Hello, my name is Stephen.
And in this lecture we are going to the main function.
PDB.
So we will start a gdb with hello to our analysis.
But firstly, if you didn't watch the previous lecture here we have this.
Hello here.
So we created this in previous section here.
So if we run this.
So we wrote that assembler language and so basically it prints out the Hello world message.
And we also have this.
Source code here.
Sam's here, so we will open the project here.
Hello.
So this is our.
The.
This is our source code.
Uh, and then we will compile that to Hello here and now we will disassemble the main.
So we will start the gdb here and after that we will pass the hello file.
So you need to be in the same directory as your output file.
So now um, here, as you learned before this, the Hello World program first initializes initializes
some data in this section, the data and section.bs here so and then proceeds the to the main label
and this is where the action starts here.
So let's begin our examination there.
And at the gdb prompt you will type the disassemble.
Tumble.
Main and here gdb returns your source code more or less.
So the return source code isn't exactly the same as your source code were originally right and right.
So it's actually has some move, move move apps here.
So as you can see it's not um the same.
And uh, gdb returns your source code more or less.
But uh, let's actually question that.
Strange isn't it?
Right.
What happened there?
And there is some analysis needed here.
So uh, the long numbers on the left, um, starting with 0X000 and so on, are these are the memory
addresses.
So, um, this long numbers on the left are the memory addresses.
Uh, so they are the places where the machine instructions of our program are stored, as you can see
here from the addresses.
Um, and, um.
Well, Plaza's here.
Zero plus five, ten, 20, 25, 27, 32, 37 in the second line here.
Uh, this is the first instruction.
Move.
Move X0X1 needs five bytes of memory.
So.
But wait a minute.
So in our source code, we wrote mov rax one.
So what's the deal with the x here?
Right.
So, well, if you look at the register table on our Linux here, so you will see that a x is the low
of 32 bit part of the rax register.
So the assembler is smart enough to figure out that the 64 register is far too much to heart, too much
waste of resources for storing the number one, so it uses the 32 bit register.
So the same is true for the use of edX here and addicts add add and add x here.
Add add x.
So here in this table we have our we have the RDA and the x, but here our compiler change it to add
and add x so it uses here.
And this is the same apply.
So our compiler didn't want to waste so much memory for this decimal numbers it needed to.
And the 64 bit assembler is an extension of the 32 bit assembler and you will see that whenever possible
the assembler will use 32 bit instructions.
So the 0X1 is the hexadecimal representation of the decimal number one.
Right?
So you learn that in the previous lecture and 0XD.
A0X or 0XC is zero.
X is the decimal representation of 13 and zero x.
C is a decimal representation of 12.
And but 0X3C is a decimal representation of 60.
So the Nop instruction here by the Nop instruction means that no operation and is inserted there by
the assembler.
Memory management reason.
But you might be.
We might be missing something here.
Right?
So what happened to our message?
Right.
So we don't have any message here, as you can see here.
Now.
This instruction here.
Move.
Move!
ABS.
RSI.
Um, here, as you can see.
Here.
Move.
RSI.
Message got replaced by move.
Actually, let's make it always on top.
So this RSI message here got replaced by Move.
ABS Move Apps RSI.
And here we have this hexadecimal number zero x 44 to 10.
So don't worry about move apps for now.
So is it there because of the 64 bit addressing and it used to put an immediate value in a register
and this zero x 44 to 10 is the memory address where message is stored on our computer.
And this can be different address in your case.
So it's actually changing and.
At the GDP.
Let's actually type this following here.
X/S0X.
So you will use this slash where you are using this for the URLs on your browser, not the reverse slash
here.
So zero x 4040 ten.
Um, here.
Or actually, instead, you will write this.
You say this will be different on your system.
This value will be different on your system.
So you will you write, uh, this, uh.
Your value here and not 44%.
So in this case, I will write 44% because it resides on our message resides on that.
And here we access here and we will press enter and that's it.
So here we have a hello world message on our on this memory.
And the X here stands for examine and here's stands for string.
And the gdb answered that on our zero x 44 to 10 decimal hexadecimal number is the start of the string
message and tries to show the whole string up until the string terminating zero here that we plotted
here.
So now you know, one of the reasons why we put a terminating zero after the Hello world and you can
also type the.
No, they are, actually.
You can also type this here.
Uh, instead of s, you can type C, and here we got this H here.
So, uh, with the C here with the C here, you ask for a character.
Right.
So here, GDP returns the first character of our message, preceded by the decimal Ascii code of the
of that character.
In this case, it's 104 and do a Google search here or a table of Ascii codes to verify and keep that
table handy for future use.
So there's no need to memorize, memorize it or open an additional terminal window, um, here and type
man Ascii here and here.
We will see all the Ascii tables here.
And it wrote something like it's actually 100, 104 here, so 104.
So it's actually.
H here need to be.
H.
A, B, C, D, as you can see here, characters.
And we also have.
In the left side we have octal, decimal hex and character here.
So we will press enter.
We see the age.
And as you can see here, in 104 of the decimal here, we are seeing our age.
We can.
This man is always useful for the Linux users here.
And.
Well, let's actually look at the other examples as well.
So we will write here F before C we will write 13 C here and that's it.
Here we have this h a l l o r comma space world here so you can use this, uh, following, uh, 13
characters, uh, to write all the.
The characters that reside on that memory address.
And as you can see, it starts from 40, 40, ten and ends at 40 4018 here.
So.
No, that's it.
And we can also do this here instead of characters.
We can do the D here.
Um, and as you can see here, instead of seeing characters, we are seeing the decimal representation
of that characters in Ascii table.
And we can also use this.
You can also use X with this.
Here we are seeing the 13 characters starting memory address in a hexadecimal representation.
And we can also do this here, X and ampersand here and message.
And as you can see, we are seeing full Hello world.
And now let's return to disassemble the listing in next lecture.
So I'm waiting you in.
Next lecture.