2024年11月28日

gdb

use -g flag for gcc to compile with debug

  1. layout next

  2. nexti (assembly next)

  3. next (code next)

  4. refresh

x86

Practical Reverse Engineering

  1. EAX: Accumulator for operands and results data.

  2. EBX: Pointer to data in the DS segment.

  3. ECX: Counter for string and loop operations.

  4. EDX: I/O pointer.

  5. ESI: Pointer to data in the segment pointed to by the DS register; source pointer for string operations.

  6. EDI: Pointer to data (or destination) in the segment pointed to by the ES register; destination pointer for string operations.

  7. ESP: Stack pointer (in the SS segment).

  8. EBP: Pointer to data on the stack (in the SS segment).