Address on top of the stack while debugging? Question from Procedures, Intro to Assembly Language

Hello HTBoxers,

I’m currently doing the Intro To Assembly Language module on HTB ACADEMY and I’m stuck at the question from the chapter procedures which is:

Try assembling and debugging the above code, and note how “call” and “ret” store and retrieve “rip” on the stack. What is the address at the top of the stack after entering “Exit”?

Debugging is done with command: dbg -i .

Code:

global  _start

section .data
    message db "Fibonacci Sequence:", 0x0a

section .text
_start:
    call printMessage   ; print intro message
    call initFib        ; set initial Fib values
    call loopFib        ; calculate Fib numbers
    call Exit           ; Exit the program

printMessage:
    mov rax, 1      ; rax: syscall number 1
    mov rdi, 1      ; rdi: fd 1 for stdout
    mov rsi,message ; rsi: pointer to message
    mov rdx, 20     ; rdx: print length of 20 bytes
    syscall         ; call write syscall to the intro message
    ret

initFib:
    xor rax, rax    ; initialize rax to 0
    xor rbx, rbx    ; initialize rbx to 0
    inc rbx         ; increment rbx to 1
    ret

loopFib:
    add rax, rbx    ; get the next number
    xchg rax, rbx   ; swap values
    cmp rbx, 10		; do rbx - 10
    js loopFib		; jump if result is <0
    ret

Exit:
    mov rax, 60
    mov rdi, 0
    syscall

This is the result from debugging. At the white arrow you can see that it’s after entering the “Exit” function. The white box on the stack seems to me that one of these addresses must be the right answer to the question.

I tried a lot but none of the answers (in different kinds of format) seem to work. Is there something I miss? Thank you in advance for your help! I appreciate it.

Happy Hacking, klmnop

I am stuck on the same question. Have you figured it out?

@ bu5hv1p3r

No not yet, I parked the excercise for now. Hopefully someone in the future reads this question and will be able to help us.

OMFG!

How frustrating. I must have copied and pasted that number in to the solutions box like 16 times.

@klmnop, @bu5hv1p3r, its so dumb. But count the characters in the address you are trying to copy and paste. You will notice something after you do. If you don’t then I suggest typing disas _start and look at the addresses there.
-onthesauce

2 Likes

Thank you so much! That is so dumb. I wonder why it is that way.

No problem! I was thinking the same thing. Maybe GEF does it to save screen space?

That is what I would assume but I have an address of all 0’s and it is the correct length so who knows. Maybe it is some kind of assembly thing that I just do not understand since I am new to this

Great! Good job! Of all the thing I tried this wasn’t one of them! Thanks a lot!

No problem at all!
-onthesauce