注册 登录
编程论坛 → 汇编论坛

找个位置,记录下学习笔记（寂寞的疼）

zhu224039 发布于 2014-06-02 13:27， 651 次点击
程序代码：

int fuction()
{
    int a=0;
    a=a+4;
    printf("%d\n",a);
    getchar();
    return 0;

}
int _tmain(int argc, _TCHAR* argv[])
{
    int a=0;
    _asm{
        mov eax,fuction
        mov [ebp+4],eax
    }
   
    return 0;
}

栈最简单的用法
程序代码：

int addr;
int fuction()
{
    int a=0;
    _asm{
        mov eax,fuction
        mov [ebp+4],eax
    }
    a=a+4;
    printf("%d\n",a);
     getchar();
     return 0;
}
int _tmain(int argc, _TCHAR* argv[])
{
    int a=0;
    _asm{
        mov ecx,0
    }
    fuction();
   
    return 0;
}


程序代码：

.text:004113B0 wmain           proc near               ; CODE XREF: j_wmainj
.text:004113B0
.text:004113B0 var_CC          = byte ptr -0CCh
.text:004113B0 lpText          = dword ptr -8
.text:004113B0
.text:004113B0                 push    ebp
.text:004113B1                 mov     ebp, esp
.text:004113B3                 sub     esp, 0CCh
.text:004113B9                 push    ebx
.text:004113BA                 push    esi
.text:004113BB                 push    edi
.text:004113BC                 lea     edi, [ebp+var_CC]
.text:004113C2                 mov     ecx, 33h
.text:004113C7                 mov     eax, 0CCCCCCCCh
.text:004113CC                 rep stosd                      ---------------------〉每个程序都有的怪物

.text:004113CE                 mov     [ebp+lpText], offset aLoveMePlease ; "love me please"
.text:004113D5                 mov     esi, esp

.text:004113D7                 push    0               ; uType
.text:004113D9                 push    0               ; lpCaption
.text:004113DB                 mov     eax, [ebp+lpText]
.text:004113DE                 push    eax             ; lpText
.text:004113DF                 push    0               ; hWnd      
                                                                     函数参数入栈

.text:004113E1                 call    ds:__imp__MessageBoxA@16 ; MessageBoxA(x,x,x,x)
                                                         
.text:004113E7                 cmp     esi, esp
.text:004113E9                 call    j__RTC_CheckEsp
                                                        栈是否被更改验证程序 为了防止缓冲区溢出，出于安全

.text:004113EE                 xor     eax, eax
                                                函数返回值 return 0

.text:004113F0                 pop     edi
.text:004113F1                 pop     esi
.text:004113F2                 pop     ebx
.text:004113F3                 add     esp, 0CCh
                                                     对应开头的栈操作，疑问call MessageBox的一系列压站 出栈      在哪里进行的    函数内部 OR j__RTC_CheckEsp 不太可能是函数内部



.text:004113F9                 cmp     ebp, esp
.text:004113FB                 call    j__RTC_CheckEsp
                                                        又在验证栈是否平衡

.text:00411400                 mov     esp, ebp
.text:00411402                 pop     ebp
.text:00411403                 retn
.text:00411403 wmain           endp



下面是上面汇编的C程序

程序代码：

#include "stdafx.h"
#include "windows.h"
int _tmain(int argc, _TCHAR* argv[])
{
    char *str="love me please";
    ::MessageBoxA(NULL,str,NULL,MB_OK);
    return 0;
}


函数调用剖析
程序代码：

#include "stdafx.h"
#include "windows.h"
void function(int b)
{
    int a=4;
    a+=b;
}

int _tmain(int argc, _TCHAR* argv[])
{
    int a=0;
    function(a);
    return 0;
}


程序代码：

.text:00411A20                 push    ebp
.text:00411A21                 mov     ebp, esp
.text:00411A23                 sub     esp, 0CCh
.text:00411A29                 push    ebx
.text:00411A2A                 push    esi
.text:00411A2B                 push    edi
.text:00411A2C                 lea     edi, [ebp+var_CC]
.text:00411A32                 mov     ecx, 33h
.text:00411A37                 mov     eax, 0CCCCCCCCh
.text:00411A3C                 rep stosd
                                                        每个程序都有的怪物

