标签：
概率
esp :栈顶指针，必须的
ebp: 存放堆栈指针,不是必须的
#include <stdio.h>
int func(int param1 ,int param2,int param3)
{
int var1 = param1;
int var2 = param2;
int var3 = param3;
printf("var1=%d,var2=%d,var3=%d",var1,var2,var3);
return var1;
}
int main(int argc, char* argv[])
{
int result = func(1,2,3);
return 0;
}
上面这个函数 调用后 堆栈数据分析
1 main(int argc, char* argv[])函数汇编代码 2 3 ; Attributes: bp-based frame 4 main proc near 5 6 var_CC= dword ptr -0CCh 7 var_8= dword ptr -8 8 9 push ebp ;压入ebp 10 mov ebp, esp ;ebp = esp,保留esp,待函数调用完再恢复,因为函数调用中肯定会用到esp. 11 sub esp, 0CCh ;为该函数留出临时存储区, 堆栈大小为 0CCh 12 push ebx;压入ebx 13 push esi;压入esi 14 push edi;压入edi 15 lea edi, [ebp+var_CC] ;读入[ebp-0C0h]有效地址,即原esp-0C0h,正好是为该函数留出的临时存储区的最低位 16 mov ecx, 33h ;ecx = 30h(48),30h*4 = 0C0h 17 mov eax, 0CCCCCCCCh ;重复在es:[edi]存入30个;0CCCCCCCCh? Debug模式下把Stack上的变量初始化为0xcc，检查未初始化的问题 18 rep stosd 19 20 //int result = func(1,2,3); 21 push 3 22 push 2 23 push 1 24 call func ;相当 push (call func下一条指令的地址) ,jmp func, esp-=4 25 26 add esp, 0Ch 27 mov [ebp+var_8], eax 28 xor eax, eax 29 pop edi 30 pop esi 31 pop ebx 32 add esp, 0CCh 33 cmp ebp, esp 34 call _RTC_CheckEsp 35 mov esp, ebp ;还原 esp栈顶 36 pop ebp ;还原 ebp 37 retn ;相当 pop eip, esp+=4 38 main endp
1 int func(int param1 ,int param2,int param3)函数汇编代码 2 ; Attributes: bp-based frame 3 4 func proc near 5 6 var_E4= dword ptr -0E4h 7 var_20= dword ptr -20h 8 var_14= dword ptr -14h 9 var_8= dword ptr -8 10 arg_0= dword ptr 8 11 arg_4= dword ptr 0Ch 12 arg_8= dword ptr 10h 13 14 push ebp 15 mov ebp, esp 16 sub esp, 0E4h 17 push ebx 18 push esi 19 push edi 20 lea edi, [ebp-0E4h] 21 mov ecx, 39h 22 mov eax, 0CCCCCCCCh 23 rep stosd 24 25 //int var1 = param1; 26 //int var2 = param2; 27 //int var3 = param3; 28 mov eax, [ebp+8] 29 mov [ebp-8], eax 30 mov eax, [ebp+ 0Ch] 31 mov [ebp -14h], eax 32 mov eax, [ebp+10h] 33 mov [ebp-20h], eax 34 35 36 mov esi, esp 37 mov eax, [ebp-20h] 38 push eax 39 mov ecx, [ebp -14h] 40 push ecx 41 mov edx, [ebp-8] 42 push edx 43 push offset s_Var1DVar2DVar ; "var1=%d,var2=%d,var3=%d" 44 call ds:__imp__printf 45 add esp, 10h 46 cmp esi, esp 47 call j__RTC_CheckEsp 48 mov eax, [ebp-8] 49 pop edi 50 pop esi 51 pop ebx 52 add esp, 0E4h 53 cmp ebp, esp 54 call j__RTC_CheckEsp 55 mov esp, ebp 56 pop ebp 57 retn 58 func endp
标签：
原文地址：http://www.cnblogs.com/mayingkun/p/5792055.html
