<深入理解電腦系統> 通過程式的機器級表示來理解函數棧

標籤：

C源碼:

void swap(int *a,int *b){   int c;   c = *a;    *a = *b;   *b = c;}int main(void){   int a ;   int b ;   int ret;   a =16;   b = 64;   ret = 0;   swap(&a,&b);   ret = a - b;   return ret;}

編譯:

gcc -g func_stack.c -o a.outobjdump -dS a.out > main.dump

可以得到反組譯碼的組譯工具main.dump, 有對應的C程式,如下所示:

a.out：     檔案格式 elf32-i386Disassembly of section .init:08048294 <_init>: 8048294:53                   push   %ebx 8048295:83 ec 08             sub    $0x8,%esp 8048298:e8 83 00 00 00       call   8048320 <__x86.get_pc_thunk.bx> 804829d:81 c3 63 1d 00 00    add    $0x1d63,%ebx 80482a3:8b 83 fc ff ff ff    mov    -0x4(%ebx),%eax 80482a9:85 c0                test   %eax,%eax 80482ab:74 05                je     80482b2 <_init+0x1e> 80482ad:e8 1e 00 00 00       call   80482d0 <[email protected]> 80482b2:83 c4 08             add    $0x8,%esp 80482b5:5b                   pop    %ebx 80482b6:c3                   ret    Disassembly of section .plt:080482c0 <[email protected]>: 80482c0:ff 35 04 a0 04 08    pushl  0x804a004 80482c6:ff 25 08 a0 04 08    jmp    *0x804a008 80482cc:00 00                add    %al,(%eax)...080482d0 <[email protected]>: 80482d0:ff 25 0c a0 04 08    jmp    *0x804a00c 80482d6:68 00 00 00 00       push   $0x0 80482db:e9 e0 ff ff ff       jmp    80482c0 <_init+0x2c>080482e0 <[email protected]>: 80482e0:ff 25 10 a0 04 08    jmp    *0x804a010 80482e6:68 08 00 00 00       push   $0x8 80482eb:e9 d0 ff ff ff       jmp    80482c0 <_init+0x2c>Disassembly of section .text:080482f0 <_start>: 80482f0:31 ed                xor    %ebp,%ebp 80482f2:5e                   pop    %esi 80482f3:89 e1                mov    %esp,%ecx 80482f5:83 e4 f0             and    $0xfffffff0,%esp 80482f8:50                   push   %eax 80482f9:54                   push   %esp 80482fa:52                   push   %edx 80482fb:68 c0 84 04 08       push   $0x80484c0 8048300:68 50 84 04 08       push   $0x8048450 8048305:51                   push   %ecx 8048306:56                   push   %esi 8048307:68 0f 84 04 08       push   $0x804840f 804830c:e8 cf ff ff ff       call   80482e0 <[email protected]> 8048311:f4                   hlt     8048312:66 90                xchg   %ax,%ax 8048314:66 90                xchg   %ax,%ax 8048316:66 90                xchg   %ax,%ax 8048318:66 90                xchg   %ax,%ax 804831a:66 90                xchg   %ax,%ax 804831c:66 90                xchg   %ax,%ax 804831e:66 90                xchg   %ax,%ax08048320 <__x86.get_pc_thunk.bx>: 8048320:8b 1c 24             mov    (%esp),%ebx 8048323:c3                   ret     8048324:66 90                xchg   %ax,%ax 8048326:66 90                xchg   %ax,%ax 8048328:66 90                xchg   %ax,%ax 804832a:66 90                xchg   %ax,%ax 804832c:66 90                xchg   %ax,%ax 804832e:66 90                xchg   %ax,%ax08048330 <deregister_tm_clones>: 8048330:b8 1f a0 04 08       mov    $0x804a01f,%eax 8048335:2d 1c a0 04 08       sub    $0x804a01c,%eax 804833a:83 f8 06             cmp    $0x6,%eax 804833d:77 01                ja     8048340 <deregister_tm_clones+0x10> 804833f:c3                   ret     8048340:b8 00 00 00 00       mov    $0x0,%eax 8048345:85 c0                test   %eax,%eax 8048347:74 f6                je     804833f <deregister_tm_clones+0xf> 8048349:55                   push   %ebp 804834a:89 e5                mov    %esp,%ebp 804834c:83 ec 18             sub    $0x18,%esp 804834f:c7 04 24 1c a0 04 08 movl   $0x804a01c,(%esp) 8048356:ff d0                