一个简单C程序的汇编程序执行分析

一.汇编指令

1、mov

movl %eax,%edx     edx=eax
movl %0x123,%edx   edx=0x123
movl 0x123,%edx    edx=*(int32_t*)0x123;
movl (%ebx),%edx   edx=*(int32_t*)ebx;
movl 4(%ebx),%edx  edx=*(int32_t*)(ebx+4);

 2、pushl

pushl %eax相当于

subl $4，%esp
movl %eax,(%esp)

3、popl

popl %eax相当于

movl (%esp), %eax
add $4, %esp

4、call 0x12345

pushl %eip
movl 0x12345,%eip

5、ret

popl %eip

6、leave

movl %ebp,%esp
pop %ebp

二、函数调用分析

代码如下：

int g(int x)
{
    return x + 3;   
}

int f(int x)
{
    return g(x);    
}

int main(void)
{
    return f(8) + 1;    
}

汇编代码：

g:
    pushl   %ebp
    movl    %esp, %ebp
    movl    8(%ebp), %eax
    addl    $3, %eax
    popl    %ebp
    ret
f:
    pushl   %ebp
    movl    %esp, %ebp
    subl    $4, %esp
    movl    8(%ebp), %eax
    movl    %eax, (%esp)
    call    g
    leave
    ret
main:
    pushl   %ebp
    movl    %esp, %ebp
    subl    $4, %esp
    movl    $8, (%esp)
    call    f
    addl    $1, %eax
    leave
    ret

接下来，分析一下堆栈调用的过程：

首先main()

pushl   %ebp
movl    %esp, %ebp
subl    $4, %esp
movl    $8, (%esp)

 接下来，调用

call f

此时，eip指向f中的pushl %ebp

pushl   %ebp
movl    %esp, %ebp
subl    $4, %esp
movl    8(%ebp), %eax
movl    %eax, (%esp)

 

 接下来，运行

call g

接下来，执行

 pushl   %ebp
 movl    %esp, %ebp
 movl    8(%ebp), %eax
 addl    $3, %eax
 popl    %ebp //将ebp指向的值赋给ebp
 ret//相当于：popl eip

 

 此时，eip指向f函数中的leave

leave
ret

接下来执行

 addl    $1, %eax

 此时eax = 12
接下来执行

leave
ret