1、汇编源码fun.c
#include<stdio.h>
int g_a=1;
int fun(int p,int q)
{
int a =1;
return a+p+q;
}
int main()
{
int a =1;
int b =2;
fun(a,b);
return 0;
}
2、反汇编
a.out: file format elf32-littlearm
Disassembly of section .init:
00008250 <_init>:
8250: e92d4008 push {r3, lr}
8254: eb00001d bl 82d0 <call_weak_fn>
8258: e8bd8008 pop {r3, pc}
Disassembly of section .plt:
0000825c <.plt>:
825c: e52de004 push {lr} ; (str lr, [sp, #-4]!)
8260: e59fe004 ldr lr, [pc, #4] ; 826c <_init+0x1c>
8264: e08fe00e add lr, pc, lr
8268: e5bef008 ldr pc, [lr, #8]!
826c: 000082bc .word 0x000082bc
8270: e28fc600 add ip, pc, #0, 12
8274: e28cca08 add ip, ip, #8, 20 ; 0x8000
8278: e5bcf2bc ldr pc, [ip, #700]! ; 0x2bc
827c: e28fc600 add ip, pc, #0, 12
8280: e28cca08 add ip, ip, #8, 20 ; 0x8000
8284: e5bcf2b4 ldr pc, [ip, #692]! ; 0x2b4
8288: e28fc600 add ip, pc, #0, 12
828c: e28cca08 add ip, ip, #8, 20 ; 0x8000
8290: e5bcf2ac ldr pc, [ip, #684]! ; 0x2ac
Disassembly of section .text:
00008294 <_start>:
8294: e3a0b000 mov fp, #0
8298: e3a0e000 mov lr, #0
829c: e49d1004 pop {r1} ; (ldr r1, [sp], #4)
82a0: e1a0200d mov r2, sp
82a4: e52d2004 push {r2} ; (str r2, [sp, #-4]!)
82a8: e52d0004 push {r0} ; (str r0, [sp, #-4]!)
82ac: e59fc010 ldr ip, [pc, #16] ; 82c4 <_start+0x30>
82b0: e52dc004 push {ip} ; (str ip, [sp, #-4]!)
82b4: e59f000c ldr r0, [pc, #12] ; 82c8 <_start+0x34>
82b8: e59f300c ldr r3, [pc, #12] ; 82cc <_start+0x38>
82bc: ebffffeb bl 8270 <_init+0x20>
82c0: ebfffff0 bl 8288 <_init+0x38>
82c4: 00008418 .word 0x00008418
82c8: 00008380 .word 0x00008380
82cc: 000083b8 .word 0x000083b8
000082d0 <call_weak_fn>:
82d0: e59f3014 ldr r3, [pc, #20] ; 82ec <call_weak_fn+0x1c>
82d4: e59f2014 ldr r2, [pc, #20] ; 82f0 <call_weak_fn+0x20>
82d8: e08f3003 add r3, pc, r3
82dc: e7932002 ldr r2, [r3, r2]
82e0: e3520000 cmp r2, #0
82e4: 012fff1e bxeq lr
82e8: eaffffe3 b 827c <_init+0x2c>
82ec: 00008248 .word 0x00008248
82f0: 00000018 .word 0x00000018
000082f4 <__do_global_dtors_aux>:
82f4: e59f3010 ldr r3, [pc, #16] ; 830c <__do_global_dtors_aux+0x18>
82f8: e5d32000 ldrb r2, [r3]
82fc: e3520000 cmp r2, #0
8300: 03a02001 moveq r2, #1
8304: 05c32000 strbeq r2, [r3]
8308: e12fff1e bx lr
830c: 00010550 .word 0x00010550
00008310 <frame_dummy>:
8310: e59f0020 ldr r0, [pc, #32] ; 8338 <frame_dummy+0x28>
8314: e92d4008 push {r3, lr}
8318: e5903000 ldr r3, [r0]
831c: e3530000 cmp r3, #0
8320: 08bd8008 popeq {r3, pc}
8324: e59f3010 ldr r3, [pc, #16] ; 833c <frame_dummy+0x2c>
8328: e3530000 cmp r3, #0
832c: 08bd8008 popeq {r3, pc}
8330: e12fff33 blx r3
8334: e8bd8008 pop {r3, pc}
8338: 0001043c .word 0x0001043c
833c: 00000000 .word 0x00000000
00008340 <fun>:
8340: e52db004 push {fp} ; (str fp, [sp, #-4]!)
