function in C # (-) No parameter no return value function

Analysis of functions in C #

First write a small example, a static function, no return value, an invisible parameter

Break breakpoints on line 17th with 20 lines respectively

F5 Debug Run, at this time break in line 17th myfunction (),

Right-click Disassembly in line 17th to see the disassembly code

The call 002D0C30 application here is MyFunction ()

At this point F11 directly into the MyFunction function to see our function

002D2CA0 is MyFunction entrance, here is the question, clearly above call 002D0C30, here why is 002D2CA0?

Go to 002D0C30 on the address bar, result vs prompt cannot specify address, no code at current address ... Fuck VS

Did we just give up? NO ... In another way, attach our console program with a third-party debugger

It is clear that the original first call 002D0C30 this statement, entered is not our function myfunction,

Instead, first enter into the 002D0C30, execute the JMP 002d2ca0 statement, and jump to the real myfunction function entry.

Summary: Call 002d0c30-> 002d0c30 jmp 002d2ca0->002d2ca0 (myfunction real function entry)

Then we analyze the stack, and what we see here is the call stack, and I'm concerned about the current stack.

In fact, the current stack is pressed into the return address after the execution of MyFunction ().

That is the address of the 18th line of code 002D2B00

To verify, go to the Register window and learn that the ESP pointer is pointing to the top of the current stack.

Ok,esp = 06d6ec18, go to memory to see if 06D6EC18 is saved 002d2b00

Summary: The top of the current stack stack is the return address that is stored after the current function is finished executing.

Now take the final step and analyze the function of the disassembly code in the function

002D2CA0 push EBP//Front These two sentences are used to save ESP,
002D2CA1 mov ebp,esp//At this time EBP points to the top of the stack, which can be accessed by [ebp+xx] function parameters
002D2CA3 Push EDI
002D2CA4 push ESI
002D2CA5 push ebx //To save the EDI esi ebx register pressure stack

Sub esp,2ch Allocates temporary variable space, our code is an empty function, there is no temporary variable,

The 2Ch space here is used by the following vs added code

Here's a bunch of debug code with VS generated, and the release code is different.

002d2ca6 Sub Esp,2ch
002d2ca9 XOR EBX,EBX
002d2cab mov dword ptr [EBP-10H],EBX
002d2cae mov dword ptr [EBP-1CH],EBX
002D2CB1 cmp DWORD ptr ds:[0015c7a8h],0
002d2cb8 JE 002d2cbf
002D2CBA Call 71c6cb2d
002D2CBF NOP

The code behind this is the stack balancing process that must be done when the current function returns

002D2CC0 NOP
002D2CC1 Lea Esp,[ebp-0ch]//Let ESP point to the top of the function entrance

The following is a sequence of three registers saved after the entrance and then popped from the stack
002D2CC4 pop ebx
002D2CC5 pop ESI
002D2CC6 Pop EDI
002D2CC7 Pop EBP

RET pops the return address of the top of the stack, changes the EIP, and lets the current CPU jump to the address of the statement myfunction () in the main function.

002D2CC8 ret

To be continued, followed by the second one. function analysis with parameter of return value

function in C # (-) No parameter no return value function