.text:00411A3E                 mov     [ebp+var_8], 0  
                                                        int a=0;
                                                         变量 a 的位置在[ebp+var_8]处

 
.text:00411A45                 mov     eax, [ebp+var_8]
.text:00411A48                 push    eax
                                                       调用function函数的参数入栈

.text:00411A49                 call    j_function      
                                                
.text:00411A4E                 add     esp, 4         调用函数function参数的出栈

.text:00411A51                 xor     eax, eax       main函数的返回值 return 0  

.text:00411A53                 pop     edi
.text:00411A54                 pop     esi
.text:00411A55                 pop     ebx
.text:00411A56                 add     esp, 0CCh
                                                      对应上面的怪物  
.text:00411A5C                 cmp     ebp, esp
.text:00411A5E                 call    j__RTC_CheckEsp
                                                        栈核对
.text:00411A63                 mov     esp, ebp
.text:00411A65                 pop     ebp
.text:00411A66                 retn
.text:00411A66 wmain           endp



流程控制语句的研究
if     else

程序代码：

#include "windows.h"
int _tmain(int argc, _TCHAR* argv[])
{
    int a=0;
    if(a==0)  
        a=1;
    else
        a=0;
    return 0;
}


程序代码：


.text:00411380 wmain           proc near               ; CODE XREF: j_wmainj
.text:00411380
.text:00411380 var_CC          = byte ptr -0CCh
.text:00411380 var_8           = dword ptr -8
.text:00411380
.text:00411380                 push    ebp
.text:00411381                 mov     ebp, esp
.text:00411383                 sub     esp, 0CCh
.text:00411389                 push    ebx
.text:0041138A                 push    esi
.text:0041138B                 push    edi
.text:0041138C                 lea     edi, [ebp+var_CC]
.text:00411392                 mov     ecx, 33h
.text:00411397                 mov     eax, 0CCCCCCCCh
.text:0041139C                 rep stosd
                                                        这部分固定的 可以不管
                                                                    
.text:0041139E                 mov     [ebp+var_8], 0

.text:004113A5                 cmp     [ebp+var_8], 0
.text:004113A9                 jnz     short loc_4113B4      
                                                             分支选择  相当于  如果 a==0不成立跳转到  short loc_4113B4 执行a=0部分

.text:004113AB                 mov     [ebp+var_8], 1          这句为  a=1
.text:004113B2                 jmp     short loc_4113BB
.text:004113B4 ; ---------------------------------------------------------------------------
.text:004113B4
.text:004113B4 loc_4113B4:                             ; CODE XREF: wmain+29j
.text:004113B4                 mov     [ebp+var_8], 0          这句为  a=0
.text:004113BB
.text:004113BB loc_4113BB:                             ; CODE XREF: wmain+32j
.text:004113BB                 xor     eax, eax                 return 0
                                                                下面为固定部分

.text:004113BD                 pop     edi
.text:004113BE                 pop     esi
.text:004113BF                 pop     ebx
.text:004113C0                 mov     esp, ebp
.text:004113C2                 pop     ebp
.text:004113C3                 retn
.text:004113C3 wmain           endp


if   else if   else   剖析
程序代码：

int _tmain(int argc, _TCHAR* argv[])
{
    int a=0;
    if(a==0)  
        a=1;
    else if(a>0)
        a=0;
    else
        a=-1;
    return 0;
}


程序代码：

.text:00411380
.text:00411380 wmain           proc near               ; CODE XREF: j_wmainj
.text:00411380
.text:00411380 var_CC          = byte ptr -0CCh
.text:00411380 var_8           = dword ptr -8
.text:00411380
.text:00411380                 push    ebp
.text:00411381                 mov     ebp, esp
.text:00411383                 sub     esp, 0CCh
.text:00411389                 push    ebx
.text:0041138A                 push    esi
.text:0041138B                 push    edi
.text:0041138C                 lea     edi, [ebp+var_CC]
.text:00411392                 mov     ecx, 33h
.text:00411397                 mov     eax, 0CCCCCCCCh
.text:0041139C                 rep stosd
                                                                    上面的是垃圾

