-3

I am workin on Overthewire narnia2(ctf game). Currently I am learning how to use the gdb and I have a simple question. 

    (gdb) x/200x $esp-0xac
0xffffd5a4: 0x08048534  0xffffd5c8  0xf7e5b7d0  0xffffd5c8
0xffffd5b4: 0xf7ffd920  0xf7e5b7d5  0x08048494  0x08048534
0xffffd5c4: 0xffffd5c8  0x6850c031  0x68732f2f  0x69622f68
0xffffd5d4: 0x50e3896e  0x89e18953  0xcd0bb0c2  0x41414180
0xffffd5e4: 0x41414141  0x41414141  0x41414141  0x41414141
0xffffd5f4: 0x41414141  0x41414141  0x41414141  0x41414141
0xffffd604: 0x41414141  0x41414141  0x41414141  0x41414141
0xffffd614: 0x41414141  0x41414141  0x41414141  0x41414141
0xffffd624: 0x41414141  0x41414141  0x41414141  0x41414141
0xffffd634: 0x41414141  0x41414141  0x41414141  0x41414141
0xffffd644: 0x41414141  0x62626262  0xf7e2a200  0x00000002
0xffffd654: 0xffffd6e4  0xffffd6f0  0x00000000  0x00000000
0xffffd664: 0x00000000  0xf7fc5000  0xf7ffdc0c  0xf7ffd000
0xffffd674: 0x00000000  0x00000002  0xf7fc5000  0x00000000
0xffffd684: 0x59e07c0a  0x6308501a  0x00000000  0x00000000



    (gdb) x/200x $esp

0xffffd7a0: 0x000036b2  0x0000000e  0x000036b2  0x00000017
0xffffd7b0: 0x00000001  0x00000019  0xffffd7eb  0x0000001a
0xffffd7c0: 0x00000000  0x0000001f  0xffffdfe8  0x0000000f
0xffffd7d0: 0xffffd7fb  0x00000000  0x00000000  0x00000000
0xffffd7e0: 0x00000000  0x00000000  0x8b000000  0xb1cfbc04
0xffffd7f0: 0x91563e77  0xcb1ff506  0x6957e20c  0x00363836
0xffffd800: 0x00000000  0x00000000  0x00000000  0x72616e2f
0xffffd810: 0x2f61696e  0x6e72616e  0x00326169  0x41414141
0xffffd820: 0x41414141  0x41414141  0x41414141  0x41414141
0xffffd830: 0x41414141  0x41414141  0x41414141  0x41414141
0xffffd840: 0x41414141  0x41414141  0x41414141  0x41414141
0xffffd850: 0x41414141  0x41414141  0x41414141  0x41414141
0xffffd860: 0x41414141  0x41414141  0x41414141  0x41414141
0xffffd870: 0x41414141  0x41414141  0x41414141  0x41414141
0xffffd880: 0x41414141  0x31414141  0x2f6850c0  0x6868732f
0xffffd890: 0x6e69622f  0x5350e389  0xc289e189  0x80cd0bb0

what am I looking at when I do $esp-0xac? I've also seen other methods like $esp-0x14, but why not do plain $esp? what is the most used and why?

Cœur
  • 37,241
  • 25
  • 195
  • 267
Joel alexis
  • 41
  • 6

1 Answers1

1

what am i looking at when i do $esp-0xac?

The $esp register points to the boundary (in memory) between used and unused portion of the stack. On i*86 processors, stack grows to lower addresses, so anything above (at higher addresses) $esp contains used portion of the stack (local variables, return addresses, saved registers, etc.) and anything below (at lower addresses) contains currently unused portion of the stack.

The command x/200x $esp-0xac then examines contents of 43 32-bit words of currently used stack, and 157 words of unused portion of the stack.

ive also seen other methods like $esp-0x14, but why not do plain $esp?

The $esp-0x14 would let you look at the last 5 used words of the stack. Using $esp would let you look at the unused portion of the stack. You could do that, but it's somewhat pointless.

what is the most used and why?

Examining stack is useful when you want to where some specific value is stored (e.g. during exploit / stack buffer overflow analysis), or when you are debugging at the machine instruction level.

Employed Russian
  • 199,314
  • 34
  • 295
  • 362