Search⌘ K
Home/
Courses/
Foundations of Linux ARM64: Debug, Disassemble, and Reverse

Memory Pointers Example: Memory Layout

Learn about memory layout and pointers with the help of an example.

We'll cover the following...

Memory pointers in the C/C++ language

We have the following data declaration and definition in the C/C++ language:

C++
int a, b;
int *pa, *pb = &b;

Memory pointers in the assembly language

The example code we’ll look at in this lesson corresponds to the following pseudocode and assembly language:

Source code

The source code of memory pointers is as follows:

Assembly (GAS x86)
.data
a:  .int 0
b:  .int 0
pa: .quad 0
pb: .quad b
.text
.global _start
main:
_start:
	   adr  x0, a
	   adr  x1, pa
	   str  x0, [x1]
	   adr  x0, pa
	   ldr  x0, [x0]
       mov  w2, #1
	   str  w2, [x0] 
	   adr  x1, pb
       ldr  x1, [x1]
	   str  w2, [x1]
 
	   ldr  w2, [x0]
       ldr  w3, [x1]        
	   add  w3, w3, w2
	   str  w3, [x1]
	   mov  x0, #0              
       mov  w8, #93             
       svc  #0

Memory pointers in the GDB disassembly

The code example of memory pointers is described in detail below.

Compile and execute GDB commands

We compile and link the course code, and load the executable into GDB. We get the following output:

C++
as MemoryPointers.asm -o MemoryPointers.o
ld MemoryPointers.o -o MemoryPointers
gdb ./MemoryPointers

Note: You can practice all the commands in the coding playground provided at the end of the lesson.

Now, we are in GDB environment:

Loading object code into GDB
Loading object code into GDB

We then put a breakpoint on the main function and run the program until GDB reaches at this point:

C++
break main

A breakpoint is shown below:

C++
Breakpoint 1 at 0x4000b0
(gdb)

Now, run the program:

C++
set disable-randomization off
run

The output after execution is given below:

C++
Starting program: /Chapters/Chapter7/MemoryPointers 
Breakpoint 1, 0x00000000004000b0 in _start ()
(gdb)

Now, we disassemble the main function:

C++
disass main

The output is given below:

C++
Dump of assembler code for function _start:
=> 0x00000000004000b0 <+0>:     adr     x0, 0x4100f0
   0x00000000004000b4 <+4>:     adr     x1, 0x4100f8
   0x00000000004000b8 <+8>:     str     x0, [x1]
   0x00000000004000bc <+12>:    adr     x0, 0x4100f8
   0x00000000004000c0 <+16>:    ldr     x0, [x0]
   0x00000000004000c4 <+20>:    mov     w2, #0x1                        // #1
   0x00000000004000c8 <+24>:    str     w2, [x0]
   0x00000000004000cc <+28>:    adr     x1, 0x410100
   0x00000000004000d0 <+32>:    ldr     x1, [x1]
   0x00000000004000d4 <+36>:    str     w2, [x1]
   0x00000000004000d8 <+40>:    ldr     w2, [x0]
   0x00000000004000dc <+44>:    ldr     w3, [x1]
   0x00000000004000e0 <+48>:    add     w3, w3, w2
   0x00000000004000e4 <+52>:    str     w3, [x1]
   0x00000000004000e8 <+56>:    mov     x0, #0x3                        // #3
   0x00000000004000ec <+60>:    lsl     x2, x1, x0
End of assembler dump.
(gdb)

We then clear x0 – x3 registers to set up a memory layout that is easy to follow:

C++
set  $x0 = 0
set  $x1 = 0
set  $x2 = 0
set  $x3 = 0
info registers  x0 x1 x2 x3

We get the following output:

C++
x0             0x0                 0
x1             0x0                 0
x2             0x0                 0
x3             0x0                 0
(gdb)

We also instruct GDB to automatically display the current instruction to be executed, the values of registers x0 – x3, and the contents of variables a, b, pa, pb:

C++
(gdb) display/i $pc
1: x/i $pc
=> 0x4000b0 <_start>:   adr     x0, 0x4100f0
(gdb) display/x $x0
2: /x $x0 = 0x0
(gdb) display/x $x1
3: /x $x1 = 0x0
(gdb) display/x $x2
4: /x $x2 = 0x0
(gdb) display/x $x3
5: /x $x3 = 0x0
(gdb) display/x (int)a
6: /x (int)a = 0x0
(gdb) display/x (int)b
7: /x (int)b = 0x0
(gdb) display/x (long)pa
8: /x (long)pa = 0x0 
(gdb) display/x (long)pb
9: /x (long)pb = 0x4100f4
(gdb)

We see that the pb variable contains the address 0x4100f4. We then check the addresses of (variables) memory locations a, b, pa, pb:

C++
(gdb) print &a
$1 = (<data variable, no debug info> *) 0x4100f0
(gdb) print &b
$2 = (<data variable, no debug info> *) 0x4100f4
(gdb) print &pa
$3 = (<data variable, no debug info> *) 0x4100f8
(gdb) print &pb
$4 = (<data variable, no debug info> *) 0x410100
(gdb)

We also check the value stored at the address 0x4100f4 (value of pb that is the address of ...