2023年6月22日 03:11:12go评论119阅读模式

英文:

Explanation needed for this assembler code

问题

以下是代码的翻译：

这是C代码：

void test_function(int a, int b, int c, int d) 
{
int flag;
char buffer[10];
flag = 31337;
buffer[0] = 'A';
}
int main() 
{
test_function(1, 2, 3, 4);
}

test_function的汇编代码：

test_function函数的汇编代码：
0x08048344 <test_function+0>: push ebp
0x08048345 <test_function+1>: mov ebp,esp
0x08048347 <test_function+3>: sub esp,0x28
0x0804834a <test_function+6>: mov DWORD PTR [ebp-12],0x7a69
0x08048351 <test_function+13>: mov BYTE PTR [ebp-40],0x41
0x08048355 <test_function+17>: leave
0x08048356 <test_function+18>: ret

我是新手，所以脑中有一些问题。

我认为汇编代码的前三行是函数的前导部分。它将ebp推入堆栈，然后将esp的值复制给ebp。然而，我不明白为什么esp要在内存中向后移动40个字节。
它将31337放入ebp-12中，但为什么确切是ebp-12，它是否表示flag的内存？看起来似乎不是，因为底部标记为(2)的位置被指定为flag的内存。
在"x/16xw $esp"之后，除了左边带有数字的内存之外，不带任何数字的其他内存是什么，因为带有数字的内存代表局部变量、参数和sfp？

英文:

This is the c code:

void test_function(int a, int b, int c, int d) 
{
int flag;
char buffer[10];
flag = 31337;
buffer[0] = &#39;A&#39;;
}
int main() 
{
test_function(1, 2, 3, 4);
}

Assembly of test_function:

Dump of assembler code for function test_function:
0x08048344 &lt;test_function+0&gt;: push ebp
0x08048345 &lt;test_function+1&gt;: mov ebp,esp
0x08048347 &lt;test_function+3&gt;: sub esp,0x28
0x0804834a &lt;test_function+6&gt;: mov DWORD PTR [ebp-12],0x7a69
0x08048351 &lt;test_function+13&gt;: mov BYTE PTR [ebp-40],0x41
0x08048355 &lt;test_function+17&gt;: leave
0x08048356 &lt;test_function+18&gt;: ret

End of assembler dump.
(gdb) print $ebp-12
$1 = (void *) 0xbffff7dc
(gdb) print $ebp-40
$2 = (void *) 0xbffff7c0
(gdb) x/16xw $esp
0xbffff7c0: (1)0x00000000 0x08049548 0xbffff7d8 0x08048249
0xbffff7d0: 0xb7f9f729 0xb7fd6ff4 0xbffff808 0x080483b9
0xbffff7e0: 0xb7fd6ff4 (2)0xbffff89c (3)0xbffff808 (4)0x0804838b
0xbffff7f0: (5)0x00000001 0x00000002 0x00000003 0x00000004

I'm new to these topics; therefore, some questions exist in my head.

I suppose first 3 lines of the assembler code is prologue. It pushes ebp, then copies esp to ebt. However, I didn't understand why esp goes back 40 bytes in memory.
It puts 31337 into ebp-12,but why is it exactly ebp-12 and does it represent the flag's memory?
It seems it does not since at the bottom, (2) is designated as flag's memory.
Below "x/16xw $esp", what are the other memories not including any (number) on the left since the memories with numbers represents local variables, parameters,and sfp?

