Understanding disassembly x86 + understanding function call + parameter pass and stack frame

[Matthias Brugger]

2013/8/6 nidhi mittal hada <nidhimittal19 at gmail.com>:
>
>
> ---------- Forwarded message ----------
> From: nidhi mittal hada <nidhimittal19 at gmail.com>
> Date: Tue, Aug 6, 2013 at 2:16 PM
> Subject: Understanding disassembly x86 + understanding function call +
> parameter pass and stack frame
> To: Kernelnewbies <kernelnewbies at nl.linux.org>
> Cc: Mulyadi Santosa <mulyadi.santosa at gmail.com>
>
>
> Hi All,
>
> I am using crash tool to analyze core dump obtained from red hat linux on
> x86_64 platform.
>
> And crash tool gives a stack trace of panic.
> But its does not show function parameters which were passed in this stack
> trace.
>
> So i have to disassemble and understand the value of parameters passed to
> these functions, while it panicked.
> Which i am not able to understand much.
>
> I would request help in knowing, how to understand disassembled function
> call , on x86_64 arch.
>
> Putting some of the doubts..
>
> a)like which sequence the parameters, return address, etc are pushed on
> stack?
> b)Which registers are used, if some registers play some spl. role ?
> c)lets say for a program a.c i use gcc -S a.c ...do we have some other
> command to generate
> somewhat more clear assembly code, may be with some comments in english

I'm not a revers engineering pro, but maybe "ida pro" might help you.
It shows you which code block is called by which jump etc.
The downside it's not open source and it's not freeware (there exists
a limited version, which you can give a try).
There exist other free available revers engineering tools too. If I
can remember the name, I'll post it here.

Good luck!
Matthias

>
> Any kind of help in understanding this will be appreciated ..
>
> Thanks
> Nidhi
>
>
>
>
>
> --
> Thanks & Regards
> Nidhi Mittal Hada
>
> http://nidhi-searchingmyself.blogspot.com/
>
>
> _______________________________________________
> Kernelnewbies mailing list
> Kernelnewbies at kernelnewbies.org
> http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
>



-- 
motzblog.wordpress.com