hacking-the-art-of-exploitation

There are also operations that are used to control the flow of execution.
The cmp operation is used to compare values, and basically any operation
beginning with j is used to jump to a different part of the code (depending
on the result of the comparison). The example below first compares a 4-byte
value located at EBP minus 4 with the number 9. The next instruction is shorthand
for jump if less than or equal to, referring to the result of the previous
comparison. If that value is less than or equal to 9, execution jumps to the
instruction at 0x8048393. Otherwise, execution flows to the next instruction
with an unconditional jump. If the value isn’t less than or equal to 9, execution
will jump to 0x80483a6.
804838b: 83 7d fc 09 cmp DWORD PTR [ebp-4],0x9
804838f: 7e 02 jle 8048393
8048391: eb 13 jmp 80483a6
These examples have been from our previous disassembly, and we have
our debugger configured to use Intel syntax, so let’s use the debugger to step
through the first program at the assembly instruction level.
The -g flag can be used by the GCC compiler to include extra debugging
information, which will give GDB access to the source code.
reader@hacking:~/booksrc $ gcc -g firstprog.c
reader@hacking:~/booksrc $ ls -l a.out
-rwxr-xr-x 1 matrix users 11977 Jul 4 17:29 a.out
reader@hacking:~/booksrc $ gdb -q ./a.out
Using host libthread_db library "/lib/libthread_db.so.1".
(gdb) list
1 #include
2
3 int main()
4 {
5 int i;
6 for(i=0; i < 10; i++)
7 {
8 printf("Hello, world!\n");
9 }
10 }
(gdb) disassemble main
Dump of assembler code for function main():
0x08048384 : push ebp
0x08048385 : mov ebp,esp
0x08048387 : sub esp,0x8
0x0804838a : and esp,0xfffffff0
0x0804838d : mov eax,0x0
0x08048392 : sub esp,eax
0x08048394 : mov DWORD PTR [ebp-4],0x0
0x0804839b : cmp DWORD PTR [ebp-4],0x9
0x0804839f : jle 0x80483a3
0x080483a1 : jmp 0x80483b6
26 0x200