8344: e28db000 add fp, sp, #0
8348: e24dd014 sub sp, sp, #20
834c: e50b0010 str r0, [fp, #-16]
8350: e50b1014 str r1, [fp, #-20]
8354: e3a03001 mov r3, #1
8358: e50b3008 str r3, [fp, #-8]
835c: e51b2008 ldr r2, [fp, #-8]
8360: e51b3010 ldr r3, [fp, #-16]
8364: e0822003 add r2, r2, r3
8368: e51b3014 ldr r3, [fp, #-20]
836c: e0823003 add r3, r2, r3
8370: e1a00003 mov r0, r3
8374: e28bd000 add sp, fp, #0
8378: e8bd0800 ldmfd sp!, {fp}
837c: e12fff1e bx lr
00008380 <main>:
8380: e92d4800 push {fp, lr}
8384: e28db004 add fp, sp, #4
8388: e24dd008 sub sp, sp, #8
838c: e3a03001 mov r3, #1
8390: e50b3008 str r3, [fp, #-8]
8394: e3a03002 mov r3, #2
8398: e50b300c str r3, [fp, #-12]
839c: e51b0008 ldr r0, [fp, #-8]
83a0: e51b100c ldr r1, [fp, #-12]
83a4: ebffffe5 bl 8340 <fun>
83a8: e3a03000 mov r3, #0
83ac: e1a00003 mov r0, r3
83b0: e24bd004 sub sp, fp, #4
83b4: e8bd8800 pop {fp, pc}
000083b8 <__libc_csu_init>:
83b8: e92d45f8 push {r3, r4, r5, r6, r7, r8, sl, lr}
83bc: e59f504c ldr r5, [pc, #76] ; 8410 <__libc_csu_init+0x58>
83c0: e59fa04c ldr sl, [pc, #76] ; 8414 <__libc_csu_init+0x5c>
83c4: e08f5005 add r5, pc, r5
83c8: e08fa00a add sl, pc, sl
83cc: e065a00a rsb sl, r5, sl
83d0: e1a06000 mov r6, r0
83d4: e1a07001 mov r7, r1
83d8: e1a08002 mov r8, r2
83dc: ebffff9b bl 8250 <_init>
83e0: e1b0a14a asrs sl, sl, #2
83e4: 08bd85f8 popeq {r3, r4, r5, r6, r7, r8, sl, pc}
83e8: e3a04000 mov r4, #0
83ec: e4953004 ldr r3, [r5], #4
83f0: e1a00006 mov r0, r6
83f4: e1a01007 mov r1, r7
83f8: e1a02008 mov r2, r8
83fc: e2844001 add r4, r4, #1
8400: e12fff33 blx r3
8404: e154000a cmp r4, sl
8408: 1afffff7 bne 83ec <__libc_csu_init+0x34>
840c: e8bd85f8 pop {r3, r4, r5, r6, r7, r8, sl, pc}
8410: 00008068 .word 0x00008068
8414: 00008068 .word 0x00008068
00008418 <__libc_csu_fini>:
8418: e12fff1e bx lr
Disassembly of section .fini:
0000841c <_fini>:
841c: e92d4008 push {r3, lr}
8420: e8bd8008 pop {r3, pc}
3、分析主要部分
00008340 <fun>:
8340: e52db004 push {fp} ; (str fp, [sp, #-4]!)