call   *%eax 8048358:c9                   leave   8048359:c3                   ret     804835a:8d b6 00 00 00 00    lea    0x0(%esi),%esi08048360 <register_tm_clones>: 8048360:b8 1c a0 04 08       mov    $0x804a01c,%eax 8048365:2d 1c a0 04 08       sub    $0x804a01c,%eax 804836a:c1 f8 02             sar    $0x2,%eax 804836d:89 c2                mov    %eax,%edx 804836f:c1 ea 1f             shr    $0x1f,%edx 8048372:01 d0                add    %edx,%eax 8048374:d1 f8                sar    %eax 8048376:75 01                jne    8048379 <register_tm_clones+0x19> 8048378:c3                   ret     8048379:ba 00 00 00 00       mov    $0x0,%edx 804837e:85 d2                test   %edx,%edx 8048380:74 f6                je     8048378 <register_tm_clones+0x18> 8048382:55                   push   %ebp 8048383:89 e5                mov    %esp,%ebp 8048385:83 ec 18             sub    $0x18,%esp 8048388:89 44 24 04          mov    %eax,0x4(%esp) 804838c:c7 04 24 1c a0 04 08 movl   $0x804a01c,(%esp) 8048393:ff d2                call   *%edx 8048395:c9                   leave   8048396:c3                   ret     8048397:89 f6                mov    %esi,%esi 8048399:8d bc 27 00 00 00 00 lea    0x0(%edi,%eiz,1),%edi080483a0 <__do_global_dtors_aux>: 80483a0:80 3d 1c a0 04 08 00 cmpb   $0x0,0x804a01c 80483a7:75 13                jne    80483bc <__do_global_dtors_aux+0x1c> 80483a9:55                   push   %ebp 80483aa:89 e5                mov    %esp,%ebp 80483ac:83 ec 08             sub    $0x8,%esp 80483af:e8 7c ff ff ff       call   8048330 <deregister_tm_clones> 80483b4:c6 05 1c a0 04 08 01 movb   $0x1,0x804a01c 80483bb:c9                   leave   80483bc:f3 c3                repz ret  80483be:66 90                xchg   %ax,%ax080483c0 <frame_dummy>: 80483c0:a1 10 9f 04 08       mov    0x8049f10,%eax 80483c5:85 c0                test   %eax,%eax 80483c7:74 1f                je     80483e8 <frame_dummy+0x28> 80483c9:b8 00 00 00 00       mov    $0x0,%eax 80483ce:85 c0                test   %eax,%eax 80483d0:74 16                je     80483e8 <frame_dummy+0x28> 80483d2:55                   push   %ebp 80483d3:89 e5                mov    %esp,%ebp 80483d5:83 ec 18             sub    $0x18,%esp 80483d8:c7 04 24 10 9f 04 08 movl   $0x8049f10,(%esp) 80483df:ff d0                call   *%eax 80483e1:c9                   leave   80483e2:e9 79 ff ff ff       jmp    8048360 <register_tm_clones> 80483e7:90                   nop 80483e8:e9 73 ff ff ff       jmp    8048360 <register_tm_clones>080483ed <swap>:/*main.c代碼：*/void swap(int *a,int *b){ 80483ed:55                   push   %ebp 80483ee:89 e5                mov    %esp,%ebp 80483f0:83 ec 10             sub    $0x10,%esp   int c;   c = *a;  80483f3:8b 45 08             mov    0x8(%ebp),%eax 80483f6:8b 00                mov    (%eax),%eax 80483f8:89 45 fc             mov    %eax,-0x4(%ebp)   *a = *b; 80483fb:8b 45 0c             mov    0xc(%ebp),%eax 80483fe:8b 10                mov    (%eax),%edx 8048400:8b 45 08             mov    0x8(%ebp),%eax 8048403:89 10                mov    %edx,(%eax)   *b = c; 8048405:8b 45 0c             mov    0xc(%ebp),%eax 8048408:8b 55 fc             mov    -0x4(%ebp),%edx 804840b:89 10                mov    %edx,(%eax)} 804840d:c9                   leave   804840e:c3                   ret    0804840f <main>:int main(void){ 804840f:55                   push   %ebp 8048410:89 e5                mov    %esp,%ebp 8048412:83 ec 18             sub    $0x18,%esp   int a ;   int b ;   int ret;   a =16; 