Grasping Writer: Li Pengju No.: 20132201(* Original works reproduced please specify the source *)(Study course: "Linux kernel Analysis" MOOC course http://mooc.study.163.com/course/USTC-1000029000)Experimental section (the following command is available for lab building 64-bit Linux virtual machine environment, 32-bit Linux environment may be slightly different)Compile the assembly code using the gcc–s–o main.s main.c-m32 command.The code is as follows:int g (int x) { return8;} int f (int x)
talk about some personal opinions. Next, we will conduct some small tests and explain them in assembly language. You can do it together.
(1) char name [] and char * name
1:
2: void process ()
3 :{
00401020 push ebp
00401021 mov ebp, esp
00401023 sub esp, 4Ch
00401026 push ebx
00401027 push esi
00401028 push edi
00401029 lea edi, [ebp-4Ch]
0040102C mov ecx, 13 h
00401031 mov eax, 0 CCCCCCCCh
00401036 re
Wang Yi Original Works reproduced please specify the source "Linux kernel Analysis" MOOC course http://mooc.study.163.com/course/USTC-1000029000The core of this lesson is to complete the scheduling of the process through the interrupt mechanism, in this course, __init My_start_kernel as an entry function, define the T-PCB structure of process No. 0, copy to make other process TPCB data structure, The interrupt Time function is My_timer_handler periodic call to modify the value of the my_need_sch
", and the above is just the key value of the registry, the bottom line "you can still use this program % d ". In fact, this is the number of times you can use it. There should be a calculator here, but you don't have to worry about it. first go to the code and find a suitable place for breakpoint.004017DA 68 00014300 multi-open push program. 00430100; SOFTWAREAutoSoftMultRun2004017DF 68 02000080 push 80000002004017E4 FF15 0C604200 call dword ptr ds: [......004017FE FF15 08604200 call dword ptr
Stdcall: If you see EBP + a few, you have to ret 4 * n unless the proc uses parameter defined by the pseudo command, the parameter
C add ESP, 8 after caller call addtewo
1. Why sometimes an error occurs when RET is returned: stdcall Convention subprogram addtwo needs to clear parameters
Description of RET 8 (mov ESP, add ESP after EBP ret, 8 clear parameters)
) object User-Defined Function 2 → │ ┃ 24 (?) ...... The object variable of the │ interface was too large and too small to exceed the upper limit.] ━━ ━┓ │ ① 0 (4) the pointer of the interface was → ② 0 (4) * pvtable was → ③? (?) ...... │ ┗ ━ ┛ ┃ ┗ ━━ [[[[[│ ┣ ━━ ━ [Interface 2] ━━ ━ ┫ ┏ [[ [interface 2] ━━ ┓ │ ┃ ...... Too many? (?) ...... ┃ ╰ ── ╯ ① = Varptr (object variable) Address ② = objptr (object variable) '// This pointer address ③: it can only be obtained indirectly through copymemory:
of the function in the function, pointing to the stack bottom (frame bottom) of a function ).
% ESP --- is the stack register, which is equivalent to the base register of the entire program, always pointing to the top of the stack.
Push --- import stack operation.
MoV --- move
Sub --- Subtraction
In the first sentence, push % EBP means % EBP is put into the stack. At this time, % EBP stores the starting address of the frame of the previous function,
is not currently in the running state.;
Sub ESP, 4*4MoV [esp + 12], EBX; save registersMoV [esp + 8], ESI;MoV [esp + 4], EDI;MoV [esp + 0], EBP;MoV EBX, PCR [pcselfpcr]; Set address of PCRMoV EDI, ECx; set old thread addressMoV ESI, EDX; set next thread addressMovzx ECx, by
It is widely used in NAT and IPSec technologies. But in essence, there is a conflict between the two.
