int _tmain(int argc, _TCHAR* argv[])
{
002B1400 55 push ebp
002B1401 8B EC mov ebp,esp
002B1403 81 EC C0 00 00 00 sub esp,0C0h
002B1409 53 push ebx
002B140A 56 push esi
002B140B 57 push edi
002B140C 8D BD 40 FF FF FF lea edi,[ebp-0C0h]
002B1412 B9 30 00 00 00 mov ecx,30h
002B1417 B8 CC CC CC CC mov eax,0CCCCCCCCh
002B141C F3 AB rep stos dword ptr es:[edi]
// 这里调用了add()函数
add();
002B141E E8 E1 FC FF FF call add (02B1104h)
// call = push + jmp
// push = sub + mov
return 0;
002B1423 33 C0 xor eax,eax
}
002B1425 5F pop edi
002B1426 5E pop esi
002B1427 5B pop ebx
002B1428 81 C4 C0 00 00 00 add esp,0C0h
002B142E 3B EC cmp ebp,esp
002B1430 E8 10 FD FF FF call __RTC_CheckEsp (02B1145h)
002B1435 8B E5 mov esp,ebp
002B1437 5D pop ebp
002B1438 C3 ret
=================================================================
void add(){
002B13C0 55 push ebp
002B13C1 8B EC mov ebp,esp
002B13C3 81 EC CC 00 00 00 sub esp,0CCh
---------------------------------------------------------------------> 开辟栈帧
002B13C9 53 push ebx
002B13CA 56 push esi
002B13CB 57 push edi
---------------------------------------------------------------------> 保存现场
002B13CC 8D BD 34 FF FF FF lea edi,[ebp-0CCh]
002B13D2 B9 33 00 00 00 mov ecx,33h
002B13D7 B8 CC CC CC CC mov eax,0CCCCCCCCh
002B13DC F3 AB rep stos dword ptr es:[edi]
--------------------------------------------------------------------> 初始化栈空间
int a = 3;
002B13DE C7 45 F8 03 00 00 00 mov dword ptr [a],3 ===>(dword ptr [ebp + 8],3 )
---------------------------------------------------------------------> 在栈空间声明一块内存并初始化(C语言中 定义一个局部变量)
}
002B13E5 5F pop edi
002B13E6 5E pop esi
002B13E7 5B pop ebx
----------------------------------------------------------------------> 恢复现场
002B13E8 8B E5 mov esp,ebp
002B13EA 5D pop ebp
// leave (与上面的两行等价)
----------------------------------------------------------------------> 恢复栈帧
002B13EB C3 ret
----------------------------------------------------------------------> call的调用·对应的返回
call = push + jmp
ret = pop + jmp
pop = mov + add
汇编地址/有效地址 | 栈的内存空间 | 基础寄存器 | 在栈上的函数 | |
edi | esp | |||
esi | esp | |||
edx | esp | |||
c | esp | |||
c | ||||
3 | (ebp+8) | |||
c | ||||
ebp | esp/(ebp) | add() | ||
return address | esp | |||
esp | ||||
ebp | main() |