GDB Baby Step 4: Decoding Multiplication in Assembly with GDB — StackZero

This article was originally published at https://www.stackzero.net/gdb-baby-step-4/

Welcome to the next stage of our adventure into the fascinating world of GNU Debugger (GDB) — “GDB Baby Step 4: Decoding Multiplication in Assembly with GDB”. This installment delves deeper into the functional mechanisms of GDB, unraveling how it uncovers operations within program registers. Our focus for this exercise is to identify a specific multiplication constant utilized in a function call, only with a twist: we seek the constant in its decimal form. Ready for the challenge? Let’s dive in.

Preceding Steps: Revisiting GDB Baby Steps 1, 2 and 3

Before we take on the Baby Step 4 challenge, a quick recap of our past adventures is in order. Each step of our journey so far — from the introductory lessons of GDB, setting breakpoints, and examining registers to understand program execution flow — has been meticulously preparing us for the task.

GDB Baby Step 1 introduced us to the GDB environment and disassemble executables, Step 2 guided us on examining specific register contents at a function end, and Step 3 steered us towards understanding how memory addresses store values. All these valuable skills will come into play in Baby Step 4. If you missed the previous steps or need a refresher, revisit GDB Baby Step 1, GDB Baby Step 2, and GDB Baby Step 3.

This foundational knowledge will undoubtedly make Baby Step 4 a smoother ride.

If you are really a beginner in reverse engineering, I suggest you start with:

• Unravelling the Secrets of Reverse Engineering: Practical Applications for In-Depth Analysis
• A Beginner’s Guide to PicoCTF’s Reverse Engineering: Simple Writeups

Stepping Over vs. Stepping Into: The GDB Navigation Basics

A crucial step in our journey is to understand two fundamental GDB instructions: Step Over” (ni) and “Step Into” (si).
Both commands are about navigating through the program, but they operate differently.

• “Step Over” (ni) executes the current line of…