windbg 栈处理函数调用的过程（做一次记录）

main函数的汇编

 HiStack!main:
00e51080 55             push    ebp
00e51081 8bec           mov     ebp, esp
00e51083 6a7a           push    7Ah
00e51085 e886ffffff     call    HiStack!Proc (00e51010)
00e5108a 5d             pop     ebp
00e5108b c3             ret     
00e5108c cc             int     3
00e5108d cc             int     3
00e5108e cc             int     3
00e5108f cc             int     3

Proc的汇编函数

00e51010 55             push    ebp
00e51011 8bec           mov     ebp, esp
00e51013 51             push    ecx
00e51014 8b4508         mov     eax, dword ptr [ebp+8]
00e51017 8945fc         mov     dword ptr [ebp-4], eax
00e5101a 8b4dfc         mov     ecx, dword ptr [ebp-4]
00e5101d 51             push    ecx
00e5101e 8b5508         mov     edx, dword ptr [ebp+8]
00e51021 52             push    edx
00e51022 6890f1e800     push    offset HiStack!`string' (00e8f190)
00e51027 e864000000     call    HiStack!printf (00e51090)
00e5102c 83c40c         add     esp, 0Ch
00e5102f 8b4508         mov     eax, dword ptr [ebp+8]
00e51032 0faf45fc       imul    eax, dword ptr [ebp-4]
00e51036 8be5           mov     esp, ebp
00e51038 5d             pop     ebp
00e51039 c20400         ret     4

Windbg 分析过程

Microsoft ® Windows Debugger Version 10.0.20153.1000 X86
Copyright © Microsoft Corporation. All rights reserved.

CommandLine: D:\advdbg\Adwdbcode_tools\swdbgbk_src\bin\Release\HiStack.exe

************* Path validation summary **************
Response Time (ms) Location
OK D:\mysymbols
Symbol search path is: D:\mysymbols
Executable search path is:
*** WARNING: Unable to verify checksum for HiStack.exe
ModLoad: 00e50000 00e9e000 HiStack.exe
*** ERROR: Module load completed but symbols could not be loaded for ntdll.dll
ModLoad: 770f0000 7728a000 ntdll.dll
*** ERROR: Module load completed but symbols could not be loaded for C:\Windows\SysWOW64\KERNEL32.DLL
ModLoad: 76930000 76a10000 C:\Windows\SysWOW64\KERNEL32.DLL
*** ERROR: Module load completed but symbols could not be loaded for C:\Windows\SysWOW64\KERNELBASE.dll
ModLoad: 76db0000 76faf000 C:\Windows\SysWOW64\KERNELBASE.dll
(4c78.4ef0): Break instruction exception - code 80000003 (first chance)
eax=00000000 ebx=0117f000 ecx=f8d50000 edx=00000000 esi=013e22b8 edi=770f687c
eip=7719ecc2 esp=012ff5ac ebp=012ff5d8 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!LdrpDoDebuggerBreak+0x2b:
7719ecc2 cc int 3

0:000> g
Breakpoint 0 hit
eax=013e8d68 ebx=0117f000 ecx=00000000 edx=742f4c58 esi=00e99748 edi=013e6a28
eip=00e51080 esp=012ffab8 ebp=012ffafc iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
HiStack!main:
00e51080 55              push    ebp

0:000> r ebp,esp
ebp=012ffafc esp=012ffab8在这里插入代码片

0:000> !teb
TEB at 01182000
    ExceptionList:        012ffaec
    StackBase:            01300000
    StackLimit:           012fd000
    SubSystemTib:         00000000
    FiberData:            00001e00
    ArbitraryUserPointer: 00000000
    Self:                 01182000
    EnvironmentPointer:   00000000
    ClientId:             00004c78 . 00004ef0
    RpcHandle:            00000000
    Tls Storage:          0118202c
    PEB Address:          0117f000
    LastErrorValue:       0
    LastStatusValue:      0
    Count Owned Locks:    0
    HardErrorMode:        0

0:000> kbn
 # ChildEBP RetAddr      Args to Child              
00 012ffab4 00e5128f     00000001 013e6a28 013e8d68 HiStack!main [d:\advdbg\adwdbcode_tools\swdbgbk_src\chap22\histack\histack.cpp @ 14] 
01 (In