答案1

得分: 0

问题描述：

```plaintext
它将ebp推入堆栈，然后将esp复制到ebt

ebt错误，没有名为ebt的寄存器。应该是ebp。

push ebp

这个命令是为了在调用test_function函数之前保护堆栈底部。

mov ebp, esp
sub esp, 0x28

这个命令是为了增加堆栈以分配新的内存块来存储test_function函数执行期间的值。堆栈的大小增加不是固定的，不会始终为0x28。这个值由编译器计算，确保大小合适。

mov DWORD PTR [ebp-12], 0x7a69

对应于flag = 31337，flag的地址等于ebp-12的值。地址由编译器分配。DWORD对应于int。十六进制数0x7a69等于十进制数31337。

以及

mov BYTE PTR [ebp-40], 0x41

相同。十六进制数0x41等于十进制数65。字节对应于char。

下面的代码

(gdb) x/16xw $esp
0xbffff7c0: (1)0x00000000 0x08049548 0xbffff7d8 0x08048249
0xbffff7d0: 0xb7f9f729 0xb7fd6ff4 0xbffff808 0x080483b9
0xbffff7e0: 0xb7fd6ff4 (2)0xbffff89c (3)0xbffff808 (4)0x0804838b
0xbffff7f0: (5)0x00000001 0x00000002 0x00000003 0x00000004

例如，左侧代码的0xbffff7c0是地址，其值为0x00000000。因此，0xbffff7c4（0xbffff7c4 = 0xbffff7c0 + 4）地址的值为0x08049548，因为0x00000000占用4个字节。0xbffff7c8地址的值为0xbffff7d8。...

我认为下面的汇编代码

函数test_function的汇编代码转储：
0x08048344 <test_function+0>: push ebp
0x08048345 <test_function+1>: mov ebp, esp
0x08048347 <test_function+3>: sub esp, 0x28
0x0804834a <test_function+6>: mov DWORD PTR [ebp-12], 0x7a69
0x08048351 <test_function+13>: mov BYTE PTR [ebp-40], 0x41
0x08048355 <test_function+17>: leave
0x08048356 <test_function+18>: ret

可以转换为以下代码（如@Peter Cordes指出，"leave"等于"mov esp, ebp" + "pop ebp"，请参见https://www.felixcloutier.com/x86/leave）

函数test_function的汇编代码转储：
0x08048344 <test_function+0>: push ebp
0x08048345 <test_function+1>: mov ebp, esp
0x08048347 <test_function+3>: sub esp, 0x28
0x0804834a <test_function+6>: mov DWORD PTR [ebp-12], 0x7a69
0x08048351 <test_function+13>: mov BYTE PTR [ebp-40], 0x41
                               mov esp, ebp   // 这里改变了
                               pop ebp       // 这里改变了
0x08048356 <test_function+18>: ret

局部变量存储在堆栈中。

因此，我们可以得到以下图像：


<details>
<summary>英文:</summary>

You problem

It pushes ebp, then copies esp to ebt

ebt is wrong, there is no register that called ebt. It is should be ebp.

push ebp

the command is for preserve the stack bottom before calling the test_function function.

mov ebp,esp
sub esp,0x28

the command is for increase the stack to allocate a new block of memory for storing values during the execution of test_function function. And the size of the stack increase is not fixed and will not always be 0x28. This value is calculated by the compiler, which ensures that the size is suitable.

mov DWORD PTR [ebp-12],0x7a69

corresponds to flag = 31337,flag address is equal to ebp-12&#39;s value. The address is assigned by the compiler. DWORD corresponds to int.The hexadecimal number 0x7a69 is equivalent to the decimal number 31337.

And

mov BYTE PTR [ebp-40],0x41

the same as. The hexadecimal number 0x41 is equivalent to the decimal number 65. The decimal value of the ASCII code for the letter A is the decimal number 65. BYTE corresponds to char.

Below code

(gdb) x/16xw $esp
0xbffff7c0: (1)0x00000000 0x08049548 0xbffff7d8 0x08048249
0xbffff7d0: 0xb7f9f729 0xb7fd6ff4 0xbffff808 0x080483b9
0xbffff7e0: 0xb7fd6ff4 (2)0xbffff89c (3)0xbffff808 (4)0x0804838b
0xbffff7f0: (5)0x00000001 0x00000002 0x00000003 0x00000004

Such as 0xbffff7c0: of left code is address,it&#39; value is 0x00000000. So 0xbffff7c4(0xbffff7c4 = 0xbffff7c0 + 4) address&#39;s value is 0x08049548, because 0x00000000 occupies 4 bytes. 0xbffff7c8 address&#39;s value is 0xbffff7d8. ....



I think below assembler code

Dump of assembler code for function test_function:
0x08048344 <test_function+0>: push ebp
0x08048345 <test_function+1>: mov ebp,esp
0x08048347 <test_function+3>: sub esp,0x28
0x0804834a <test_function+6>: mov DWORD PTR [ebp-12],0x7a69
0x08048351 <test_function+13>: mov BYTE PTR [ebp-40],0x41
0x08048355 <test_function+17>: leave
0x08048356 <test_function+18>: ret

can convert below code(as @Peter Cordes point that &quot;leave&quot; is equal to &quot;mov esp,ebp&quot; + &quot;pop ebp&quot; see at https://www.felixcloutier.com/x86/leave)

Dump of assembler code for function test_function:
0x08048344 <test_function+0>: push ebp
0x08048345 <test_function+1>: mov ebp,esp
0x08048347 <test_function+3>: sub esp,0x28
0x0804834a <test_function+6>: mov DWORD PTR [ebp-12],0x7a69
0x08048351 <test_function+13>: mov BYTE PTR [ebp-40],0x41
mov esp,ebp // here changed
pop ebp // here changed
0x08048356 <test_function+18>: ret


Local variables are stored in the stack.

So we can get a picture see below:

[![enter image description here][1]][1]


  [1]: https://i.stack.imgur.com/dOrfR.png

</details>

通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。

需要解释这段汇编代码。

问题

答案1

无法在Go中读取utmpx文件。

如何在rename()中使用文件路径？

更改函数的返回地址不如预期工作

这个不兼容的指针会引发问题吗？

What's the correct way to type hint an empty list as a literal in python?

如何在Highcharts Gantt中更改本地化的星期名称

如何在同一个流中使用多个过滤器和映射函数？

如何使用Map/Set来将代码优化到O(n)？

.NET MAUI Android在GitHub Actions上构建失败，错误代码为1。

如何在Playwright视觉比较中屏蔽多个定位器？

在C++中，可以使用可变模板参数来检索类型的内部类型。

selenium.common.exceptions.StaleElementReferenceException: Message: stale element reference: stale element not found

Creating and opening a URL to log in to Website via Basic Auth with Robot Framework/Selenium (Python)

AG Grid 在上下文菜单中以大文本形式打开

发表评论