Question

I don’t have the full source code but an object file with symbols. There’s a read line:

=> 0x080489cd <+169>:   call   0x8049275 <read_line>
   0x080489d2 <+174>:   mov    %eax,(%esp)
   0x080489d5 <+177>:   call   0x8048d59 <phase_1>

in the function:
 8048d59:   55                      push   %ebp
 8048d5a:   89 e5                   mov    %esp,%ebp
 8048d5c:   83 ec 08                sub    $0x8,%esp

I put a b in the first line and also added one to the function name to be sure. After entering “1” tried p *(char**)$esp and I get:

0x80489da "\350\355\006"

which is not what I was expected. I was expected to see “1”. I also tried:

gdb x $esp
0xbffff0cc: 0x080489da

gdb x *0xbffff0cc

0x80489da <main+182>: 0x0006ede8

Answer 1

If you are breaking on the first like of the function (I assume that’s what you mean by: “I put a b in the first line”) then what you’re seeing is the return address. It looks like you’re actually seeing the return address from calling phase_1.

If what you’re looking for is the first parameter try:

p *(char**)($esp+4);