Binary Analysis Cookbook

How it works...

In step 1, we examine the stack, and this time, the last command we issue is the print command, which converts the hexadecimal value into a decimal value and stores it in a temporary variable. Remember that Little Endian matters here, so we need to reverse the byte order of the last command. Also note that esp contains the 0x080480f8 address, which is the address of our <portnum> label containing the bytes, 0x5c11. In JMP, CALL a series of instructions. The instruction immediately following the CALL instruction is automatically pushed onto the stack. As you can see here, esp is essentially pointing to the value 4444. Remember our static analysis phase and how poorly objdump handled these bytes? GDB is doing a better job, ...