可执行文件的带注释的反汇编

Question

当将C程序编译为目标文件时，很容易让Microsoft编译器使用cl /Fa给您一个带注释的反汇编(带有函数和变量的名称，源行号等)。

我试图从最终链接的可执行文件中获得类似的东西(假设该程序是用适当的调试信息编译的)，这似乎更棘手;dumpbin和objdump似乎只提供无注释的反汇编。

获得这个的最好方法是什么?

Answer 1

如果你用debuginfo编译程序，windbg应该提供带有行号的函数反汇编

使用调试信息编译的示例代码和使用/Fa生成的程序集文件

C:codesnipscomparesrcdebug>cl /Zi /Fa comparesrc.cpp /link /Debug
comparesrc.cpp
/out:comparesrc.exe
/debug
/Debug
comparesrc.obj

上述编译的源代码

C:codesnipscomparesrcdebug>type comparesrc.cpp
#include <stdio.h>  // standard include file
int main (void)
{ // this line will become prolog
    printf("hello my dear source comparen");  // see str in .data section
    puts("c");  // will put a char* with line break to console
    puts("om");
    puts("pare");
    int a,b,c,d;
    a = 2; b =3 ; c = 4;
    d = a+b-c;    // 2+3 -4 = 1
    printf("%dn",d);  // should print 1
    d = (a*b)/c;  // 2*3 /4 = 6 /4  numerator = 1
    printf("%dn",d);  // should printf 1
    d = (a*b)%c;   // 2 * 3 % 4 denominator = 2
    printf("%dn",d);  // should print 2
    return 0;   // lets generate a cod file and see the assembly
}   // this line will get converted to epilog

由/Fa switch创建的程序集文件

C:codesnipscomparesrcdebug>type comparesrc.asm
; Listing generated by Microsoft (R) Optimizing Compiler Version 16.00.30319.01

        TITLE   C:codesnipscomparesrcdebugcomparesrc.cpp
        .686P
        .XMM
        include listing.inc
        .model  flat
INCLUDELIB LIBCMT
INCLUDELIB OLDNAMES
CONST   SEGMENT
$SG3850 DB      'hello my dear source compare', 0aH, 00H
        ORG $+2
$SG3851 DB      'c', 00H
        ORG $+2
$SG3852 DB      'om', 00H
        ORG $+1
$SG3853 DB      'pare', 00H
        ORG $+3
$SG3858 DB      '%d', 0aH, 00H
$SG3859 DB      '%d', 0aH, 00H
$SG3860 DB      '%d', 0aH, 00H
CONST   ENDS
PUBLIC  _main
EXTRN   _puts:PROC
EXTRN   _printf:PROC
; Function compile flags: /Odtp
_TEXT   SEGMENT
_c$ = -16                                               ; size = 4
_d$ = -12                                               ; size = 4
_b$ = -8                                                ; size = 4
_a$ = -4                                                ; size = 4
_main   PROC
; File c:codesnipscomparesrcdebugcomparesrc.cpp
; Line 3
        push    ebp
        mov     ebp, esp
        sub     esp, 16                                 ; 00000010H
; Line 4
        push    OFFSET $SG3850
        call    _printf
        add     esp, 4
; Line 5
        push    OFFSET $SG3851
        call    _puts
        add     esp, 4
; Line 6
        push    OFFSET $SG3852
        call    _puts
        add     esp, 4
; Line 7
        push    OFFSET $SG3853
        call    _puts
        add     esp, 4
; Line 9
        mov     DWORD PTR _a$[ebp], 2
        mov     DWORD PTR _b$[ebp], 3
        mov     DWORD PTR _c$[ebp], 4
; Line 10
        mov     eax, DWORD PTR _a$[ebp]
        add     eax, DWORD PTR _b$[ebp]
        sub     eax, DWORD PTR _c$[ebp]
        mov     DWORD PTR _d$[ebp], eax
; Line 11
        mov     ecx, DWORD PTR _d$[ebp]
        push    ecx
        push    OFFSET $SG3858
        call    _printf
        add     esp, 8
; Line 12
        mov     eax, DWORD PTR _a$[ebp]
        imul    eax, DWORD PTR _b$[ebp]
        cdq
        idiv    DWORD PTR _c$[ebp]
        mov     DWORD PTR _d$[ebp], eax
; Line 13
        mov     edx, DWORD PTR _d$[ebp]
        push    edx
        push    OFFSET $SG3859
        call    _printf
        add     esp, 8
; Line 14
        mov     eax, DWORD PTR _a$[ebp]
        imul    eax, DWORD PTR _b$[ebp]
        cdq
        idiv    DWORD PTR _c$[ebp]
        mov     DWORD PTR _d$[ebp], edx
; Line 15
        mov     eax, DWORD PTR _d$[ebp]
        push    eax
        push    OFFSET $SG3860
        call    _printf
        add     esp, 8
; Line 16
        xor     eax, eax
; Line 17
        mov     esp, ebp
        pop     ebp
        ret     0
_main   ENDP
_TEXT   ENDS
END

