0000000000033a1b subq $0x28,%rsp
I am having trouble extracting 0x28 from the above line. I am able to extract subq from a big list of assembly code but i only want 0x28 since this gives me the stack size. I was thinking of using substr() function buy there are variations to it, another one could look like this:
0000000000033a1c subq $0x000000b8,%rsp
in this case i only want 0x000000b8.
I am using perl.
Thank you.
From stackoverflow
-
If your input of the following format always:
instruction_address operand $stack_size,register
you can do:
$a = '0000000000033a1b subq $0x28,%rsp'; $a =~s/^.*?\$(.*?),.*$/\1/; print $a; # prints 0x28
rashid : Thank you so much, it worked!. Could you please explain to me what is happening? I do not just want to copy and paste the code, i want to learn it. Thank you.Axeman : @rashid, he's escaping the dollar-sign for one...zen : rashid, the regex reads: ^ from start of string . any character * zero or more times ? non greedy modifier \$ a literal dollar sign ( begin capturing . any character * zero or more times ? non greedy modifier ) end capture group 1 , a literal comma .* everything else up to the $ end of string \1 substituted by capture group 1 --- see Recipe 6.15 in the "perl cookbook" for an explanation of greedy modifiers. -
Without code, my guess is that you're not escaping the dollar sign. Thus you are asking for it to match the end of the line, and then
'0x28'
.In any regex,
/\$0x(\p{XDigit}+)/
should capture'28'
out of that string.
0 comments:
Post a Comment