|
From: Tanmay M. <tan...@ho...> - 2012-07-12 05:13:08
|
Thanks Pat.Here's the output of "otool -v -t check"Is this what is required?Do let me know if I need to disassemble in some other way. -----------------------------------------------------------check:(__TEXT,__text) sectionstart:0000000100000c78 pushq $0x000000000100000c7a movq %rsp,%rbp0000000100000c7d andq $0xf0,%rsp0000000100000c81 movq 0x08(%rbp),%rdi0000000100000c85 leaq 0x10(%rbp),%rsi0000000100000c89 movl %edi,%edx0000000100000c8b addl $0x01,%edx0000000100000c8e shll $0x03,%edx0000000100000c91 addq %rsi,%rdx0000000100000c94 movq %rdx,%rcx0000000100000c97 jmp 0x100000c9d0000000100000c99 addq $0x08,%rcx0000000100000c9d cmpq $0x00,(%rcx)0000000100000ca1 jne 0x100000c990000000100000ca3 addq $0x08,%rcx0000000100000ca7 callq 0x100000cb40000000100000cac movl %eax,%edi0000000100000cae callq 0x100000e5c0000000100000cb3 hlt_main:0000000100000cb4 pushq %rbp0000000100000cb5 movq %rsp,%rbp0000000100000cb8 subq $0x20,%rsp0000000100000cbc movl $0x000001c8,%edi0000000100000cc1 callq 0x100000e620000000100000cc6 movq %rax,0xf0(%rbp)0000000100000cca movl $0x000011d0,%edi0000000100000ccf callq 0x100000e620000000100000cd4 movq %rax,0xe8(%rbp)0000000100000cd8 movq 0xe8(%rbp),%rdx0000000100000cdc addq $0x00000130,%rdx0000000100000ce3 movq 0xe8(%rbp),%rcx0000000100000ce7 addq $0x00000098,%rcx0000000100000cee movq 0xf0(%rbp),%rax0000000100000cf2 movq 0xe8(%rbp),%rsi0000000100000cf6 movq %rax,%r90000000100000cf9 movq %rdx,%r80000000100000cfc movq %rsi,%rdx0000000100000cff movl $0x00000098,%esi0000000100000d04 leaq 0x00000165(%rip),%rdi0000000100000d0b movl $0x00000000,%eax0000000100000d10 callq 0x100000e680000000100000d15 movq $0xffffffff,%rax0000000100000d1c cmpq $0xff,%rax0000000100000d20 je 0x100000d3e0000000100000d22 movq $0xffffffff,%rcx0000000100000d29 movq 0xf0(%rbp),%rdi0000000100000d2d movl $0x00000098,%edx0000000100000d32 movl $0x00000000,%esi0000000100000d37 callq 0x100000e560000000100000d3c jmp 0x100000d510000000100000d3e movq 0xf0(%rbp),%rdi0000000100000d42 movl $0x00000098,%edx0000000100000d47 movl $0x00000000,%esi0000000100000d4c callq 0x100000df60000000100000d51 movl $0x00000000,0xfc(%rbp)0000000100000d58 movl $0x00000000,0xfc(%rbp)0000000100000d5f jmp 0x100000de70000000100000d64 movl 0xfc(%rbp),%esi0000000100000d67 leaq 0x0000012d(%rip),%rdi0000000100000d6e movl $0x00000000,%eax0000000100000d73 callq 0x100000e680000000100000d78 movq $0xffffffff,%rax0000000100000d7f cmpq $0xff,%rax0000000100000d83 je 0x100000daf0000000100000d85 movq $0xffffffff,%rcx0000000100000d8c movl 0xfc(%rbp),%eax0000000100000d8f cdqe0000000100000d91 imulq $0x00000098,%rax,%rax0000000100000d98 movq %rax,%rdi0000000100000d9b addq 0xe8(%rbp),%rdi0000000100000d9f movq 0xf0(%rbp),%rsi0000000100000da3 movl $0x000001c8,%edx0000000100000da8 callq 0x100000e500000000100000dad jmp 0x100000dd00000000100000daf movl 0xfc(%rbp),%eax0000000100000db2 cdqe0000000100000db4 imulq $0x00000098,%rax,%rax0000000100000dbb movq %rax,%rdi0000000100000dbe addq 0xe8(%rbp),%rdi0000000100000dc2 movq 0xf0(%rbp),%rsi0000000100000dc6 movl $0x000001c8,%edx0000000100000dcb callq 0x100000e220000000100000dd0 movl 0xfc(%rbp),%esi0000000100000dd3 leaq 0x000000ce(%rip),%rdi0000000100000dda movl $0x00000000,%eax0000000100000ddf callq 0x100000e680000000100000de4 incl 0xfc(%rbp)0000000100000de7 cmpl $0x1a,0xfc(%rbp)0000000100000deb jle 0x200000d640000000100000df1 movl 0xfc(%rbp),%eax0000000100000df4 leave0000000100000df5 ret___inline_memset_chk:0000000100000df6 pushq %rbp0000000100000df7 movq %rsp,%rbp0000000100000dfa subq $0x20,%rsp0000000100000dfe movq %rdi,0xf8(%rbp)0000000100000e02 movl %esi,0xf4(%rbp)0000000100000e05 movq %rdx,0xe8(%rbp)0000000100000e09 movq $0xffffffff,%rcx0000000100000e10 movq 0xe8(%rbp),%rdx0000000100000e14 movl 0xf4(%rbp),%esi0000000100000e17 movq 0xf8(%rbp),%rdi0000000100000e1b callq 0x100000e560000000100000e20 leave0000000100000e21 ret___inline_memcpy_chk:0000000100000e22 pushq %rbp0000000100000e23 movq %rsp,%rbp0000000100000e26 subq $0x20,%rsp0000000100000e2a movq %rdi,0xf8(%rbp)0000000100000e2e movq %rsi,0xf0(%rbp)0000000100000e32 movq %rdx,0xe8(%rbp)0000000100000e36 movq $0xffffffff,%rcx0000000100000e3d movq 0xe8(%rbp),%rdx0000000100000e41 movq 0xf0(%rbp),%rsi0000000100000e45 movq 0xf8(%rbp),%rdi0000000100000e49 callq 0x100000e500000000100000e4e leave0000000100000e4f ret------------------------------------------------------- > > I suspect it's not the real problem in your case. > > And I suspect it is. Of course, I could be wrong. There is only one > way to find out... > > > We need to see the actual code > > that is being executed. In particular, you haven't shown the code which > > surrounds 0x7FFFFFE00BAC from your initial report: > > ==57528== Invalid read of size 8 > > ==57528== at 0x7FFFFFE00BAC: ??? > > ==57528== by 0x100000E4D: __inline_memcpy_chk (in ./check) > > Please produce a disassembly of __inline_memcpy_chk that surrounds > > address 0x100000E4D. Please produce a disassembly of the routine > > that __inline_memcpy_chk calls (probably surrounding 0x7FFFFFE00BAC). > > I agree completely. Seeing the disassembly is the only way to know > what is really going on. > > - Pat |