我正在尝试实现一个链表,该链表将在遇到调用/返回程序集指令时存储内存地址。这通过解析程序集的每一行并且仅在遇到调用或返回指令时才断开函数来递归工作。到目前为止,这适用于调用指令,这意味着返回地址保存在链表中的节点中,但是当尝试在返回指令期间检索此值时,数据丢失了(意味着链表现在是空的(。这是我正在使用的内容:
struct ret_addr {
int address;
struct ret_addr *nxt;
};
struct ret_addr *ret_data(cs_insn *insn, struct ret_addr **head) {
struct ret_addr *r = malloc(sizeof(*r));
r->address = insn->address + insn->size;
r->nxt = (*head);
(*head) = r;
return r;
}
struct bb_data *disassemble_function_cfg(int startAddr, unsigned char *bytes, int end_section) {
csh handle;
cs_insn *insn;
cs_detail *detail;
cs_x86 *x86;
size_t count;
int stop_disasm = 0;
struct bb_data *edges = NULL;
struct ret_addr *ret_edge = NULL;
count = cs_disasm(handle, bytes, end_section, startAddr, 1, &insn);
detail = insn->detail;
for(int n = 0; n < detail->groups_count; n++) {
//break when encountering a call instruction
if(detail->groups[n] == X86_GRP_CALL) {
stop_disasm = 1;
vector_new(edges);
edges = call_insn(handle, x86, insn, vector_back(edges));
ret_edge = ret_data(insn, &ret_edge);
}
//break when encountering a return instruction
else if(detail->groups[n] == X86_GRP_RET) {
stop_disasm = 1;
vector_new(edges);
edges = ret_insn(insn, edges, &ret_edge);
}
}
if(!stop_disasm) {
disassemble_function_cfg(insn->address + insn->size, bytes + insn->size, end_section);
}
else {
return edges;
}
}
您不会在递归调用之间保留列表。您可能想要执行的操作:
struct bb_data *disassemble_function_cfg(struct ret_addr **ret_edge, int startAddr, unsigned char *bytes, int end_section)
{
...
if(*ret_edge == NULL) *ret_edge = ret_data(insn, ret_edge);
...
}