最后使用CDB (windbg的控制台版本)反汇编完整的主函数

国开行- c".lines; g主要佛罗里达大学@eip;问;"comparesrc.exe

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86    
CommandLine: comparesrc.exe    
0:000> cdb: Reading initial command '.lines;g main;uf @eip;q;'    
Line number information will be loaded
comparesrc!main [c:codesnipscomparesrcdebugcomparesrc.cpp @ 3]:
    3 00401010 55              push    ebp
    3 00401011 8bec            mov     ebp,esp
    3 00401013 83ec10          sub     esp,10h
    4 00401016 685c8c4100      push    offset comparesrc!__xt_z+0x120 (00418c5c)
    4 0040101b e81b020000      call    comparesrc!printf (0040123b)
    4 00401020 83c404          add     esp,4
    5 00401023 687c8c4100      push    offset comparesrc!__xt_z+0x140 (00418c7c)
    5 00401028 e8bf000000      call    comparesrc!puts (004010ec)
    5 0040102d 83c404          add     esp,4
    6 00401030 68808c4100      push    offset comparesrc!__xt_z+0x144 (00418c80)
    6 00401035 e8b2000000      call    comparesrc!puts (004010ec)
    6 0040103a 83c404          add     esp,4
    7 0040103d 68848c4100      push    offset comparesrc!__xt_z+0x148 (00418c84)
    7 00401042 e8a5000000      call    comparesrc!puts (004010ec)
    7 00401047 83c404          add     esp,4
    9 0040104a c745fc02000000  mov     dword ptr [ebp-4],2
    9 00401051 c745f803000000  mov     dword ptr [ebp-8],3
    9 00401058 c745f004000000  mov     dword ptr [ebp-10h],4
   10 0040105f 8b45fc          mov     eax,dword ptr [ebp-4]
   10 00401062 0345f8          add     eax,dword ptr [ebp-8]
   10 00401065 2b45f0          sub     eax,dword ptr [ebp-10h]
   10 00401068 8945f4          mov     dword ptr [ebp-0Ch],eax
   11 0040106b 8b4df4          mov     ecx,dword ptr [ebp-0Ch]
   11 0040106e 51              push    ecx
   11 0040106f 688c8c4100      push    offset comparesrc!__xt_z+0x150 (00418c8c)
   11 00401074 e8c2010000      call    comparesrc!printf (0040123b)
   11 00401079 83c408          add     esp,8
   12 0040107c 8b45fc          mov     eax,dword ptr [ebp-4]
   12 0040107f 0faf45f8        imul    eax,dword ptr [ebp-8]
   12 00401083 99              cdq
   12 00401084 f77df0          idiv    eax,dword ptr [ebp-10h]
   12 00401087 8945f4          mov     dword ptr [ebp-0Ch],eax
   13 0040108a 8b55f4          mov     edx,dword ptr [ebp-0Ch]
   13 0040108d 52              push    edx
   13 0040108e 68908c4100      push    offset comparesrc!__xt_z+0x154 (00418c90)
   13 00401093 e8a3010000      call    comparesrc!printf (0040123b)
   13 00401098 83c408          add     esp,8
   14 0040109b 8b45fc          mov     eax,dword ptr [ebp-4]
   14 0040109e 0faf45f8        imul    eax,dword ptr [ebp-8]
   14 004010a2 99              cdq
   14 004010a3 f77df0          idiv    eax,dword ptr [ebp-10h]
   14 004010a6 8955f4          mov     dword ptr [ebp-0Ch],edx
   15 004010a9 8b45f4          mov     eax,dword ptr [ebp-0Ch]
   15 004010ac 50              push    eax
   15 004010ad 68948c4100      push    offset comparesrc!__xt_z+0x158 (00418c94)
   15 004010b2 e884010000      call    comparesrc!printf (0040123b)
   15 004010b7 83c408          add     esp,8
   16 004010ba 33c0            xor     eax,eax
   17 004010bc 8be5            mov     esp,ebp
   17 004010be 5d              pop     ebp
   17 004010bf c3              ret

Answer 2

可以使用

Windbg -z <any image> 

对该映像执行反汇编或任何检查(也适用于CDB kd)。您可以看到源代码行，符号，类型-无需实际运行程序。

这在查看dll时很有用，但是当您想要查看为另一种体系结构编译的代码或无法在您的机器上运行的设备驱动程序时，这是非常必要的。

例如

cdb -z ntoskrnl.exe

将允许您检查Windows内核的代码。

这比崩溃转储更强大，因为您不仅可以看到页面中的代码-您可以看到所有代码，这些代码位于。exe