8344: e28db000 add fp, sp, #0
8348: e24dd014 sub sp, sp, #20
834c: e50b0010 str r0, [fp, #-16]
8350: e50b1014 str r1, [fp, #-20]
8354: e3a03001 mov r3, #1
8358: e50b3008 str r3, [fp, #-8]
835c: e51b2008 ldr r2, [fp, #-8]
8360: e51b3010 ldr r3, [fp, #-16]
8364: e0822003 add r2, r2, r3
8368: e51b3014 ldr r3, [fp, #-20]
836c: e0823003 add r3, r2, r3
8370: e1a00003 mov r0, r3
8374: e28bd000 add sp, fp, #0
8378: e8bd0800 ldmfd sp!, {fp}
837c: e12fff1e bx lr
00008380 <main>:
8380: e92d4800 push {fp, lr}
8384: e28db004 add fp, sp, #4
8388: e24dd008 sub sp, sp, #8
838c: e3a03001 mov r3, #1
8390: e50b3008 str r3, [fp, #-8]
8394: e3a03002 mov r3, #2
8398: e50b300c str r3, [fp, #-12]
839c: e51b0008 ldr r0, [fp, #-8]
83a0: e51b100c ldr r1, [fp, #-12]
83a4: ebffffe5 bl 8340 <fun>
83a8: e3a03000 mov r3, #0
83ac: e1a00003 mov r0, r3
83b0: e24bd004 sub sp, fp, #4
83b4: e8bd8800 pop {fp, pc}
#include<stdio.h>
int g_a=1;
int fun(int p,int q)
{
int a =1;
return a+p+q;
}
int main()
{
int a =1;
int b =2;
fun(a,b);
return 0;
}
--------main
原来的fp值
--------main_fp
lr
--------sp
a = 1
--------sp-4
b = 2
--------new sp = sp-8
--------fun
main函数的fp
--------fun_fp sp
--------sp-4
1
--------sp-8
--------sp-12
1
--------sp-16
2
--------sp-20 new sp32位机器push和pop的字节数一般为4
4、超过四个变量的函数传递
#include<stdio.h>
int g_a=1;
int fun(int p,int q,int a,int b,int c,int d)
{
return p+q+a+b+c+d;
}
int main()
{
int a =1;
int b =2;
fun(a,b,a,b,a,b);
return 0;
}
00008398 <main>:
8398: e92d4800 push {fp, lr}
839c: e28db004 add fp, sp, #4
83a0: e24dd010 sub sp, sp, #16
83a4: e3a03001 mov r3, #1
83a8: e50b3008 str r3, [fp, #-8]
83ac: e3a03002 mov r3, #2
83b0: e50b300c str r3, [fp, #-12]
83b4: e51b3008 ldr r3, [fp, #-8]
83b8: e58d3000 str r3, [sp] -----------保存第5个变量于main函数栈中
83bc: e51b300c ldr r3, [fp, #-12]
83c0: e58d3004 str r3, [sp, #4] -----------保存第6个变量于main函数栈中
83c4: e51b0008 ldr r0, [fp, #-8]
83c8: e51b100c ldr r1, [fp, #-12]
83cc: e51b2008 ldr r2, [fp, #-8]
83d0: e51b300c ldr r3, [fp, #-12]
83d4: ebffffd9 bl 8340 <fun>
83d8: e3a03000 mov r3, #0
83dc: e1a00003 mov r0, r3
83e0: e24bd004 sub sp, fp, #4
83e4: e8bd8800 pop {fp, pc}
00008340 <fun>:
8340: e52db004 push {fp} ; (str fp, [sp, #-4]!)
8344: e28db000 add fp, sp, #0
8348: e24dd014 sub sp, sp, #20
834c: e50b0008 str r0, [fp, #-8]
8350: e50b100c str r1, [fp, #-12]
8354: e50b2010 str r2, [fp, #-16]
8358: e50b3014 str r3, [fp, #-20]
835c: e51b2008 ldr r2, [fp, #-8]
8360: e51b300c ldr r3, [fp, #-12]
8364: e0822003 add r2, r2, r3
8368: e51b3010 ldr r3, [fp, #-16]
836c: e0822003 add r2, r2, r3
8370: e51b3014 ldr r3, [fp, #-20]
8374: e0822003 add r2, r2, r3
8378: e59b3004 ldr r3, [fp, #4] -------从函数栈中取值
837c: e0822003 add r2, r2, r3
8380: e59b3008 ldr r3, [fp, #8] -------从函数栈中取值
8384: e0823003 add r3, r2, r3
8388: e1a00003 mov r0, r3
838c: e28bd000 add sp, fp, #0
8390: e8bd0800 ldmfd sp!, {fp}
8394: e12fff1e bx lr
---------main
fp
--------- main_fp
lr
---------sp main_fp-4
a=1
---------sp-4 main_fp-8
b=2
---------sp-8 main_fp-12
2
---------sp-12 new sp+4 main_fp-16
1
---------new sp=sp-16 main_fp-20
r0=1-----p
r1=2-----q
r2=1-----a
r3=2-----b
[sp]-----c
[sp+4]---d
---------fun
fp
---------fun_fp sp
---------fun_fp-4 sp-4
1
---------fun_fp-8 sp-8
2
---------fun_fp-12 sp-12
1
---------fun_fp-16 sp-16
2
---------fun_fp-20 new sp = sp-20
超过4个变量的参数专递一般将额外的变量压入栈内存
2万+
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