1. From the IPsec perspective, IPSec needs to ensure data security, so it encrypts and verifies data.
2. From the perspective of NAT, IP addresses are bound to be modified to complete address translation.
IPSec provides the security of end-to-end IP communication, but there is limited support for IPSec in the NAT environment. Ah must not be able to perform Nat, this is contrary to the concept of
In-depth analysis of the C ++ function call Process
Liu Bing QQ: 44452114
E-mail: liubing2000@foxmail.com
0. Introduction
The function call process is actually an interrupted process. How does C ++ implement a function call? How does a parameter stack, function jump, protection site, and response site be implemented? This article provides an in-depth analysis and explanation of the function call process, and demonstrates it in the VC 6.0 environment. If the analysis is not in place or there ar
int goo(int a, int b){return a + b;}void foo(){int a[] = {1, 2, 3};int result = goo(a[1], a[2]);printf("result: %d", result);}
Compile in vs2010
Foo function assembly:
00EB3890 push ebp 00EB3891 mov ebp,esp 00EB3893 sub esp,0E4h 00EB3899 push ebx 00EB389A push esi 00EB389B push edi 00EB389C lea edi,[ebp-0E4h] 00EB38A2 mov ecx,39h
;}CCall::~CCall(){}int CCall::Call(int arg1, short arg2, char arg3, void *arg4){int var1;short var2;char var3;int *p;var1 = arg1;var2 = arg2;var3 = arg3;p = (int *)arg4;*p = m_Var1;return 0;}There are also portals and global functions:
// Main. cpp... # include
Next we will look at the call process in DEBUG. Note that if it is VS. NET, a DWORD will be added before and after each variable during VC compilation to detect Buffer Overflow.
First, call the void function without return values. Th
Original article address:
Http://net.pku.edu.cn /~ Course/cs201/2004/ASSEMBLY/Workshop
In Win32 compilation, we often deal with APIs. In addition, we often use self-compiled subprograms with parameters similar to APIs, this article describes the concept and Analysis of parameter transfer during the subroutine call process. In a program, the parameter is passed through the stack. That is to say, the caller pushes the parameter to be passed to the subroutine (or called) into the stack, the subrou
*/Task[pid].next= task[pid];/*the next process in the initial process 0 is process 0*/Then three processes were copied, note Task[i].state =-1; / * Initial state of the process, not enforceable */ Task[i].next = task[i-1].next; Task[i-1].next = task[i]; /* */These two lines of code set the way the process is switched, such as process 0 switching to process 1, and process 1 switching to process 2. /*START process 0 by task[0]*/PID=0; My_current_task= Task[pid]; ASMvolatile( "M
Absrtact: Looking back, we found that our interrupt handlers were not written elegantly enough. The interrupt response requires three conditions: the interrupt token in the eflags is open, the interrupt mask register does not block the corresponding interrupt, and the EOI flag is set.
1. Modify the clock interrupt handler: G/kernel/kernel.asm
174 Inc DWORD [K_reenter]
175 CMP DWORD [K_reenter], 0
176 jne. 1; re-entry. 1
177
178 mov ESP
Debug versionESP stack top pointerEBP holds stack pointer Empty program: Int main () { 00411360 push ebp, press into EBP 00411361 mov ebp,esp; EBP = ESP, keep esp, wait for function call to resume, ESP is definitely used in a function call. 00411363 Sub esp,0c0h;
Reference :http://blog.csdn.net/hudashi/article/details/7820338http://shitou7630.blog.163.com/blog/static/32699536201342110155436/Http://www.cnblogs.com/52yixin/archive/2011/06/29/2093634.htmlhttp://blog.csdn.net/mniwc/article/details/7993361Http://www.cnblogs.com/coderzh/archive/2008/12/01/1345053.htmlHttp://blog.sina.com.cn/s/blog_6f6769b50100uhzz.htmlHttps://msdn.microsoft.com/zh-cn/library/ms235286.aspx(Owed by: Spring Night rain Http://blog.csdn.net/chunyexiyu reprint please indicate the so
vtbldiamond ();
If (pvtblreal1! = NULL)
{
Pvtblreal1-> F1 ();
Vtblrealb * ptempvtbb = dynamic_cast
Ptempvtbb-> F1 ();
Delete pvtblreal1;
}
Vtblrealb * pvtbrealb = new vtbldiamond ();
If (pvtbrealb! = NULL)
{
Ivtbl * pvtbl = dynamic_cast
Pvtbl-> F1 ();
Delete pvtbrealb;
}
Return 0;
}
The execution result is as follows:
Let's perform disassembly and debugging to see how the compiler helps us implement it?
Let's look at the initialization of an
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.