函数调用战帧过程解析图

这里，我们来研究如下代码的栈帧过程。为了初学者理解汇编指令，所以编译环境是在vc++6.0下

#include<stdio.h>
#include<stdlib.h>

int sum(int _a,int _b)
{
    int c=0;
    c=_a+_b;
    return c;
}

int main()
{
    int a=10;
    int b=20;
    int ret=0;

    ret=sum(a,b);
    printf("%d\n",ret);

    system("pause");
    return 0；
}

//如下是从vc++6.0中截取的汇编指令
--- f:\vc\a\a.cpp  ----------------------------------------
10:
11:   int main()
12:   {
00401060   push        ebp
00401061   mov         ebp,esp
00401063   sub         esp,4Ch
00401066   push        ebx
00401067   push        esi
00401068   push        edi
00401069   lea         edi,[ebp-4Ch]
0040106C   mov         ecx,13h
00401071   mov         eax,0CCCCCCCCh
00401076   rep stos    dword ptr [edi]
13:       int a=10;
00401078   mov         dword ptr [ebp-4],0Ah
14:       int b=20;
0040107F   mov         dword ptr [ebp-8],14h
15:       int ret=0;
00401086   mov         dword ptr [ebp-0Ch],0
16:
17:       ret=sum(a,b);
0040108D   mov         eax,dword ptr [ebp-8]
00401090   push        eax
00401091   mov         ecx,dword ptr [ebp-4]
00401094   push        ecx
00401095   call        @ILT+0(sum) (00401005)
0040109A   add         esp,8
0040109D   mov         dword ptr [ebp-0Ch],eax
18:       printf("%d\n",ret);
004010A0   mov         edx,dword ptr [ebp-0Ch]
004010A3   push        edx
004010A4   push        offset string "%d\n" (00424024)
004010A9   call        printf (00401200)
004010AE   add         esp,8
19:
20:       system("pause");
004010B1   push        offset string "pause" (0042401c)
004010B6   call        system (004010f0)
004010BB   add         esp,4
21:   }
004010BE   pop         edi
004010BF   pop         esi
004010C0   pop         ebx
004010C1   add         esp,4Ch
004010C4   cmp         ebp,esp
004010C6   call        __chkesp (00401280)
004010CB   mov         esp,ebp
004010CD   pop         ebp
004010CE   ret

--- f:\vc\a\a.cpp  ----------------------------------------
1:    #include<stdio.h>
2:    #include<stdlib.h>
3:
4:    int sum(int _a,int _b)
5:    {
00401020   push        ebp
00401021   mov         ebp,esp
00401023   sub         esp,44h
00401026   push        ebx
00401027   push        esi
00401028   push        edi
00401029   lea         edi,[ebp-44h]
0040102C   mov         ecx,11h
00401031   mov         eax,0CCCCCCCCh
00401036   rep stos    dword ptr [edi]
6:        int c=0;
00401038   mov         dword ptr [ebp-4],0
7:        c=_a+_b;
0040103F   mov         eax,dword ptr [ebp+8]
00401042   add         eax,dword ptr [ebp+0Ch]
00401045   mov         dword ptr [ebp-4],eax
8:        return c;
00401048   mov         eax,dword ptr [ebp-4]
9:    }
0040104B   pop         edi
0040104C   pop         esi
0040104D   pop         ebx
0040104E   mov         esp,ebp
00401050   pop         ebp
00401051   ret