differences in hex dump and disassembly
From: Vinay (vinaynkaranth_at_yahoo.com)
Date: 07/28/04
- Next message: Sting: "Skipping initrd phase in boot process"
- Previous message: Michael Kerrisk: "Re: collect process IO stats (linux newbie)"
- Next in thread: Erik de Castro Lopo: "Re: differences in hex dump and disassembly"
- Reply: Erik de Castro Lopo: "Re: differences in hex dump and disassembly"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: 28 Jul 2004 00:17:26 -0700
Hello
I intend to do some fooling around with with code segment during run
time. During run time, I want to modify the origial code for a
function by inserting a jump instruction to another location. I follow
the following steps.
1. Call mprotect and change the protection to PROT_WRITE, of the page
where the function is present.
2. Write the jump instruction at the function address.
3. Revert back the protection to read and execute.
I dont find any problem doing these. When I see the hex dump (x
command in gdb) of the function, I can see that the first instruction
of the function has been changed. But when I do "disassemble" of the
function in gdb, I find that the disassembly is same as the original
function!!, but the hex dump shows the new change. Why this difference
? Here is the hex dump of the function which i changed. 'E9' is the
jump instruction opcode followed by the offset.
0x806032c <TestPatch>: 0xe9 0xcf 0xdc 0x02 0x00 0x14
0x68 0x51
0x8060334 <TestPatch+8>: 0x61 0x08
Dump of assembler code for function TestPatch
0x0806032c <TestPatch+0>: push %ebp
0x0806032d <TestPatch+1>: mov %esp,%ebp
0x0806032f <TestPatch+3>: sub $0x14,%esp
0x08060332 <TestPatch+6>: push $0x8086151
Please let me know if I am going wrong some where.
Thanx and regards
Vinay
- Next message: Sting: "Skipping initrd phase in boot process"
- Previous message: Michael Kerrisk: "Re: collect process IO stats (linux newbie)"
- Next in thread: Erik de Castro Lopo: "Re: differences in hex dump and disassembly"
- Reply: Erik de Castro Lopo: "Re: differences in hex dump and disassembly"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]