differences in hex dump and disassembly

From: Vinay (vinaynkaranth_at_yahoo.com)
Date: 07/28/04


Date: 28 Jul 2004 00:17:26 -0700

Hello

I intend to do some fooling around with with code segment during run
time. During run time, I want to modify the origial code for a
function by inserting a jump instruction to another location. I follow
the following steps.

1. Call mprotect and change the protection to PROT_WRITE, of the page
where the function is present.
2. Write the jump instruction at the function address.
3. Revert back the protection to read and execute.

I dont find any problem doing these. When I see the hex dump (x
command in gdb) of the function, I can see that the first instruction
of the function has been changed. But when I do "disassemble" of the
function in gdb, I find that the disassembly is same as the original
function!!, but the hex dump shows the new change. Why this difference
? Here is the hex dump of the function which i changed. 'E9' is the
jump instruction opcode followed by the offset.

0x806032c <TestPatch>: 0xe9 0xcf 0xdc 0x02 0x00 0x14
 0x68 0x51
0x8060334 <TestPatch+8>: 0x61 0x08

Dump of assembler code for function TestPatch
0x0806032c <TestPatch+0>: push %ebp
0x0806032d <TestPatch+1>: mov %esp,%ebp
0x0806032f <TestPatch+3>: sub $0x14,%esp
0x08060332 <TestPatch+6>: push $0x8086151

Please let me know if I am going wrong some where.

Thanx and regards
Vinay