ansaurus

Question

Copying and calling Functions in x86 AT&T-Assembler in gcc

Answer 1

+3 A:

You have the following problems:

when setting up the stack for your call to copy_bytes, you want pushl $to_gen_inner not pushl to_gen_inner (the latter pushes the contents of memory to_gen_inner points to)
when copying values to the local stackframe inside copy_bytes, you need to write the register you just read the parameter into, instead of always writing EAX
lcall *(%eax) expects to read an address from the memory pointed to by EAX, and jump there. Moreover, it expects to read 48 bytes, with the first 16 being the segment. I've replaced your lcall with call *%eax; also replaced the lrets with rets accordingly.
the call to printregs is assembled as a relative call, which blows up since the instruction you're executing is no longer at the same relative offset to the target as it was when it was assembled. I've replaced it with
```
movl $printregs, %ecx
call *%ecx
```

(which trashes %ecx)

finally, to_gen_inner sets up the stackframe on entry, but fails to destroy it on exit

With all those fixed, the code looks like this:

.global main
.section .data

to_gen_inner: #x f, implicit n
        pushl %ebp
        movl %esp, %ebp
        movl $0xFF00FF00, %eax
        movl $printregs, %ecx
        call *%ecx
        movl %ebp, %esp
        popl %ebp        
        ret

.set to_gen_inner_len, . - to_gen_inner

.section .text

main:
        pushl %ebp
        movl %esp, %ebp

        #allocate memory
        pushl $to_gen_inner_len
        call malloc
        popl %ecx

        pushl $to_gen_inner_len
        pushl $to_gen_inner
        pushl %eax
        call copy_bytes
        popl %eax
        popl %ecx
        popl %ecx

        call *%eax

        movl %ebp, %esp
        popl %ebp
        ret

printfregs:
        .ascii "eax: %8X\nebx: %8X\necx: %8X\nedx: %8X\n\0"

printregs:
        pushl %edx
        pushl %ecx
        pushl %ebx
        pushl %eax
        pushl $printfregs
        call printf
        popl %ecx
        popl %eax
        popl %ebx
        popl %ecx
        popl %edx
        ret

copy_bytes: #dest source length
        pushl %ebp
        movl %esp, %ebp

        subl $24, %esp

        movl 8(%ebp), %ecx # dest
        movl %ecx, -4(%ebp)

        movl 12(%ebp), %ebx # source
        movl %ebx, -8(%ebp)

        movl 16(%ebp), %eax # length
        movl %eax, -12(%ebp)

        addl %eax, %ecx # last dest-byte
        movl %ecx, -16(%ebp)

        addl %eax, %edx # last source-byte
        movl %ecx, -20(%ebp)

        movl -4(%ebp), %eax
        movl -8(%ebp), %ebx
        movl -16(%ebp), %ecx

        copy_bytes_2:
        movb (%ebx), %dl
        movb %dl, (%eax)
        incl %eax
        incl %ebx
        cmp %eax, %ecx
        jne copy_bytes_2

        movl %ebp, %esp
        popl %ebp
        ret

...which builds and runs here for me. Hope that helps.

moonshadow 2009-03-12 21:39:17

Hm. Strange. Your code also works with just call *%eax (what I did first). Seems like this wasnt the main reason why my code failed. Anyway. Thank you very much.

schoppenhauer 2009-03-12 23:40:31

Ah - looks like it's call *%eax vs call *(%eax) - the former branches to the address at %eax, the latter calls the address contained in the memory pointed to by %eax. Will edit answer.

moonshadow 2009-03-13 00:07:56

ansaurus

tags:

views:

answers:

Copying and calling Functions in x86 AT&T-Assembler in gcc

related questions