Symbian中反汇编代码分析

    这是比较初级的东西，只是看看栈的分配而已。

源代码

TInt CMyAppDocument::AssembleAdd()
 {
 TInt result = 0;
 TInt a = 2;
 TInt b = 3;
 result = a+b;
 return result;
 }

 

反汇编后

 {
0x31312820 <CMyAppDocument::AssembleAdd>:    push  ebp
0x31312821 <CMyAppDocument::AssembleAdd+1>:  mov   ebp,esp
0x31312823 <CMyAppDocument::AssembleAdd+3>:  sub   esp,0x10
0x31312826 <CMyAppDocument::AssembleAdd+6>:  push  ecx
0x31312827 <CMyAppDocument::AssembleAdd+7>:  push  edi
0x31312828 <CMyAppDocument::AssembleAdd+8>:  lea   edi,dword ptr [esp+0x8]  

0x3131282c <CMyAppDocument::AssembleAdd+12>: mov   eax,0xcccccccc
0x31312831 <CMyAppDocument::AssembleAdd+17>: stosd                          
0x31312832 <CMyAppDocument::AssembleAdd+18>: stosd
0x31312833 <CMyAppDocument::AssembleAdd+19>: stosd
0x31312834 <CMyAppDocument::AssembleAdd+20>: stosd
0x31312835 <CMyAppDocument::AssembleAdd+21>: pop   edi
0x31312836 <CMyAppDocument::AssembleAdd+22>: pop   ecx
0x31312837 <CMyAppDocument::AssembleAdd+23>: mov   dword ptr [ebp-0x10],ecx
 TInt result = 0;
0x3131283a <CMyAppDocument::AssembleAdd+26>: mov   dword ptr [ebp-0x4],0x0
 TInt a = 2;
0x31312841 <CMyAppDocument::AssembleAdd+33>: mov   dword ptr [ebp-0x8],0x2
 TInt b = 3;
0x31312848 <CMyAppDocument::AssembleAdd+40>: mov   dword ptr [ebp-0xc],0x3
 result = a+b;
0x3131284f <CMyAppDocument::AssembleAdd+47>: mov   edx,dword ptr [ebp-0x8]
0x31312852 <CMyAppDocument::AssembleAdd+50>: add   edx,dword ptr [ebp-0xc]
0x31312855 <CMyAppDocument::AssembleAdd+53>: mov   dword ptr [ebp-0x4],edx
 return result;
0x31312858 <CMyAppDocument::AssembleAdd+56>: mov   eax,dword ptr [ebp-0x4]
 
 }
0x3131285b <CMyAppDocument::AssembleAdd+59>: leave                          

0x3131285c <CMyAppDocument::AssembleAdd+60>: ret   near

 

栈空间分析：

|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------| <High address of memory>
|       ESP        | ;Before push EBP
|------------------|    
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
PUSH ebp
MOV  ebp,esp
|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------|
|                  | ;ESP-0x10
|------------------|
|                  | ;ESP-0xC
|------------------|
|                  | ;ESP-0x8
|------------------|
|                  | ;ESP-0x4
|------------------|
|     EBP          | ;Current ESP
|------------------| <High address of memory>
 
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
SUB esp,0x10
|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------|
|                  | ;Current ESP
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|      EBP         | 
|------------------| <High address of memory>

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
PUSH ecx
|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------|
|      ECX         | ;Current ESP
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|      EBP         | 
|------------------| <High address of memory>

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
PUSH edi
|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------|
|      EDI         | ;Current ESP
|------------------|
|      ECX         |
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|      EBP         | 
|------------------| <High address of memory>

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
LEA edi,dword ptr[esp+0x8]
|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------|
|      EDI         | ;Current ESP, edi pointer to ESP+0x8
|------------------|
|      ECX         |
|------------------|
|                  | ;ESP+0x8, EDI pointer to here
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|      EBP         | 
|------------------| <High address of memory>

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
MOV EAX,0xCCCCCCCC
|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------|
|      EDI         | ;Current ESP, edi pointer to ESP+0x8
|------------------|
|      ECX         |
|------------------|
|                  | ;ESP+0x8, EDI pointer to here
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|      EBP         | 
|------------------| <High address of memory>
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
STOSD    

STOSD
STOSD
STOSD
|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------|
|      EDI         | ;Current ESP, edi pointer to ESP+0x8
|------------------|
|      ECX         |
|------------------|
|   0xCCCCCCCC     | ;ESP+0x8, First EDI pointer to here
|------------------|
|   0xCCCCCCCC     | ;Second EDI pointer to here
|------------------|
|   0xCCCCCCCC     | ;Third EDI pointer to here
|------------------|
|   0xCCCCCCCC     | ;Fourth EDI pointer to here
|------------------|
|      EBP         | 
|------------------| <High address of memory>

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
POP edi
POP ecx
|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------|
|   0xCCCCCCCC     | ;Current ESP
|------------------|
|   0xCCCCCCCC     |
|------------------|
|   0xCCCCCCCC     |
|------------------|
|   0xCCCCCCCC     |
|------------------|
|      EBP         | 
|------------------| <High address of memory>

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
MOV dword ptr[ebp-0x10],ECX  ;Address[0x2F873920],contents at memory[586A7107]<===>0x07716A58(Little-endian)
|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------|
|   0x2F873920     | ;EBP-0x10, and mov the content of ECX to here
|------------------|
|   0xCCCCCCCC     | ;Current ESP
|------------------|
|   0xCCCCCCCC     |
|------------------|
|   0xCCCCCCCC     |
|------------------|
|   0xCCCCCCCC     |
|------------------|
|      EBP         | 
|------------------| <High address of memory>

 

剩下的和上面的类似，就不再列出了。