When looking at a listing file that was generated by NASM, I see that there are three kinds of opcodes:
What they mean? when each of them is used?
This is an example of a listing file that demonstrate all of the above:
1 section .text
2 extern printf
3 extern fgets
4 00000000 313233 str3: db "123"
5 main:
6 00000003 68[00000000] push str1
7 00000008 68[09000000] push str2
8 0000000D 68[00000000] push str3
9 00000012 E8(00000000) call func1
10 00000017 E8(04000000) call func2
11 0000001C E80B000000 call func3
12 00000021 E8(00000000) call printf
13 00000026 E8(00000000) call fgets
14 0000002B C3 ret
15
16 0000002C 90 func3: nop
17 0000002D C3 ret
18
19
20 section .text1
21 00000000 90 func1: nop
22 00000001 90 nop
23 00000002 90 nop
24 00000003 C3 ret
25
26 00000004 90 func2: nop
27 00000005 90 nop
28 00000006 90 nop
29 00000007 C3 ret
30
31
32 section .data
33
34 00000000 313233343536373839 str1: db "123456789"
35 00000009 313233343536373839 str2: db "123456789"
They're showing where relocations will be applied at link time.
[nnnnnnnn]
shows an absolute relocation (when the linker performs the relocation, the base address of some section will be added to the offset). e.g. once the binary is fully linked, those bytes in the push str2
instruction will be changed to contain the base address of .data
+ 0x09
.
(nnnnnnnn)
shows a PC-relative relocation (used for calls and branches, where the final value must be relative to the address of the next instruction). e.g. the bytes in the call func2
instruction will be updated with the difference between the final address of func2
, and the address of the following instruction (call func3
).
There are no brackets for the call func3
instruction itself because no relocation is needed in that case - the call
instruction needs a relative address, but func3
is within the same section, so the relative address is already known (the following instruction is at .text + 0x21
, and func3
is at .text + 0x2c
, so the relative address is 0xb
regardless of the final address of .text
).
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With