汇编堆栈3函数

Question

aduna2:
.LFB0:
.cfi_startproc
    push    ebp
.cfi_def_cfa_offset 8
.cfi_offset 5, -8
    mov ebp, esp
.cfi_def_cfa_register 5
    sub esp, 16
    mov DWORD PTR [ebp-4], 10
    mov eax, DWORD PTR [ebp+12]
    mov edx, DWORD PTR [ebp+8]
    add edx, eax
    mov eax, DWORD PTR [ebp+16]
    add edx, eax
    mov eax, DWORD PTR [ebp-4]
    add eax, edx
    leave
aduna:
.LFB1:
.cfi_startproc
    push    ebp
.cfi_def_cfa_offset 8
.cfi_offset 5, -8
    mov ebp, esp
.cfi_def_cfa_register 5
    sub esp, 28
    mov DWORD PTR [ebp-4], 7
    mov eax, DWORD PTR [ebp-4]
    mov DWORD PTR [esp+8], eax
    mov eax, DWORD PTR [ebp+12]
    mov DWORD PTR [esp+4], eax
    mov eax, DWORD PTR [ebp+8]
    mov DWORD PTR [esp], eax
    call    aduna2
    leave
main:
.LFB2:
.cfi_startproc
    push    ebp
.cfi_def_cfa_offset 8
.cfi_offset 5, -8
    mov ebp, esp
.cfi_def_cfa_register 5
    and esp, -16
    sub esp, 16
    mov DWORD PTR [esp+4], 6
    mov DWORD PTR [esp], 5
    call    aduna
    mov DWORD PTR [esp+4], eax
    mov DWORD PTR [esp], OFFSET FLAT:.LC0
    call    printf
    leave

我在这段代码中有以下问题:主要是我不能弄清楚esp的位置，当sub esp 16相对于ebp。我在"adunare"one_answers"adunare2"中有这个问题，我不知道它相对于ebp在哪里。我无法为这个程序绘制堆栈，因为在"adunare2"中我得到ebp+8,ebp+12,ebp+16时，我的所有堆栈都卡住了。给我看一个会很有帮助，因为我不明白是怎么回事。在每次调用时都插入一个返回地址?如果在"adunare2"中是，您如何使用+8，+12，+16获得提到的参数?

下面是c代码:

#include<stdio.h>
int aduna2(int a,int b,int c) 
{
    int d=10;
    return a+b+c+d;
}
int aduna(int a,int b)
{
    int c=7;
    return aduna2(a,b,c);
}
int main()
{
    printf("%dn",aduna(5,6));
}

Answer 1

即使从不完整的反汇编，我想我可以回答"什么是主要与堆栈之前aduna":

main:
    ; store old ebp value into stack (to restore it before return)
    push  ebp
    mov   ebp, esp   ; copy current value of esp to ebp

此时esp和ebp都有相同的值，指向当前堆栈的顶部，假设它是0x0054，那么(堆栈)内存看起来像这样:

address | value
-----------------
0x0050  | ????
0x0054  | old_ebp           <- esp/ebp pointing here
0x0058  | return address to "main" caller
0x005C  | whatever was already in stack before calling main

然后代码继续为"aduna"函数准备参数:

    and   esp, -16     ; -16 = 0xFFFFFFF0 -> makes esp 16B aligned
       ; esp here is 0x0050
    sub   esp, 16      ; make room at top of stack for 16B, esp = 0x0040
       ; store the arguments into the stack
    mov   DWORD PTR [esp+4], 6   ; at 0x0044 goes value 6
    mov   DWORD PTR [esp], 5     ; at 0x0040 goes value 5
    call  aduna                  ; call aduna

现在，在输入aduna后，ebp/esp和堆栈内存看起来像这样:

ebp = still 0x0054, nothing did modify it
esp = 0x003C (call did pust return address at top of stack)
address | value
-----------------
0x0038  | ????
0x003C  | return address to instruction after "call aduna" <- esp
0x0040  | 5
0x0044  | 6
0x0048  | ????
0x004C  | ????
0x0050  | ????
0x0054  | old_ebp           <- ebp pointing here
0x0058  | return address to "main" caller
0x005C  | whatever was already in stack before calling main

并且aduna以序码push ebp mov ebp, esp开始，因此堆栈顶部将改变一个位:

address | value
-----------------
0x0038  | 0x0054  <- both esp and ebp pointing here (= 0x0038)
0x003C  | return address to instruction after "call aduna"
0x0040  | 5
0x0044  | 6

所以mov eax, DWORD PTR [ebp+12]将获取地址0x0044 (0x38 + 0x0C = 0x44)，存储6。ebp+8指向值5。aduna中的esp/ebp组合的其余部分在此以下，进入局部变量(驻留在内存的"堆栈"部分)，我不打算描述，因为一旦你理解了这个初始部分，你应该能够破译它的其余部分。

对于leave，检查指令集手册(它会改变esp和ebp)。缺失的ret也很重要，改变esp也是如此。