So basically what I am trying to do is to distinguish the data from the memory address during my analysis task in relation to the assembler.
Here is an example that I can barely handle.
Suppose we have a val variable declared in a .data section.
0x08048054 01 00 00 00
and here is one line of assembly code by parsing the ELF file.
mov $0x08048054, %eax
Perhaps this is an indirect reference to the variable val , for example:
mov $0x8048054,%eax
mov %edx,0x4(%esp)
mov %eax,(%esp)
call printf
then I convert $ 0x8048054 to the variable name val as follows:
mov val,%eax
mov %edx,0x4(%esp)
mov %eax,(%esp)
call printf
But there is another situation: 0x8048054 is used only as a number in one calculation:
mov $0x8048054,%eax
add 0x8(%ebp), %eax
, , ( , , )
b = 0x8048054 + argc;
$0x8048054 val
, of% eax register, , , .
?
- ?
!