Reverse Assembly _ for statement Disassembly

Reverse Assembly _ for statement Disassembly

　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　By: for example

Chapter 2 of reverse disassembly, for statement Disassembly

Sample Code:

 1 #include"stdio.h"   2 1.int function(int a,int b)   3 2.{   4 3.    int c=a+b;   5 4.    int i;   6 5.    for(i=0;i<50;i++)   7 6.    {   8 7.        c=c+i;   9 8.    }  10 9.    return c;  11 10.}  12 11.void main()  13 12.{  14 13.    function(1,2);  15 14.}   

 

Disassembly:

 

1 #include "stdio.h"2 3 4 int function(int a,int b)5 6 {

 

011d1a40 push EBP 011d1a41 mov EBP, ESP 011d1a43 sub ESP, 0d8h

 

011d1a49 push EBX; save the environment 011d1a4a push ESI; save the environment 011d1a4b push EDI; save the environment   011d1a4c Lea EDI, [ebp-0D8h] 011d1a52 mov ECx, 36 h 011d1a57 mov eax, 0 cccccccch 011d1a5c rep STOs dword ptr es: [EDI]; Initialized to 0xcc

 

1   int c=a+b;

 

011d1a5e mov eax, dword ptr [A] 011d1a61 add eax, dword ptr [B] 011d1a64 mov dword ptr [c], eax; Timeout ;---------------------------------------------------------------------------------------------

1 int i;2 3     for(i=0;i<50;i++)

011d1a67 mov dword ptr [I], 0; I = 0 011d1a6e JMP Function + 39 h (11d1a79h); Jump to judge whether I is greater than 50 011d1a70 mov eax, dword ptr [I]; 011d1a73 add eax, 1; Executed I = I + 1 011d1a76 mov dword ptr [I], eax;; 011d1a79 cmp dword ptr [I], 32 h; Judge whether I is greater than 50 011d1a7d jge Function + 4ah (11d1a8ah)If the value is greater than or equal to 50, the for loop is exceeded; otherwise, the execution continues.

 

1  {               2 3         c=c+i;  

 

011d1a7f mov eax, dword ptr [c]; Executed C = C + I; 011d1a82 add eax, dword ptr [I]; | 011d1a85 mov dword ptr [c], eax; |

}

 

011d1a88 JMP Function + 30 h (11d1a70h); If it is not greater than the jump to the position where I ++ is executed

 

; Success ;---------------------------------------------------------------------------------------------,

 

1  return c;

011d1a8a mov eax, dword ptr [c]

  011d1a8d pop EDI; restore the environment 011d1a8e pop ESI; restore the environment 011d1a8f pop EBX; restore the environment   011d1a90 mov ESP, EBP 011d1a92 pop EBP   011d1a93 RET