汇编下循环对数组访问的分析

C代码

DWORD FindRole(PDWORD pRoleArray, int Roleid);
static PDWORD  pRoleAddrArray=NULL;
int main()
{

	pRoleAddrArray = (PDWORD) malloc(sizeof(DWORD)*8);
	for (int i = 0; i < 8; i++)
	{
		pRoleAddrArray[i] = 0x11111111 * i ;
	}
	DWORD role = FindRole(pRoleAddrArray,6);
	printf("role=%x\n", role);
	getchar();
}
DWORD FindRole(PDWORD pRoleAddrArray,int Roleid)
{
	for (int i = 0; i < 8; i++)
	{
		if (i == Roleid)
		{
			return pRoleAddrArray[i];
		}
	}
}

FindRole的汇编代码

push ebp
mov ebp,esp
sub esp,44
push ebx
push esi
push edi
mov dword ptr ss:[ebp-4],0			//int i=0;
jmp x86test.2E1603					//大于等于则直接返回
mov eax,dword ptr ss:[ebp-4]
add eax,1
mov dword ptr ss:[ebp-4],eax
cmp dword ptr ss:[ebp-4],8			//i和8比较
jge x86test.2E1621					//不相同就跳走
mov eax,dword ptr ss:[ebp-4]
cmp eax,dword ptr ss:[ebp+C]
jne x86test.2E161F
lfence 
mov eax,dword ptr ss:[ebp-4]
mov ecx,dword ptr ss:[ebp+8]		//[ebp+8]是数组基址
mov eax,dword ptr ds:[ecx+eax*4]	//[数组基址+i*4]
jmp x86test.2E1621
jmp x86test.2E15FA
pop edi
pop esi
pop ebx
mov esp,ebp
pop ebp
ret 

main函数的汇编代码

push ebp
mov ebp,esp
sub esp,48
push ebx
push esi
push edi
push 20										//分配20字节
call dword ptr ds:[<&malloc>]				//malloc
add esp,4
mov dword ptr ds:[<pRoleAddrArray>],eax		//取得返回值给全局变量
mov dword ptr ss:[ebp-4],0
jmp x86test.2E171B
mov eax,dword ptr ss:[ebp-4]
add eax,1
mov dword ptr ss:[ebp-4],eax
cmp dword ptr ss:[ebp-4],8					//i和8比较
jge x86test.2E1736							//大于等于8就跳走去执行FindRole了
imul eax,dword ptr ss:[ebp-4],11111111		//eax = i*0x11111111;
mov ecx,dword ptr ss:[ebp-4]				//ecx = i;
mov edx,dword ptr ds:[<pRoleAddrArray>]		//edx = 数组基址；
mov dword ptr ds:[edx+ecx*4],eax			//[数组基址+i*4] = i*0x11111111;
jmp x86test.2E1712
push 6
mov eax,dword ptr ds:[<pRoleAddrArray>]
push eax
call x86test.2E110E
add esp,8
mov dword ptr ss:[ebp-8],eax
mov eax,dword ptr ss:[ebp-8]
push eax
push x86test.2E5B30
call x86test.2E10AF
add esp,8
call dword ptr ds:[<&getchar>]
xor eax,eax
pop edi
pop esi
pop ebx
mov esp,ebp
pop ebp
ret 

关键语句

//数组初始化的时候
imul eax,dword ptr ss:[ebp-4],11111111		//eax = i*0x11111111;
mov ecx,dword ptr ss:[ebp-4]				//ecx = i;
mov edx,dword ptr ds:[<pRoleAddrArray>]		//edx = 数组基址；
mov dword ptr ds:[edx+ecx*4],eax			//[数组基址+i*4] = i*0x11111111;

//去数组的值的时候
mov ecx,dword ptr ss:[ebp+8]		//[ebp+8]是数组基址
mov eax,dword ptr ds:[ecx+eax*4]	//[数组基址+i*4]

数组的取值方式总结为
数组成员字节数 [数组基址+数组下标*数组成员字节数]
没什么意思