internet time @ ???
tenpo ni li "???"

rnd's website |

trying to do assembly-level debugging in gdb

GDB seems to have been clearly made with source-level debugging in mind, the kind where the source code of the program is available. Sometimes this is not the case, or you just don’t want to bother looking for the source code. Here I’ll put a bunch of useful commands.

x64 Linux C/C++ conventions

This is a set of additional notes written during the process of disassembling a library.

For function calls, the arguments are stored in the following order:

When a function is called, it will typically perform the following operations:

push rbp
mov  rbp, rsp
sub  rsp, (amount of space used for local variables)
add  rsp, (same amount)
leave ; or mov rsp,rbp and pop rbp

This means that any reference to memory at [rbp-0x…] is using the function’s local variables.

If a function returns a value, it will be stored in the EAX register.

If it is a C++ function, its name will be “mangled”: its argument types will be included in the name. The utility c++filt can convert these mangled names to their standard forms. If the function is part of an object, it will require the first parameter to be the object’s address.

Seems like the same is true for constructors and destructors: their first parameter is an address that will point to the object in question.