8048415:c7 45 f4 10 00 00 00 movl   $0x10,-0xc(%ebp)   b = 64; 804841c:c7 45 f8 40 00 00 00 movl   $0x40,-0x8(%ebp)   ret = 0; 8048423:c7 45 fc 00 00 00 00 movl   $0x0,-0x4(%ebp)   swap(&a,&b); 804842a:8d 45 f8             lea    -0x8(%ebp),%eax 804842d:89 44 24 04          mov    %eax,0x4(%esp) 8048431:8d 45 f4             lea    -0xc(%ebp),%eax 8048434:89 04 24             mov    %eax,(%esp) 8048437:e8 b1 ff ff ff       call   80483ed <swap>   ret = a - b; 804843c:8b 55 f4             mov    -0xc(%ebp),%edx 804843f:8b 45 f8             mov    -0x8(%ebp),%eax 8048442:29 c2                sub    %eax,%edx 8048444:89 d0                mov    %edx,%eax 8048446:89 45 fc             mov    %eax,-0x4(%ebp)   return ret; 8048449:8b 45 fc             mov    -0x4(%ebp),%eax} 804844c:c9                   leave   804844d:c3                   ret     804844e:66 90                xchg   %ax,%ax08048450 <__libc_csu_init>: 8048450:55                   push   %ebp 8048451:57                   push   %edi 8048452:31 ff                xor    %edi,%edi 8048454:56                   push   %esi 8048455:53                   push   %ebx 8048456:e8 c5 fe ff ff       call   8048320 <__x86.get_pc_thunk.bx> 804845b:81 c3 a5 1b 00 00    add    $0x1ba5,%ebx 8048461:83 ec 1c             sub    $0x1c,%esp 8048464:8b 6c 24 30          mov    0x30(%esp),%ebp 8048468:8d b3 0c ff ff ff    lea    -0xf4(%ebx),%esi 804846e:e8 21 fe ff ff       call   8048294 <_init> 8048473:8d 83 08 ff ff ff    lea    -0xf8(%ebx),%eax 8048479:29 c6                sub    %eax,%esi 804847b:c1 fe 02             sar    $0x2,%esi 804847e:85 f6                test   %esi,%esi 8048480:74 27                je     80484a9 <__libc_csu_init+0x59> 8048482:8d b6 00 00 00 00    lea    0x0(%esi),%esi 8048488:8b 44 24 38          mov    0x38(%esp),%eax 804848c:89 2c 24             mov    %ebp,(%esp) 804848f:89 44 24 08          mov    %eax,0x8(%esp) 8048493:8b 44 24 34          mov    0x34(%esp),%eax 8048497:89 44 24 04          mov    %eax,0x4(%esp) 804849b:ff 94 bb 08 ff ff ff call   *-0xf8(%ebx,%edi,4) 80484a2:83 c7 01             add    $0x1,%edi 80484a5:39 f7                cmp    %esi,%edi 80484a7:75 df                jne    8048488 <__libc_csu_init+0x38> 80484a9:83 c4 1c             add    $0x1c,%esp 80484ac:5b                   pop    %ebx 80484ad:5e                   pop    %esi 80484ae:5f                   pop    %edi 80484af:5d                   pop    %ebp 80484b0:c3                   ret     80484b1:eb 0d                jmp    80484c0 <__libc_csu_fini> 80484b3:90                   nop 80484b4:90                   nop 80484b5:90                   nop 80484b6:90                   nop 80484b7:90                   nop 80484b8:90                   nop 80484b9:90                   nop 80484ba:90                   nop 80484bb:90                   nop 80484bc:90                   nop 80484bd:90                   nop 80484be:90                   nop 80484bf:90                   nop080484c0 <__libc_csu_fini>: 80484c0:f3 c3                repz ret Disassembly of section .fini:080484c4 <_fini>: 80484c4:53                   push   %ebx 80484c5:83 ec 08             sub    $0x8,%esp 80484c8:e8 53 fe ff ff       call   8048320 <__x86.get_pc_thunk.bx> 80484cd:81 c3 33 1b 00 00    add    $0x1b33,%ebx 80484d3:83 c4 08             add    $0x8,%esp 80484d6:5b                   pop    %ebx 80484d7:c3                   ret    

下面將根據main/swap/start來講述對應的彙編代碼,來理解系統的函數棧是怎麼調用的.

-------待續---------------------

參考:

點擊開啟連結

點擊開啟連結

<深入理解電腦系統> 通過程式的機器級表示來理解函數棧