.text:0041139E                 mov     [ebp+var_8], 0               a=0;
.text:004113A5                 cmp     [ebp+var_8], 0      
.text:004113A9                 jnz     short loc_4113B4            if(a==0)  不相等跳转 相等 运行下面的

.text:004113AB                 mov     [ebp+var_8], 1                   a=1;
.text:004113B2                 jmp     short loc_4113CA
.text:004113B4 ; ---------------------------------------------------------------------------
.text:004113B4
.text:004113B4 loc_4113B4:                             ; CODE XREF: wmain+29j
.text:004113B4                 cmp     [ebp+var_8], 0  
.text:004113B8                 jle     short loc_4113C3        if(a>0)  小于等于跳转 命题成立执行下面的
.text:004113BA                 mov     [ebp+var_8], 0                 a=0
.text:004113C1                 jmp     short loc_4113CA
.text:004113C3 ; ---------------------------------------------------------------------------
.text:004113C3                                                  else 部分 没有条件判断不跳转
.text:004113C3 loc_4113C3:                             
.text:004113C3                 mov     [ebp+var_8], 0FFFFFFFFh       a=-1
.text:004113CA
.text:004113CA loc_4113CA:                             
.text:004113CA                                         
.text:004113CA                 xor     eax, eax                     return 0     
                                                                    下面的是垃圾
.text:004113CC                 pop     edi
.text:004113CD                 pop     esi
.text:004113CE                 pop     ebx
.text:004113CF                 mov     esp, ebp
.text:004113D1                 pop     ebp
.text:004113D2                 retn
.text:004113D2 wmain           endp



分支解析    比较条件+条件跳转指令+满足条件的代码+jmp到分支结构结束的第一条指令处   构成


for 循环研究

程序代码：

int _tmain(int argc, _TCHAR* argv[])
{
    int i,a=0;
    for(i=0;i<10;i++)
        a+=i;
    return 0;
}


程序代码：

.text:00411380 wmain           proc near               ; CODE XREF: j_wmainj
.text:00411380
.text:00411380 var_D8          = byte ptr -0D8h
.text:00411380 var_14          = dword ptr -14h
.text:00411380 var_8           = dword ptr -8
.text:00411380
.text:00411380                 push    ebp
.text:00411381                 mov     ebp, esp
.text:00411383                 sub     esp, 0D8h
.text:00411389                 push    ebx
.text:0041138A                 push    esi
.text:0041138B                 push    edi
.text:0041138C                 lea     edi, [ebp+var_D8]
.text:00411392                 mov     ecx, 36h
.text:00411397                 mov     eax, 0CCCCCCCCh
.text:0041139C                 rep stosd

 -------------------------------------------------------------------------------------- 分割线
.text:0041139E                 mov     [ebp+var_14], 0       a=0
.text:004113A5                 mov     [ebp+var_8], 0        i=0
.text:004113AC                 jmp     short loc_4113B7      跳转到条件  i<10 判定处
.text:004113AE ; ---------------------------------------------------------------------------
.text:004113AE
.text:004113AE loc_4113AE:                             
.text:004113AE                 mov     eax, [ebp+var_8]
.text:004113B1                 add     eax, 1         
.text:004113B4                 mov     [ebp+var_8], eax                  i++部分
.text:004113B7
.text:004113B7 loc_4113B7:                             
.text:004113B7                 cmp     [ebp+var_8], 0Ah          0AH=10   
.text:004113BB                 jge     short loc_4113C8          i<10判定的地方 大于跳转  小于执行后面的

.text:004113BD                 mov     eax, [ebp+var_14]
.text:004113C0                 add     eax, [ebp+var_8]
.text:004113C3                 mov     [ebp+var_14], eax      这个地方完成 a+=10
.text:004113C6                 jmp     short loc_4113AE       跳转到i++部分  构成循环
.text:004113C8 ; ---------------------------------------------------------------------------
.text:004113C8
.text:004113C8 loc_4113C8:                                   这个地方 就是for循环结束的地方了
.text:004113C8                 xor     eax, eax
.text:004113CA                 pop     edi
.text:004113CB                 pop     esi
.text:004113CC                 pop     ebx
.text:004113CD                 mov     esp, ebp
.text:004113CF                 pop     ebp
.text:004113D0                 retn
.text:004113D0 wmain           endp



while()循环的剖析
程序代码：

int _tmain(int argc, _TCHAR* argv[])
{
    int a=0;
    while(a<10){
        a++;
    }
    return 0;
}

