add other syntax

Author: hexylena

_resources/assembly-stack.md

@@ -2,6 +2,14 @@
 
 When entering/exiting a function.
 
+You can use
+
+```
+set disassembly-flavor [intel|att]
+```
+
+to switch disassembly formats. (Or to include that in your `~/.gdbinit` to set permanently)
+
 ## C Code
 
 ```
@@ -32,31 +40,31 @@ sudo apt install gcc-multilib lib32gcc-5-dev
 ## Disassembly
 
 ```
-(gdb) disas main
+(gdb) disas main        # Intel Syntax             # ATT Syntax
 Dump of assembler code for function main:
-   0x080483f4 <+0>:     push   ebp
-   0x080483f5 <+1>:     mov    ebp,esp
-   0x080483f7 <+3>:     push   0x5
-   0x080483f9 <+5>:     push   0x4
-   0x080483fb <+7>:     push   0x3
-   0x080483fd <+9>:     call   0x80483db <blah>
-   0x08048402 <+14>:    add    esp,0xc
-   0x08048405 <+17>:    mov    eax,0x0
-   0x0804840a <+22>:    leave
-   0x0804840b <+23>:    ret
-
-(gdb) disas blah
+   0x080483f4 <+0>:     push   ebp                 push   %ebp
+   0x080483f5 <+1>:     mov    ebp,esp             mov    %esp,%ebp
+   0x080483f7 <+3>:     push   0x5                 push   $0x5
+   0x080483f9 <+5>:     push   0x4                 push   $0x4
+   0x080483fb <+7>:     push   0x3                 push   $0x3
+   0x080483fd <+9>:     call   0x80483db <blah>    call   0x80483db <blah>
+   0x08048402 <+14>:    add    esp,0xc             add    $0xc,%esp
+   0x08048405 <+17>:    mov    eax,0x0             mov    $0x0,%eax
+   0x0804840a <+22>:    leave                      leave
+   0x0804840b <+23>:    ret                        ret
+
+(gdb) disas blah        # Intel Syntax                   # ATT Syntax
 Dump of assembler code for function blah:
-   0x080483db <+0>:     push   ebp
-   0x080483dc <+1>:     mov    ebp,esp
-   0x080483de <+3>:     sub    esp,0x10
-   0x080483e1 <+6>:     mov    eax,DWORD PTR [ebp+0x8]
-   0x080483e4 <+9>:     imul   eax,DWORD PTR [ebp+0xc]
-   0x080483e8 <+13>:    imul   eax,DWORD PTR [ebp+0x10]
-   0x080483ec <+17>:    mov    DWORD PTR [ebp-0x4],eax
-   0x080483ef <+20>:    mov    eax,DWORD PTR [ebp-0x4]
-   0x080483f2 <+23>:    leave
-   0x080483f3 <+24>:    ret
+   0x080483db <+0>:     push   ebp                        push   %ebp
+   0x080483dc <+1>:     mov    ebp,esp                    mov    %esp,%ebp
+   0x080483de <+3>:     sub    esp,0x10                   sub    $0x10,%esp
+   0x080483e1 <+6>:     mov    eax,DWORD PTR [ebp+0x8]    mov    0x8(%ebp),%eax
+   0x080483e4 <+9>:     imul   eax,DWORD PTR [ebp+0xc]    imul   0xc(%ebp),%eax
+   0x080483e8 <+13>:    imul   eax,DWORD PTR [ebp+0x10]   imul   0x10(%ebp),%eax
+   0x080483ec <+17>:    mov    DWORD PTR [ebp-0x4],eax    mov    %eax,-0x4(%ebp)
+   0x080483ef <+20>:    mov    eax,DWORD PTR [ebp-0x4]    mov    -0x4(%ebp),%eax
+   0x080483f2 <+23>:    leave                             leave
+   0x080483f3 <+24>:    ret                               ret
 ```
 
 ## Step -1 - Before entering
@@ -181,3 +189,44 @@ addr          | addr         | contents     | use
 `ebp - 0x8`   | `0xffffcf7c` | garbage?     |
 `ebp - 0xc`   | `0xffffcf78` | garbage?     |
 `ebp - 0x10`  | `0xffffcf74` | garbage?     | esp
+
+If we want to see multiple values we can do something like:
+
+```
+(gdb) x/3d ((int)$ebp + 0x8)
+0xffffcf8c:     3       4       5
+```
+
+which prints next three values up, as decimals. Or we can view them as integers:
+
+
+```
+(gdb) x/3t ((int)$ebp + 0x8)
+0xffffcf8c:     00000000000000000000000000000011        00000000000000000000000000000100        00000000000000000000000000000101
+```
+
+The formats available are:
+
+specifier | type
+--------- | -----
+`o`       | octal
+`x`       | hex
+`d`       | decimal
+`u`       | unsigned decimal
+`t`       | binary
+`f`       | float
+`a`       | address
+`i`       | instruction
+`c`       | char
+`s`       | string
+`T`       | OStype
+
+If you accidentally use `i` expecting `integer`, instead it will treat those as
+instructions that appear nowhere in the disassembly and can be a bit confusing.
+
+```
+(gdb) x/3i ((int)$ebp + 0x8)
+0xffffcf8c:  add    eax,DWORD PTR [eax]
+0xffffcf8e:  add    BYTE PTR [eax],al
+0xffffcf90:  add    al,0x0
+```