0000000000033a1b        subq    $0x28,%rsp 
I am having trouble extracting 0x28 from the above line. I am able to extract subq from a big list of assembly code but i only want 0x28 since this gives me the stack size. I was thinking of using substr() function buy there are variations to it, another one could look like this:
0000000000033a1c subq    $0x000000b8,%rsp 
in this case i only want 0x000000b8.
I am using perl.
Thank you.
            From stackoverflow
        
    - 
                        If your input of the following format always: instruction_address operand $stack_size,registeryou can do: $a = '0000000000033a1b subq $0x28,%rsp'; $a =~s/^.*?\$(.*?),.*$/\1/; print $a; # prints 0x28rashid : Thank you so much, it worked!. Could you please explain to me what is happening? I do not just want to copy and paste the code, i want to learn it. Thank you.Axeman : @rashid, he's escaping the dollar-sign for one...zen : rashid, the regex reads: ^ from start of string . any character * zero or more times ? non greedy modifier \$ a literal dollar sign ( begin capturing . any character * zero or more times ? non greedy modifier ) end capture group 1 , a literal comma .* everything else up to the $ end of string \1 substituted by capture group 1 --- see Recipe 6.15 in the "perl cookbook" for an explanation of greedy modifiers.
- 
                        Without code, my guess is that you're not escaping the dollar sign. Thus you are asking for it to match the end of the line, and then '0x28'.In any regex, /\$0x(\p{XDigit}+)/should capture'28'out of that string.
 
0 comments:
Post a Comment