Assembly Checking Values on Stack

[Assembly] Checking Values on Stack - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Coders Lounge (https://hackforums.net/forumdisplay.php?fid=5)
+---- Thread: [Assembly] Checking Values on Stack (/showthread.php?tid=5679855)

Checking Values on Stack - 7_R3X - Jul 27, 2017

I want to print 1 words from the top of stack in the form of hexadecimal. To do so, I typed the following:

Code 
(gdb) x/1xw $esp

but GDB keeps popping up:

Code 
0xffffffffffffe030:     Cannot access memory at address 0xffffffffffffe030

The program I'm trying to debug has already pushed a value onto stack so just in case if you're wondering that I might be trying to access kernel variables at the very beginning of program, it's not so. Any idea?

* - Mischa - Jul 27, 2017

I have no idea what architecture you're on.
What OS you're on.
You didn't paste any code. Clearly the problem is the ESP register because GDB is accessing invalid memory when it tries to read ESP.
At the start of your program, check ESP and EBP. Then push onto the stack and check ESP again.
You're tampering with ESP somewhere in your code, there's no other reason why it would holding an invalid memory address.

* - 7_R3X - Jul 28, 2017

(Jul 27, 2017 02:08 PM)Mischa Wrote: I have no idea what architecture you're on.
What OS you're on.
You didn't paste any code. Clearly the problem is the ESP register because GDB is accessing invalid memory when it tries to read ESP.
At the start of your program, check ESP and EBP. Then push onto the stack and check ESP again.
You're tampering with ESP somewhere in your code, there's no other reason why it would holding an invalid memory address.

I found the reason why I had problem accessing the address space. 0xffffffffffffe030 is actually a 64 bit address and I tried to access it using esp which is a 32 bit register. I changed

Code 
(gdb) x/1xw $esp

Code 
(gdb) x/1xw $rsp

and every thing works fine now!!