结构体的反汇编分析

最新推荐文章于 2024-04-30 23:14:46 发布

逮虾户肉丝

最新推荐文章于 2024-04-30 23:14:46 发布

阅读量394

点赞数

分类专栏：底层逆向学习文章标签： c语言

本文链接：https://blog.csdn.net/qq_31125257/article/details/120818103

版权

底层逆向学习专栏收录该内容

14 篇文章 3 订阅

订阅专栏

一、为什么用结构体？

char、short、int、float、数组等都是宽度不同的容器，用来存储程序执行所需要和所产生的数据，其中数组是存储相同宽度数据的容器，那么当需要存储不同宽度的不同类型的数据时，结构体是一个非常适合的选择
在这里插入图片描述

二、结构体的定义和使用

结构体的定义

结构体内部变量在定义时，除了自身以外可以使用任何类型（不能递归定义）

结构体的使用

在这里插入图片描述

三、结构体作参数和返回值

struct MyStruct1{char a ;short b ;int c ;__int64 d;};
struct MyStruct2{char aa;int bb; MyStruct1 s1;};
MyStruct2 func1(MyStruct2 s1) {
00301800  push        ebp  
00301801  mov         ebp,esp  
00301803  sub         esp,0E4h  
00301809  push        ebx  
0030180A  push        esi  
0030180B  push        edi  
0030180C  lea         edi,[ebp-24h]  
0030180F  mov         ecx,9  
00301814  mov         eax,0CCCCCCCCh  
00301819  rep stos    dword ptr es:[edi]  
//被调用函数需要寻找结构体变量时，会增加以下三句汇编
0030181B  mov         eax,dword ptr ds:[0030A004h]  
00301820  xor         eax,ebp  
00301822  mov         dword ptr [ebp-4],eax  

00301825  mov         ecx,30C029h  
0030182A  call        00301311  
	MyStruct2 s2 = s1;
0030182F  mov         eax,dword ptr [ebp+0Ch]  
00301832  mov         dword ptr [ebp-20h],eax  
00301835  mov         ecx,dword ptr [ebp+10h]  
00301838  mov         dword ptr [ebp-1Ch],ecx  
0030183B  mov         edx,dword ptr [ebp+14h]  
0030183E  mov         dword ptr [ebp-18h],edx  
00301841  mov         eax,dword ptr [ebp+18h]  
00301844  mov         dword ptr [ebp-14h],eax  
00301847  mov         ecx,dword ptr [ebp+1Ch]  
0030184A  mov         dword ptr [ebp-10h],ecx  
0030184D  mov         edx,dword ptr [ebp+20h]  
00301850  mov         dword ptr [ebp-0Ch],edx  
	s2.aa = 'A';
00301853  mov         byte ptr [ebp-20h],41h  
	s2.bb = 12;
00301857  mov         dword ptr [ebp-1Ch],0Ch  
	s2.s1.a = 1;
0030185E  mov         byte ptr [ebp-18h],1  
	s2.s1.b = 2;
00301862  mov         eax,2  
00301867  mov         word ptr [ebp-16h],ax  
	s2.s1.c = 3;
0030186B  mov         dword ptr [ebp-14h],3  
	s2.s1.d = 5;
00301872  xor         eax,eax  
00301874  mov         dword ptr [ebp-10h],5  
0030187B  mov         dword ptr [ebp-0Ch],eax  
	return s2;
0030187E  mov         eax,dword ptr [ebp+8]  
00301881  mov         ecx,dword ptr [ebp-20h]  
00301884  mov         dword ptr [eax],ecx  
00301886  mov         edx,dword ptr [ebp-1Ch]  
00301889  mov         dword ptr [eax+4],edx  
0030188C  mov         ecx,dword ptr [ebp-18h]  
0030188F  mov         dword ptr [eax+8],ecx  
00301892  mov         edx,dword ptr [ebp-14h]  
00301895  mov         dword ptr [eax+0Ch],edx  
00301898  mov         ecx,dword ptr [ebp-10h]  
0030189B  mov         dword ptr [eax+10h],ecx  
0030189E  mov         edx,dword ptr [ebp-0Ch]  
003018A1  mov         dword ptr [eax+14h],edx  
003018A4  mov         eax,dword ptr [ebp+8]  
}

