ansaurus

Question

Answer 1

+1 A:

What you show here is a hex view of your .EXE file.

There's another thing, much different, that is the program loaded on memory.

When you are talking about IP (instruction pointer, although I think you actually mean EIP), you are talking about the memory address of the next instruction to be executed.

Running an executable file will make your operating system to read the file, find the sections (code sections, data sections, etc) and map them to the memory, creating a process. All the memory pointers refer to these locations, and not to locations in your executable file.

This is where the difference comes from.

NOTE: for the record, what you are presenting is not the disassemble of your executable. It is simply a hex dump (that is, you view your file as a sequence of hex values). A disassemble would show you actual machine instructions (MOVs, CMPs, JMPs, etc).

Bruno Reis 2010-02-01 15:27:37

Yes it's true.But how program knows which piece of file he should load to memory ?

oneat 2010-02-01 15:30:08

This is another different question. Compilers generate different executable formats, for example usually PE for windows, COFF or ELF for Linuxes. The operating system is what will parse this format and know where to find all the different parts of the program inside the .exe file.

Bruno Reis 2010-02-01 15:32:52

IIRC DJGPP is coff.

Marco van de Voort 2010-02-01 16:07:17

Tell me what does it executes first!Which cell of memory.

oneat 2010-02-01 18:40:30

Answer 2

A:

IIRC dos exe does not load at an absolute address. It allocates the next available free segments, and relocates the start segments (and loads of segments) by applying fixups. (the existance of which can be seen in the URL you provide).

The offsets within segments are not relocated, but since segments start every 16 byte that doesn't cost that much slack memory.

This is logical, since loading a few extra TSRs in dos, can make the address of the first memory the binary can be loaded higher.

Have a look at a linkers and loaders free ebook that explains binary formats in a coherent way:

http://www.iecc.com/linker/

==== added ===

Oops, saw djgpp a bit late. IIRC DJGPP is COFF. If it is djgpp generated, you should probably look through the DJGPP provided utils to see if it has something to examine binary files (a -dump program or so)

Marco van de Voort 2010-02-01 15:40:44

ansaurus

tags:

views:

answers:

EXE format - how to Interpret CS:IP

related questions