Why would %rbp not be equal to the value of %rsp, which is 0x28?

52 Views Asked by At

Consider:

    164b:       f3 0f 1e fa             endbr64
    164f:       55                      push   %rbp
    1650:       53                      push   %rbx
    1651:       48 83 ec 28             sub    $0x28,%rsp
    1655:       64 48 8b 04 25 28 00    mov    %fs:0x28,%rax
    165c:       00 00
    165e:       48 89 44 24 18          mov    %rax,0x18(%rsp)
    1663:       31 c0                   xor    %eax,%eax
    1665:       48 89 e6                mov    %rsp,%rsi
    1668:       e8 18 08 00 00          call   1e85 <read_six_numbers>
    166d:       83 3c 24 01             cmpl   $0x1,(%rsp)
    1671:       75 0a                   jne    167d <phase_2+0x32>
    1673:       48 89 e5                mov    %rsp,%rbp
    1676:       bb 02 00 00 00          mov    $0x2,%ebx
    167b:       eb 13                   jmp    1690 <phase_2+0x45>
    167d:       e8 c1 07 00 00          call   1e43 <explode_bomb>
    1682:       eb ef                   jmp    1673 <phase_2+0x28>
    1684:       83 c3 01                add    $0x1,%ebx
    1687:       48 83 c5 04             add    $0x4,%rbp
    168b:       83 fb 07                cmp    $0x7,%ebx
    168e:       74 12                   je     16a2 <phase_2+0x57>
    1690:       89 d8                   mov    %ebx,%eax
    1692:       0f af 45 00             imul   0x0(%rbp),%eax
    1696:       39 45 04                cmp    %eax,0x4(%rbp)
    1699:       74 e9                   je     1684 <phase_2+0x39>
    169b:       e8 a3 07 00 00          call   1e43 <explode_bomb>
    16a0:       eb e2                   jmp    1684 <phase_2+0x39>
    16a2:       48 8b 44 24 18          mov    0x18(%rsp),%rax
    16a7:       64 48 2b 04 25 28 00    sub    %fs:0x28,%rax
    16ae:       00 00
    16b0:       75 07                   jne    16b9 <phase_2+0x6e>
    16b2:       48 83 c4 28             add    $0x28,%rsp
    16b6:       5b                      pop    %rbx
    16b7:       5d                      pop    %rbp
    16b8:       c3                      ret
    16b9:       e8 c2 fb ff ff          call   1280 <__stack_chk_fail@plt>

Given the code above, I speculated that %rbp would be equal to a decimal value of -40, but I know this is incorrect, and I don’t know enough about assembly to figure out where my logic went wrong.

I’m not entirely sure what the output is supposed to be, but I am not sure if the answer I came up with makes sense, because line 1696 compares if %eax is equal to %rbp + 4, but if %rbp is -40, this statement will never execute, resulting in an infinite loop.

0

There are 0 best solutions below