$ gc -heap --app ex4 --once
$ gc -heap --unlive ex4
$ heapdump -p ex4
Step 2:
Use JHex to decompile the compiled ex4 code
$ jhex ex4
> ex4
> ex4.mq4
The JHex output looks like this (look at the top-most symbol: 'P'):
0x000003da 48 P: (Int32)0
Notice that it has the memory location 0x000003da. Then I parse it and get:
int32__I64 - int32
To get the value, I decode it to a 64-bit integer. It's:
0x80000000
This time, this is not a JMP instruction. This is a relocation! It points to the exact memory location of the main (top-most) method. In this case, it points to a 64-bit integer literal.
Step 3:
Use JHex to decompile the decompiled ex4 code
$ jhex ex4.mq4
It would produce the following result:
A few things:
1) This is the second relocation in the decompiled code.
2) Notice that the offset is calculated from the location of the main method. It's 0x000003da. This is the start of the original method.
3) The offset is added to the start address of the main method to get the address of the original method
Related links:
Comentarios