汇编精讲01

1、简单源码main.c

#include<stdio.h>
int g_a=1;
int main()
{
	int a =1;
	int b =2;
	return 0;
}

 2、反汇编方法:截取main函数部分

(1)arm-linux-gcc hello.c
   arm-linux-objdump -d a.out > main.s

(2)arm-linux-gcc -S main.c -o main.S

a.out:     file format elf32-littlearm


Disassembly of section .init:

00008250 <_init>:
    8250:	e92d4008 	push	{r3, lr}
    8254:	eb00001d 	bl	82d0 <call_weak_fn>
    8258:	e8bd8008 	pop	{r3, pc}

Disassembly of section .plt:

0000825c <.plt>:
    825c:	e52de004 	push	{lr}		; (str lr, [sp, #-4]!)
    8260:	e59fe004 	ldr	lr, [pc, #4]	; 826c <_init+0x1c>
    8264:	e08fe00e 	add	lr, pc, lr
    8268:	e5bef008 	ldr	pc, [lr, #8]!
    826c:	00008274 	.word	0x00008274
    8270:	e28fc600 	add	ip, pc, #0, 12
    8274:	e28cca08 	add	ip, ip, #8, 20	; 0x8000
    8278:	e5bcf274 	ldr	pc, [ip, #628]!	; 0x274
    827c:	e28fc600 	add	ip, pc, #0, 12
    8280:	e28cca08 	add	ip, ip, #8, 20	; 0x8000
    8284:	e5bcf26c 	ldr	pc, [ip, #620]!	; 0x26c
    8288:	e28fc600 	add	ip, pc, #0, 12
    828c:	e28cca08 	add	ip, ip, #8, 20	; 0x8000
    8290:	e5bcf264 	ldr	pc, [ip, #612]!	; 0x264

Disassembly of section .text:

00008294 <_start>:
    8294:	e3a0b000 	mov	fp, #0
    8298:	e3a0e000 	mov	lr, #0
    829c:	e49d1004 	pop	{r1}		; (ldr r1, [sp], #4)
    82a0:	e1a0200d 	mov	r2, sp
    82a4:	e52d2004 	push	{r2}		; (str r2, [sp, #-4]!)
    82a8:	e52d0004 	push	{r0}		; (str r0, [sp, #-4]!)
    82ac:	e59fc010 	ldr	ip, [pc, #16]	; 82c4 <_start+0x30>
    82b0:	e52dc004 	push	{ip}		; (str ip, [sp, #-4]!)
    82b4:	e59f000c 	ldr	r0, [pc, #12]	; 82c8 <_start+0x34>
    82b8:	e59f300c 	ldr	r3, [pc, #12]	; 82cc <_start+0x38>
    82bc:	ebffffeb 	bl	8270 <_init+0x20>
    82c0:	ebfffff0 	bl	8288 <_init+0x38>
    82c4:	000083d0 	.word	0x000083d0
    82c8:	00008340 	.word	0x00008340
    82cc:	00008370 	.word	0x00008370

000082d0 <call_weak_fn>:
    82d0:	e59f3014 	ldr	r3, [pc, #20]	; 82ec <call_weak_fn+0x1c>
    82d4:	e59f2014 	ldr	r2, [pc, #20]	; 82f0 <call_weak_fn+0x20>
    82d8:	e08f3003 	add	r3, pc, r3
    82dc:	e7932002 	ldr	r2, [r3, r2]
    82e0:	e3520000 	cmp	r2, #0
    82e4:	012fff1e 	bxeq	lr
    82e8:	eaffffe3 	b	827c <_init+0x2c>
    82ec:	00008200 	.word	0x00008200
    82f0:	00000018 	.word	0x00000018

000082f4 <__do_global_dtors_aux>:
    82f4:	e59f3010 	ldr	r3, [pc, #16]	; 830c <__do_global_dtors_aux+0x18>
    82f8:	e5d32000 	ldrb	r2, [r3]
    82fc:	e3520000 	cmp	r2, #0
    8300:	03a02001 	moveq	r2, #1
    8304:	05c32000 	strbeq	r2, [r3]
    8308:	e12fff1e 	bx	lr
    830c:	00010508 	.word	0x00010508

