GDB不能在$ EBP的地址访问内存

Question

整个代码为：

#include <stdio.h> 
#include <string.h> 
#include <unistd.h> 

char *secret = "1234"; 

void go_shell() 
{ 
    char *shell = "/bin/sh"; 
    char *cmd[] = { "/bin/sh", 0}; 
    printf("WOuld you like to play a game?\n"); 
    setreuid(0, 0); 
    execve(shell, cmd, 0); 
} 

int authorize() 
{ 
    char password[64]; 
    printf("Enter password: "); 
    gets(password); 
    if (!strcmp(password, secret)) 
     return 1; 
    else 
     return 0; 
} 

int main() 
{ 
    if (authorize()) { 
     printf("Login successfully\n"); 
     go_shell(); 
    } else { 
     printf("Incorrect password\n"); 
    } 

    return 0; 
} 

我想看到的$ EBP时授权（）只是调用。

编译时

gcc -Wall -ggdb <source_code> -o <exe> 

然后，我开始GDB

gdb <exe> 

(gdb) disass authorize 
Dump of assembler code for function authorize: 
    0x000000000040076d <+0>:  push %rbp 
    0x000000000040076e <+1>:  mov %rsp,%rbp 
    0x0000000000400771 <+4>:  sub $0x50,%rsp 
    0x0000000000400775 <+8>:  mov %fs:0x28,%rax 
    0x000000000040077e <+17>: mov %rax,-0x8(%rbp) 
    0x0000000000400782 <+21>: xor %eax,%eax 
    0x0000000000400784 <+23>: mov $0x4008d8,%edi 
    0x0000000000400789 <+28>: mov $0x0,%eax 
    0x000000000040078e <+33>: callq 0x400590 <[email protected]> 
    0x0000000000400793 <+38>: lea -0x50(%rbp),%rax 
    0x0000000000400797 <+42>: mov %rax,%rdi 
    0x000000000040079a <+45>: mov $0x0,%eax 
    0x000000000040079f <+50>: callq 0x4005d0 <ge[email protected]> 
    0x00000000004007a4 <+55>: mov 0x2008bd(%rip),%rdx  # 0x601068 <secret> 
    0x00000000004007ab <+62>: lea -0x50(%rbp),%rax 
    0x00000000004007af <+66>: mov %rdx,%rsi 
    0x00000000004007b2 <+69>: mov %rax,%rdi 
    0x00000000004007b5 <+72>: callq 0x4005c0 <[email protected]> 
    0x00000000004007ba <+77>: test %eax,%eax 
    0x00000000004007bc <+79>: jne 0x4007c5 <authorize+88> 
    0x00000000004007be <+81>: mov $0x1,%eax 
    0x00000000004007c3 <+86>: jmp 0x4007ca <authorize+93> 
    0x00000000004007c5 <+88>: mov $0x0,%eax 
    0x00000000004007ca <+93>: mov -0x8(%rbp),%rcx 
    0x00000000004007ce <+97>: xor %fs:0x28,%rcx 
    0x00000000004007d7 <+106>: je  0x4007de <authorize+113> 
    0x00000000004007d9 <+108>: callq 0x400580 <[email protected]> 
    0x00000000004007de <+113>: leaveq 
    0x00000000004007df <+114>: retq 
End of assembler dump. 
(gdb) br *authorize+33 
Breakpoint 1 at 0x40078e: file simple_login.c, line 19. 
(gdb) run 
Starting program: ./a.out 

Breakpoint 1, 0x000000000040078e in authorize() at simple_login.c:19 
19   printf("Enter password: "); 
(gdb) where 
#0 0x000000000040078e in authorize() at simple_login.c:19 
#1 0x00000000004007ee in main() at simple_login.c:29 
(gdb) x/2x $ebp 
0xffffffffffffe4a0:  Cannot access memory at address 0xffffffffffffe4a0 

---

在ubuntu64位，Linux版本的4.8.0-44泛型（buildd @ XXXX）（gcc版本5.4。 0 20160609（Ubuntu 5.4.0-6ubuntu1〜16.04.4））＃47〜16.04.1-Ubuntu SMP

在此先感谢。

Answer 1

Dump of assembler code for function authorize: 0x000000000040076d <+0>: push %rbp

这是一个64位的版本。您应该改用x/2x $rbp。