arm架构下C语言反汇编分析

.text
.global _start

_start:

    ldr sp, =4096  

    bl main

halt:
    b halt

int main()
{
    unsigned int *pGPFCON = (unsigned int *)0x56000050;
    unsigned int *pGPFDAT = (unsigned int *)0x56000054;


    *pGPFCON = 0x100;

    *pGPFDAT = 0;

    return 0;
}

led.elf:     file format elf32-littlearm

Disassembly of section .text:

00000000 <_start>:
   0:    e3a0da01     mov    sp, #4096    ; 0x1000       //设置堆栈为4096
   4:    eb000000     bl    c <main>                   //跳到main函数执行

00000008 <halt>:
   8:    eafffffe     b    8 <halt>

0000000c <main>:
   c:    e1a0c00d     mov    ip, sp                      //把sp的值赋值给ip=4096
  10:    e92dd800     stmdb    sp!, {fp, ip, lr, pc}   //pc是R15 lr是R14 ip是R12 fp是R11 
                                    //先把sp的值减4,sp=4092 然后把pc的值放到4096到4093所指的内存中
                                    //再把sp值减4为4088 ，然后把lr的值放到4092到4089所指的内存中
                                    //再把sp值减4为4084 ，然后把ip的值放到4088到4085所指的内存中
                                    //再把sp值减4为4080 ，然后把ip的值放到4083到4080所指的内存中
               // 上面一条指令是在调用main之前需要保存寄存器的值



                                                    
  14:    e24cb004     sub    fp, ip, #4    ; 0x4           // fp =ip-4=4092      
  18:    e24dd008     sub    sp, sp, #8    ; 0x8           // sp =sp-4=4072
  
  1c:    e3a03456     mov    r3, #1442840576    ; 0x56000000  //把0x56000000放到r3中
  20:    e2833050     add    r3, r3, #80    ; 0x50            //把r3的值加80  变成0x56000050
  24:    e50b3010     str    r3, [fp, #-16]                //把0x56000050放到[4076]       第一局部变量
  
  28:    e3a03456     mov    r3, #1442840576    ; 0x56000000  //把0x56000000放到r3中
  2c:    e2833054     add    r3, r3, #84    ; 0x54            //把r3的值加84 变成0x56000054
  30:    e50b3014     str    r3, [fp, #-20]                //把0x56000050放到[4072]       第二局部变量
   
  34:    e51b2010     ldr    r2, [fp, #-16]                //把内存中[4076]的值0x56000050放到r2中去
  38:    e3a03c01     mov    r3, #256    ; 0x100            
  3c:    e5823000     str    r3, [r2]                      //把0x100写入[0x56000050]内存中去
  
  40:    e51b2014     ldr    r2, [fp, #-20]                //把内存中[4072]的值0x56000054放到r2中去
  44:    e3a03000     mov    r3, #0    ; 0x0                
  48:    e5823000     str    r3, [r2]                      //把0x0写入[0x56000054]内存中去
  
  4c:    e3a03000     mov    r3, #0    ; 0x0                  
  50:    e1a00003     mov    r0, r3
  
  54:    e24bd00c     sub    sp, fp, #12    ; 0xc             //sp=fp-12=4092-12=4080
  58:    e89da800     ldmia    sp, {fp, sp, pc}          //先把内存中4080到4083中的值给fp，然后内存中4084到4087给sp,sp=4096
                                                      //最后把4088到4091值给pc，也就是调用完main函数，
                                                      //之后下一条指令的地址，调用前存在lr寄存器中
                                                     
  
  
Disassembly of section .comment:

00000000 <.comment>:
   0:    43434700     cmpmi    r3, #0    ; 0x0
   4:    4728203a     undefined
   8:    2029554e     eorcs    r5, r9, lr, asr #10
   c:    2e342e33     mrccs    14, 1, r2, cr4, cr3, {1}
  10:    Address 0x10 is out of bounds.