00008310 <frame_dummy>:
    8310:	e59f0020 	ldr	r0, [pc, #32]	; 8338 <frame_dummy+0x28>
    8314:	e92d4008 	push	{r3, lr}
    8318:	e5903000 	ldr	r3, [r0]
    831c:	e3530000 	cmp	r3, #0
    8320:	08bd8008 	popeq	{r3, pc}
    8324:	e59f3010 	ldr	r3, [pc, #16]	; 833c <frame_dummy+0x2c>
    8328:	e3530000 	cmp	r3, #0
    832c:	08bd8008 	popeq	{r3, pc}
    8330:	e12fff33 	blx	r3
    8334:	e8bd8008 	pop	{r3, pc}
    8338:	000103f4 	.word	0x000103f4
    833c:	00000000 	.word	0x00000000

00008340 <main>:
    8340:	e52db004 	push	{fp}		; (str fp, [sp, #-4]!)
    8344:	e28db000 	add	fp, sp, #0
    8348:	e24dd00c 	sub	sp, sp, #12
    834c:	e3a03001 	mov	r3, #1
    8350:	e50b3008 	str	r3, [fp, #-8]
    8354:	e3a03002 	mov	r3, #2
    8358:	e50b300c 	str	r3, [fp, #-12]
    835c:	e3a03000 	mov	r3, #0
    8360:	e1a00003 	mov	r0, r3
    8364:	e28bd000 	add	sp, fp, #0
    8368:	e8bd0800 	ldmfd	sp!, {fp}
    836c:	e12fff1e 	bx	lr

00008370 <__libc_csu_init>:
    8370:	e92d45f8 	push	{r3, r4, r5, r6, r7, r8, sl, lr}
    8374:	e59f504c 	ldr	r5, [pc, #76]	; 83c8 <__libc_csu_init+0x58>
    8378:	e59fa04c 	ldr	sl, [pc, #76]	; 83cc <__libc_csu_init+0x5c>
    837c:	e08f5005 	add	r5, pc, r5
    8380:	e08fa00a 	add	sl, pc, sl
    8384:	e065a00a 	rsb	sl, r5, sl
    8388:	e1a06000 	mov	r6, r0
    838c:	e1a07001 	mov	r7, r1
    8390:	e1a08002 	mov	r8, r2
    8394:	ebffffad 	bl	8250 <_init>
    8398:	e1b0a14a 	asrs	sl, sl, #2
    839c:	08bd85f8 	popeq	{r3, r4, r5, r6, r7, r8, sl, pc}
    83a0:	e3a04000 	mov	r4, #0
    83a4:	e4953004 	ldr	r3, [r5], #4
    83a8:	e1a00006 	mov	r0, r6
    83ac:	e1a01007 	mov	r1, r7
    83b0:	e1a02008 	mov	r2, r8
    83b4:	e2844001 	add	r4, r4, #1
    83b8:	e12fff33 	blx	r3
    83bc:	e154000a 	cmp	r4, sl
    83c0:	1afffff7 	bne	83a4 <__libc_csu_init+0x34>
    83c4:	e8bd85f8 	pop	{r3, r4, r5, r6, r7, r8, sl, pc}
    83c8:	00008068 	.word	0x00008068
    83cc:	00008068 	.word	0x00008068

000083d0 <__libc_csu_fini>:
    83d0:	e12fff1e 	bx	lr

Disassembly of section .fini:

000083d4 <_fini>:
    83d4:	e92d4008 	push	{r3, lr}
    83d8:	e8bd8008 	pop	{r3, pc}

3、分析main函数的汇编代码

00008340 <main>:
    8340:	e52db004 	push	{fp}		; (str fp, [sp, #-4]!)
    8344:	e28db000 	add	fp, sp, #0
    8348:	e24dd00c 	sub	sp, sp, #12
    834c:	e3a03001 	mov	r3, #1
    8350:	e50b3008 	str	r3, [fp, #-8]
    8354:	e3a03002 	mov	r3, #2
    8358:	e50b300c 	str	r3, [fp, #-12]
    835c:	e3a03000 	mov	r3, #0
    8360:	e1a00003 	mov	r0, r3
    8364:	e28bd000 	add	sp, fp, #0
    8368:	e8bd0800 	ldmfd	sp!, {fp}
    836c:	e12fff1e 	bx	lr

第一列：汇编命令地址

第二列：汇编二进制代码

第三列：汇编指令

第四列：；分号代表注释

 

 r0用作保存返回值

bx 跳转指令

lr用于保存函数返回地址