interpret of gdb "gdb info reg"

来源:互联网 发布:excel数据验证限制 编辑:程序博客网 时间:2024/06/06 21:41

(gdb) info reg
eax            0x0    0
ecx            0x0    0
edx            0xfffffff4    -12
ebx            0x8e98f68    149524328
esp            0xf0828630    0xf0828630
ebp            0xf0828768    0xf0828768
esi            0x1    1
edi            0xf08293b4    -259877964
eip            0x812d529    0x812d529
eflags         0x10202    66050
cs             0x23    35
ss             0x2b    43
ds             0x2b    43
es             0x2b    43
fs             0x0    0
gs             0x63    99
(gdb)

The first column is the register name, the second column is its value in hexadecimals

and the last column is its value in decimals.

I'm not sure what you're trying to do, but usually you get more useful information
with the "disassemble" gdb command, as that shows which instructions are executed. 
If the binary is compiled with debugging info then you get a lot more information and 
backtraces are helpful too then, especially "bt full", as that gives a lot of extra info.

EIP is the instruction pointer, EAX is both the first argument of a function as well as
the return value (though it depends on which calling convention is used), but of course
the registers can be used for other things too. You can't tell what's going on by looking
at the register values, for that you need to look at the instructions. "info reg" is useful
when you want to look up the value of a register that is used by some instruction.