Here we see a screenshot of a program running in gdb:
The execution has been halted at breakpoint at the beginning of a function and an examine (x) command has been run.
Answer the following questions:
1) What is the name of the function we are in? (Just the name, and remember lower and upper case matters).
2) If we step the code ( nexti or ni ), what will be the value of the %rsp register AFTER that step?
(You must use 0x as the prefix and capital letters in the hex).
The examine command, x / 64xb, that was run is printing the content of the stack. This is know as a stack-dump.
3) How much data (how many bytes) are we seeing here? (just write the number)
4) What is the return address that will be popped of the Stack when this function ends (i.e., when a ret is executed)? (Hint: use the stack-dump and make sure you write the address in the "correct order" and using a 0x as prefix).
(Hint 2: Use you knowledge of where we expect to see instructions, i.e., the code, in the program).