程序代码：

.text:00411380 wmain           proc near               ; CODE XREF: j_wmainj
.text:00411380
.text:00411380 var_D8          = byte ptr -0D8h
.text:00411380 var_8           = dword ptr -8
.text:00411380
.text:00411380                 push    ebp
.text:00411381                 mov     ebp, esp
.text:00411383                 sub     esp, 0D8h
.text:00411389                 push    ebx
.text:0041138A                 push    esi
.text:0041138B                 push    edi
.text:0041138C                 lea     edi, [ebp+var_D8]
.text:00411392                 mov     ecx, 36h
.text:00411397                 mov     eax, 0CCCCCCCCh
.text:0041139C                 rep stosd

.text:0041139E                 mov     [ebp+var_8], 0       a=0
.text:004113A5
.text:004113A5 loc_4113A5:                             
.text:004113A5                 cmp     [ebp+var_8], 0Ah     a<10判定
.text:004113A9                 jge     short loc_4113B6     大于等于跳转

.text:004113AB                 mov     eax, [ebp+var_8]     
.text:004113AE                 add     eax, 1                                                            
.text:004113B1                 mov     [ebp+var_8], eax
                                                             上面两句对应 a++
.text:004113B4                 jmp     short loc_4113A5       跳转到while循环开头

.text:004113B6 ; ---------------------------------------------------------------------------
.text:004113B6
.text:004113B6 loc_4113B6:                                 
.text:004113B6                 xor     eax, eax              return 0
.text:004113B8                 pop     edi
.text:004113B9                 pop     esi
.text:004113BA                 pop     ebx
.text:004113BB                 mov     esp, ebp
.text:004113BD                 pop     ebp
.text:004113BE                 retn
.text:004113BE wmain           endp


do while循环
程序代码：

int _tmain(int argc, _TCHAR* argv[])
{
    int a=0;
    do{
        a++;
    }while(a<10);
    return 0;
}

程序代码：

.text:00411380 wmain           proc near               ; CODE XREF: j_wmainj
.text:00411380
.text:00411380 var_CC          = byte ptr -0CCh
.text:00411380 var_8           = dword ptr -8
.text:00411380
.text:00411380                 push    ebp
.text:00411381                 mov     ebp, esp
.text:00411383                 sub     esp, 0CCh
.text:00411389                 push    ebx
.text:0041138A                 push    esi
.text:0041138B                 push    edi
.text:0041138C                 lea     edi, [ebp+var_CC]
.text:00411392                 mov     ecx, 33h
.text:00411397                 mov     eax, 0CCCCCCCCh
.text:0041139C                 rep stosd

.text:0041139E                 mov     [ebp+var_8], 0           a=0
.text:004113A5
.text:004113A5 loc_4113A5:                             
.text:004113A5                 mov     eax, [ebp+var_8]        
.text:004113A8                 add     eax, 1
.text:004113AB                 mov     [ebp+var_8], eax      
                                                               上面三句 a++
.text:004113AE                 cmp     [ebp+var_8], 0Ah         判定  a<10
.text:004113B2                 jl      short loc_4113A5        小于跳转到do起头的位置
               
.text:004113B4                 xor     eax, eax                 return 0
.text:004113B6                 pop     edi
.text:004113B7                 pop     esi
.text:004113B8                 pop     ebx
.text:004113B9                 mov     esp, ebp
.text:004113BB                 pop     ebp
.text:004113BC                 retn
.text:004113BC wmain           endp



到此程序的组织结构部分基本完成

[ 本帖最后由 zhu224039 于 2014-6-3 13:36 编辑 ]
2 回复
#2
hu9jj2014-06-03 07:25
汇编语言与C语言对照，不错。
#3
zklhp2014-06-03 12:58
rep stosd                      ---------------------〉每个程序都有的怪物


昨晚就想说 忘说了 这是Debug版的特征 你试试 Release版应该就没有了
1
©2025, BCCN.NET
电脑版