Show Posts
Code:
lea 0x4(%esp),%ecx
pushl 0xfffffffc(%ecx)
pushl 0xfffffffc(%ecx)
These instructions serve to save the stack pointer on the stack. Notice that at main+42, this value is loaded back into ESP in order to restore the stack pointer before returning.
Code:
and $0xfffffff0,%esp
This instruction zeros out the last byte in the ESP register. This is done to ensure that the stack pointer is aligned on a 16-byte boundary (the default stack boundary is 16) in order to increase CPU execution time. There's a short semi-discussion on it at the Kernel Trap forums: http://kerneltrap.org/node/8236 .
As far as puts() goes, it's not much different from printf() when just printing out a string. You should see the memory address where the string is located pushed onto the stack just before the call to puts(). It will place a positive number in the EAX register if successful (probably 1), and a -1 in EAX if it fails.
GCIH - GIAC Certified Incident Handler : Passed my GCIH
