You can see code like this in GDB:
0x3001ce2b : movzx edx,BYTE PTR [ebp-80] <- 80 is decimal 0x3001ce2f : mov eax,DWORD PTR [ebx+0x206c2] <- 0x206c2 is hexa (0x is the key!)
If you try to do a x/x $ebp-80, you will get the wrong address because the default input radix is hexadecimal and not decimal.
But in the next line, it’s hexadecimal. I haven’t searched much about this, but it seems the decimal is used due to alignment.
The “fix” is to change the input radix or convert the 80 to hexadecimal. I prefer to change the radix to the correct one, dump the value and then change back to hexa if I need. Yeah I’m lazy !
From gdb manual:
You can always enter numbers in octal, decimal, or hexadecimal in GDB by the usual conventions: octal numbers begin with ‘0’, decimal numbers end with ‘.’, and hexadecimal numbers begin with ‘0x’. Numbers that begin with none of these are, by default, entered in base 10; likewise, the default display for numbers–when no particular format is specified–is base 10. You can change the default base for both input and output with the
set radix command.
set input-radix base
- Set the default base for numeric input. Supported choices for base are decimal 8, 10, or 16. base must itself be specified either unambiguously or using the current default radix; for example, any of
- set radix 012
- set radix 10
- set radix 0xa
- sets the base to decimal. On the other hand,‘set radix 1 leaves the radix unchanged no matter what it was.
set output-radix base
- Set the default base for numeric display. Supported choices for base are decimal 8, 10, or 16. base must itself be specified either unambiguously or using the current default radix.
- Display the current default base for numeric input.
- Display the current default base for numeric display.