 0xAB.
EDI <== [0xE4] = 0xAB
EDI = 0xAB
New contents are
EIP=4A EBP=DC ESP=DC [ESP]=2F EDI=AB [EDI]=0 EAX=0 EBX = 0
You can continue, in this way, to get the rest of the outputs
OFFSET VARIABLE Value (in decimal) Value in hexadecimalA4
A8
AB
x
y
z
DWORD
DWORD
DWORD
15
11
?
0F
0B
?
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.