Re: differences in hex dump and disassembly

From: Erik de Castro Lopo (nospam_at_mega-nerd.com)
Date: 07/28/04 

Date: Wed, 28 Jul 2004 17:35:16 +1000

Vinay wrote:
>
> Hello
>

<snip>

> I dont find any problem doing these. When I see the hex dump (x
> command in gdb) of the function, I can see that the first instruction
> of the function has been changed. But when I do "disassemble" of the
> function in gdb, I find that the disassembly is same as the original
> function!!, but the hex dump shows the new change. Why this difference
> ?

It could be that the disassember is disassembling what is on
disk instead of what is in memory.

Erik 

-- 
+-----------------------------------------------------------+
  Erik de Castro Lopo  nospam@mega-nerd.com (Yes it's valid)
+-----------------------------------------------------------+
"Microsoft treats security vulnerabilities as public relations
problems."  -- Bruce Schneier