int main() {
00301940  push        ebp  
00301941  mov         ebp,esp  
00301943  sub         esp,140h  
00301949  push        ebx  
0030194A  push        esi  
0030194B  push        edi  
0030194C  lea         edi,[ebp-80h]  
0030194F  mov         ecx,20h  
00301954  mov         eax,0CCCCCCCCh  
00301959  rep stos    dword ptr es:[edi]  
0030195B  mov         ecx,30C029h  
00301960  call        00301311  
	MyStruct2 s = { 0,1,2,3,4,5 };
00301965  mov         byte ptr [ebp-1Ch],0  
00301969  mov         dword ptr [ebp-18h],1  
00301970  mov         byte ptr [ebp-14h],2  
00301974  mov         eax,3  
00301979  mov         word ptr [ebp-12h],ax  

 - [ ] //存储3的时候为啥用了eax来中转，而存储4的时候确不用eax来中转呢？？？

0030197D  mov         dword ptr [ebp-10h],4  
00301984  xor         eax,eax  
00301986  mov         dword ptr [ebp-0Ch],5  
0030198D  mov         dword ptr [ebp-8],eax  
	MyStruct2 ss = func1(s);
00301990  sub         esp,18h  
00301993  mov         eax,esp  
00301995  mov         ecx,dword ptr [ebp-1Ch]  
00301998  mov         dword ptr [eax],ecx  
0030199A  mov         edx,dword ptr [ebp-18h]  
0030199D  mov         dword ptr [eax+4],edx  
003019A0  mov         ecx,dword ptr [ebp-14h]  
003019A3  mov         dword ptr [eax+8],ecx  
003019A6  mov         edx,dword ptr [ebp-10h]  
003019A9  mov         dword ptr [eax+0Ch],edx  
003019AC  mov         ecx,dword ptr [ebp-0Ch]  
003019AF  mov         dword ptr [eax+10h],ecx  
003019B2  mov         edx,dword ptr [ebp-8]  
003019B5  mov         dword ptr [eax+14h],edx  
003019B8  lea         eax,[ebp+FFFFFEC4h]  
003019BE  push        eax  
003019BF  call        003010CD  
003019C4  add         esp,1Ch  
003019C7  mov         ecx,dword ptr [eax]  
003019C9  mov         dword ptr [ebp+FFFFFEE4h],ecx  
003019CF  mov         edx,dword ptr [eax+4]  
003019D2  mov         dword ptr [ebp+FFFFFEE8h],edx  
003019D8  mov         ecx,dword ptr [eax+8]  
003019DB  mov         dword ptr [ebp+FFFFFEECh],ecx  
003019E1  mov         edx,dword ptr [eax+0Ch]  
003019E4  mov         dword ptr [ebp+FFFFFEF0h],edx  
003019EA  mov         ecx,dword ptr [eax+10h]  
003019ED  mov         dword ptr [ebp+FFFFFEF4h],ecx  
003019F3  mov         edx,dword ptr [eax+14h]  
003019F6  mov         dword ptr [ebp+FFFFFEF8h],edx  
003019FC  mov         eax,dword ptr [ebp+FFFFFEE4h]  
00301A02  mov         dword ptr [ebp-3Ch],eax  
00301A05  mov         ecx,dword ptr [ebp+FFFFFEE8h]  
00301A0B  mov         dword ptr [ebp-38h],ecx  
00301A0E  mov         edx,dword ptr [ebp+FFFFFEECh]  
00301A14  mov         dword ptr [ebp-34h],edx  
00301A17  mov         eax,dword ptr [ebp+FFFFFEF0h]  
00301A1D  mov         dword ptr [ebp-30h],eax  
00301A20  mov         ecx,dword ptr [ebp+FFFFFEF4h]  
00301A26  mov         dword ptr [ebp-2Ch],ecx  
00301A29  mov         edx,dword ptr [ebp+FFFFFEF8h]  
00301A2F  mov         dword ptr [ebp-28h],edx  
	return 0;
00301A32  xor         eax,eax