\documentclass[twocolumn]{article}

\setlength{\oddsidemargin}{-0.5in}
\setlength{\evensidemargin}{-0.5in}
\setlength{\topmargin}{0.0in}
\setlength{\headheight}{0in}
\setlength{\headsep}{0in}
\setlength{\textwidth}{7.0in}
\setlength{\textheight}{9.5in}
\setlength{\parindent}{0in}
\setlength{\parskip}{0.05in}
\setlength{\columnseprule}{0.3pt}
\usepackage{fancyvrb}
\usepackage{relsize}

\begin{document}

Name: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\textbf{Directions: Work only on this sheet (on both sides, if needed); do not
turn in any supplementary sheets of paper. There is actually plenty of room
for your answers, as long as you organize yourself BEFORE starting writing.
In order to get full credit, SHOW YOUR WORK.}

{\bf 1.} (15) Look at the output of {\bf gcc -S} at the top of p.10 of our
PLN unit on subroutines.  Suppose the author of the last two {\bf movl}
instructions had chosen to use ESP instead of EBP.  Show what those two
instructions would be now.  

{\bf 2.} Look at the second GDB session printout covered by May in the
discussion section.  (It consists of an assembly language program which
sums elements in an array, adapted from the example in Sec. 7 of our PLN
unit on subroutines; output from {\bf as -a}; and a GDB session.)

\begin{itemize}

\item [(a)] (15) When the {\bf ret} is executed, what address will we
return to?

\item [(b)] (10) When the {\bf ret} is executed, the circuitry for that
instruction will look in a certain memory location to determine where to
return to (i.e. the value asked for in part (x) above).  What will be
the address of that location?

\item [(c)] (15) In the GDB session, suppose we had issued the {\bf c}
(``continue'') command, instead of {\bf q} (``quit'').  Then what would
be the address of the first instruction fetch to occur outside our {\bf
.text} segment?

\end{itemize}

{\bf 3.} (10) Recall that {\bf strace} is used like this:

\begin{verbatim}
% strace a.out
\end{verbatim}

Based on knowledge from our course, give an example of a line of
C code which is likely to be in the source code for {\bf strace}.
It must be a system call, and for full credit it must be complete.

{\bf 4.} (35) The assembly language code below searches a string for the
first occurrence of 'a' (guaranteed to exist), and returns the position
of that occurrence (0 for the first character in the string, 1 for the
second, 2 for the third, etc.).  The function {\bf firsta()} is to be
callable from any C program, with this prototype:

\begin{verbatim}
int firsta(char *s);
\end{verbatim}

Fill in the blanks:

\begin{verbatim}
.text
.globl firsta
firsta:
   movl ________, %eax
top:
   cmpb $'a', (%eax)
   jz foundit
   ________
   jmp top
foundit:
   ________
   ret
\end{verbatim}

{\bf Solutions:}

{\bf 1.}

\begin{verbatim}
movl $0, (%esp)
movl $4, (%esp)
\end{verbatim}

{\bf 2.a}  This is what is on the top of the stack at that point,
0x8048084.

{\bf 2.b}  This is the address of the top of the stack at that
point, 0bfffcec4.

{\bf 2.c}  We would continue, executing the two MOV instructions and
then the RET in line 37.  That would pop the stack for the ``return
address,'' when in fact there is no return address on the stack.  What
would be on the stack instead?  Unfortunately, we erred in line 27,
where we should have added 8 to the stack pointer, so the value \$x+4 is
still there.  So, that is where we will ``return'' to--the second word
in the {\bf .data} segment, which is at 0x80490a8.

{\bf 3.}

\begin{verbatim}
execve(argv[1]);
\end{verbatim}

{\bf 4.}

\begin{verbatim}
4(%esp)
incl %eax
subl 4(%esp), %eax
\end{verbatim}

\end{document}