逆向-beginners之数组溢出

最新推荐文章于 2024-10-08 16:04:22 发布

xiaozhiwise

最新推荐文章于 2024-10-08 16:04:22 发布

阅读量927

点赞数

分类专栏： Assembly 文章标签：汇编

本文链接：https://blog.csdn.net/xiaozhiwise/article/details/133157333

版权

Assembly 专栏收录该内容

475 篇文章 3 订阅

订阅专栏

#include <stdio.h>

int main()
{
int a[20];
int i;

   for (i = 0; i < 20; i++) {
       a[i] = i * 2;
   }

printf("a[20] = %d\n", a[20]); // overflow

return 0;
}

#if 0
/*
* intel
*/
0000000000001169 <main>:
    1169:   f3 0f 1e fa             endbr64
    116d:   55                      push   %rbp
    116e:   48 89 e5                mov    %rsp,%rbp
    1171:   48 83 ec 70             sub    $0x70,%rsp
    1175:   64 48 8b 04 25 28 00    mov    %fs:0x28,%rax
    117c:   00 00
    117e:   48 89 45 f8             mov    %rax,-0x8(%rbp)
    1182:   31 c0                   xor    %eax,%eax
    1184:   c7 45 9c 00 00 00 00    movl   $0x0,-0x64(%rbp)
    118b:   eb 13                   jmp    11a0 <main+0x37> // for start
    118d:   8b 45 9c                mov    -0x64(%rbp),%eax
    1190:   8d 14 00                lea    (%rax,%rax,1),%edx
    1193:   8b 45 9c                mov    -0x64(%rbp),%eax
    1196:   48 98                   cltq               // 将%eax转换成四字
    1198:   89 54 85 a0             mov    %edx,-0x60(%rbp,%rax,4)
    119c:   83 45 9c 01             addl   $0x1,-0x64(%rbp)
    11a0:   83 7d 9c 13             cmpl   $0x13,-0x64(%rbp)
    11a4:   7e e7                   jle    118d <main+0x24> // for end
    11a6:   8b 45 f0                mov    -0x10(%rbp),%eax
    11a9:   89 c6                   mov    %eax,%esi
    11ab:   48 8d 3d 52 0e 00 00    lea    0xe52(%rip),%rdi        # 2004 <_IO_stdin_used+0x4>
    11b2:   b8 00 00 00 00          mov    $0x0,%eax
    11b7:   e8 b4 fe ff ff          callq 1070 <printf@plt>
    11bc:   b8 00 00 00 00          mov    $0x0,%eax
    11c1:   48 8b 4d f8             mov    -0x8(%rbp),%rcx
    11c5:   64 48 33 0c 25 28 00    xor    %fs:0x28,%rcx
    11cc:   00 00
    11ce:   74 05                   je     11d5 <main+0x6c>
    11d0:   e8 8b fe ff ff          callq 1060 <__stack_chk_fail@plt>
    11d5:   c9                      leaveq
    11d6:   c3                      retq
    11d7:   66 0f 1f 84 00 00 00    nopw   0x0(%rax,%rax,1)
    11de:   00 00

/*
* arm
*/
000000000040055c <main>:
40055c:   a9b97bfd    stp   x29, x30, [sp, #-112]!
400560:   910003fd    mov   x29, sp
400564:   b9006fbf    str   wzr, [x29, #108]
400568:   1400000a    b   400590 <main+0x34>      // for start
40056c:   b9406fa0    ldr   w0, [x29, #108]
400570:   531f7802    lsl   w2, w0, #1
400574:   b9806fa0    ldrsw   x0, [x29, #108]
400578:   d37ef400    lsl   x0, x0, #2
40057c:   910063a1    add   x1, x29, #0x18
400580:   b8206822    str   w2, [x1, x0]
400584:   b9406fa0    ldr   w0, [x29, #108]
400588:   11000400    add   w0, w0, #0x1
40058c:   b9006fa0    str   w0, [x29, #108]
400590:   b9406fa0    ldr   w0, [x29, #108]
400594:   71004c1f    cmp   w0, #0x13
400598:   54fffead    b.le   40056c <main+0x10> // for end
40059c:   b9406ba1    ldr   w1, [x29, #104]
4005a0:   90000000    adrp   x0, 400000 <_init-0x3e8>
4005a4:   9119a000    add   x0, x0, #0x668
4005a8:   97ffffaa    bl   400450 <printf@plt>
4005ac:   52800000    mov   w0, #0x0                      // #0
4005b0:   a8c77bfd    ldp   x29, x30, [sp], #112
4005b4:   d65f03c0    ret