title: Finding the Starting Address of an array
body: <p>I've been working on the bufbomb lab from CSAPPS and I've gotten stuck on one of the phases.</p>
  
  <p>I won't get into the gore-y details of the project since I just need a nudge in the right direction. I'm having a hard time finding the starting address of the array called "buf" in the given assembly.</p>
  
  <p>We're given a function called getbuf:</p>
  
  <pre><code>#define NORMAL_BUFFER_SIZE 32
  
  int getbuf()
  {
     char buf[NORMAL_BUFFER_SIZE];
     Gets(buf);
     return 1;
  }
  </code></pre>
  
  <p>And the assembly dumps:</p>
  
  <pre><code>Dump of assembler code for function getbuf:
  0x08048d92 &lt;+0&gt;:    sub    $0x3c,%esp
  0x08048d95 &lt;+3&gt;:    lea    0x10(%esp),%eax
  0x08048d99 &lt;+7&gt;:    mov    %eax,(%esp)
  0x08048d9c &lt;+10&gt;:    call   0x8048c66 &lt;Gets&gt;
  0x08048da1 &lt;+15&gt;:    mov    $0x1,%eax
  0x08048da6 &lt;+20&gt;:    add    $0x3c,%esp
  0x08048da9 &lt;+23&gt;:    ret   
  End of assembler dump.
  
  
  Dump of assembler code for function Gets:
  0x08048c66 &lt;+0&gt;:    push   %ebp
  0x08048c67 &lt;+1&gt;:    push   %edi
  0x08048c68 &lt;+2&gt;:    push   %esi
  0x08048c69 &lt;+3&gt;:    push   %ebx
  0x08048c6a &lt;+4&gt;:    sub    $0x1c,%esp
  0x08048c6d &lt;+7&gt;:    mov    0x30(%esp),%esi
  0x08048c71 &lt;+11&gt;:    movl   $0x0,0x804e100
  0x08048c7b &lt;+21&gt;:    mov    %esi,%ebx
  0x08048c7d &lt;+23&gt;:    jmp    0x8048ccf &lt;Gets+105&gt;
  0x08048c7f &lt;+25&gt;:    mov    %eax,%ebp
  0x08048c81 &lt;+27&gt;:    mov    %al,(%ebx)
  0x08048c83 &lt;+29&gt;:    add    $0x1,%ebx
  0x08048c86 &lt;+32&gt;:    mov    0x804e100,%eax
  0x08048c8b &lt;+37&gt;:    cmp    $0x3ff,%eax
  0x08048c90 &lt;+42&gt;:    jg     0x8048ccf &lt;Gets+105&gt;
  0x08048c92 &lt;+44&gt;:    lea    (%eax,%eax,2),%edx
  0x08048c95 &lt;+47&gt;:    mov    %ebp,%ecx
  0x08048c97 &lt;+49&gt;:    sar    $0x4,%cl
  0x08048c9a &lt;+52&gt;:    mov    %ecx,%edi
  0x08048c9c &lt;+54&gt;:    and    $0xf,%edi
  0x08048c9f &lt;+57&gt;:    movzbl 0x804a478(%edi),%edi
  0x08048ca6 &lt;+64&gt;:    mov    %edi,%ecx
  ---Type &lt;return&gt; to continue, or q &lt;return&gt; to quit---
  0x08048ca8 &lt;+66&gt;:    mov    %cl,0x804e140(%edx)
  0x08048cae &lt;+72&gt;:    mov    %ebp,%ecx
  0x08048cb0 &lt;+74&gt;:    and    $0xf,%ecx
  0x08048cb3 &lt;+77&gt;:    movzbl 0x804a478(%ecx),%ecx
  0x08048cba &lt;+84&gt;:    mov    %cl,0x804e141(%edx)
  0x08048cc0 &lt;+90&gt;:    movb   $0x20,0x804e142(%edx)
  0x08048cc7 &lt;+97&gt;:    add    $0x1,%eax
  0x08048cca &lt;+100&gt;:    mov    %eax,0x804e100
  0x08048ccf &lt;+105&gt;:    mov    0x804e110,%eax
  0x08048cd4 &lt;+110&gt;:    mov    %eax,(%esp)
  0x08048cd7 &lt;+113&gt;:    call   0x8048820 &lt;_IO_getc@plt&gt;
  0x08048cdc &lt;+118&gt;:    cmp    $0xffffffff,%eax
  0x08048cdf &lt;+121&gt;:    je     0x8048ce6 &lt;Gets+128&gt;
  0x08048ce1 &lt;+123&gt;:    cmp    $0xa,%eax
  0x08048ce4 &lt;+126&gt;:    jne    0x8048c7f &lt;Gets+25&gt;
  0x08048ce6 &lt;+128&gt;:    movb   $0x0,(%ebx)
  0x08048ce9 &lt;+131&gt;:    mov    0x804e100,%eax
  0x08048cee &lt;+136&gt;:    movb   $0x0,0x804e140(%eax,%eax,2)
  0x08048cf6 &lt;+144&gt;:    mov    %esi,%eax
  0x08048cf8 &lt;+146&gt;:    add    $0x1c,%esp
  0x08048cfb &lt;+149&gt;:    pop    %ebx
  0x08048cfc &lt;+150&gt;:    pop    %esi
  0x08048cfd &lt;+151&gt;:    pop    %edi
  ---Type &lt;return&gt; to continue, or q &lt;return&gt; to quit---
  0x08048cfe &lt;+152&gt;:    pop    %ebp
  0x08048cff &lt;+153&gt;:    ret   
  End of assembler dump.
  </code></pre>
  
  <p>I'm having a difficult time locating where the starting address of buf is (or where buf is at all in this mess!). If someone could point that out to me, I'd greatly appreciate it.</p>
  
  <p>Attempt at a solution</p>
  
  <pre><code>Reading symbols from /home/user/CS247/buflab/buflab-handout/bufbomb...(no debugging symbols found)...done.
  (gdb) break getbuf
  Breakpoint 1 at 0x8048d92
  (gdb) run -u user &lt; firecracker-exploit.bin
  Starting program: /home/user/CS247/buflab/buflab-handout/bufbomb -u user &lt; firecracker-exploit.bin
  Userid: ...
  Cookie: ...
  
  Breakpoint 1, 0x08048d92 in getbuf ()
  (gdb) print buf
  No symbol table is loaded.  Use the "file" command.
  (gdb) 
  </code></pre>