逆向-beginners之函数指针

xiaozhiwise

已于 2023-09-23 18:14:35 修改

阅读量946

点赞数

分类专栏： Assembly 文章标签：汇编

于 2023-09-23 18:14:12 首次发布

本文链接：https://blog.csdn.net/xiaozhiwise/article/details/133213142

版权

Assembly 专栏收录该内容

441 篇文章 3 订阅

订阅专栏

#include <stdio.h>
#include <stdlib.h>

int comp(const void * _a, const void * _b)
{
const int *a = (const int *)_a;
const int *b = (const int *)_b;

   if (*a == *b)
           return 0;
   else
           if (*a < *b)
                   return -1;
           else
                   return 1;
}

int main(int argc, char * argv[])
{
int numbers[10] = {1892, 45, 200, -98, 4087, 5, -12345, 1087, 88, -100000};
int i;

   /* sort the array */
   qsort(numbers, 10, sizeof(int), comp);       // qsort函数内循环
   for (i = 0; i < 9; i++)
           printf("Number = %d\n", numbers[i]);

   return 0;
}
/*
   Number = -100000
   Number = -12345
   Number = -98
   Number = 5
   Number = 45
   Number = 88
   Number = 200
   Number = 1087
   Number = 1892
*/

#if 0
/*
* intel
*/
0x555555555189
0000000000001189 <comp>:
1189:   f3 0f 1e fa     endbr64                   // rsp=0x7fffffffde78
118d:   55    push %rbp               // 0x7fffffffde70
118e:   48 89 e5    mov %rsp,%rbp       // rsp=rbp=0x7fffffffde70
1191:   48 89 7d e8     mov %rdi,-0x18(%rbp)   // 0x7fffffffde58: 0x00007fffffffe0f0
1195:   48 89 75 e0     mov %rsi,-0x20(%rbp)   // 0x7fffffffde50: 0x00007fffffffe0f4
1199:   48 8b 45 e8     mov -0x18(%rbp),%rax   // rax=0x7fffffffe0f0
119d:   48 89 45 f0     mov %rax,-0x10(%rbp)   // 0x7fffffffde60: 0x00007fffffffe0f0
11a1:   48 8b 45 e0     mov -0x20(%rbp),%rax   // rax=0x7fffffffe0f4
11a5:   48 89 45 f8     mov %rax,-0x8(%rbp)   // 0x7fffffffde68: 0x00007fffffffe0f4
11a9:   48 8b 45 f0     mov -0x10(%rbp),%rax   // 0x7fffffffe0f0
11ad:   8b 10     mov (%rax),%edx       // 0x7fffffffe0f0: 0x0000002d00000764   edx=0x764
11af:   48 8b 45 f8     mov -0x8(%rbp),%rax   // rax=0x7fffffffe0f4
11b3:   8b 00     mov (%rax),%eax       // 0x7fffffffe0f4: 0x000000c80000002d   eax=0x2d
11b5:   39 c2     cmp %eax,%edx
11b7:   75 07     jne 11c0 <comp+0x37>
11b9:   b8 00 00 00 00    mov $0x0,%eax
11be:   eb 1c     jmp 11dc <comp+0x53>
11c0:   48 8b 45 f0     mov -0x10(%rbp),%rax   // 0x7fffffffe0f0
11c4:   8b 10     mov (%rax),%edx       // 0x7fffffffe0f0: 0x0000002d00000764   edx=0x764
11c6:   48 8b 45 f8     mov -0x8(%rbp),%rax   // 0x7fffffffe0f4
11ca:   8b 00     mov (%rax),%eax       // 0x7fffffffe0f4: 0x000000c80000002d   eax=0x2d
11cc:   39 c2     cmp %eax,%edx
11ce:   7d 07     jge 11d7 <comp+0x4e>
11d0:   b8 ff ff ff ff    mov $0xffffffff,%eax
11d5:   eb 05     jmp 11dc <comp+0x53>
11d7:   b8 01 00 00 00    mov $0x1,%eax       // eax=1
11dc:   5d    pop %rbp
11dd:   c3    retq

00000000000011de <main>:
11de:   f3 0f 1e fa     endbr64                   // rsp=0x7fffffffe128
11e2:   55    push %rbp               // rsp=0x7fffffffe120
11e3:   48 89 e5    mov %rsp,%rbp       // 0x7fffffffe120
11e6:   48 83 ec 50     sub $0x50,%rsp       // 0x7fffffffe0d0
11ea:   89 7d bc    mov %edi,-0x44(%rbp)   // 0x00000001
11ed:   48 89 75 b0     mov %rsi,-0x50(%rbp)   // 0x7fffffffe0d0: 0x00007fffffffe218
11f1:   64 48 8b 04 25 28 00    mov %fs:0x28,%rax
11f8:   00 00
11fa:   48 89 45 f8     mov %rax,-0x8(%rbp)   // 0x7fffffffe118: 0xe62783cd21946100
11fe:   31 c0     xor %eax,%eax
1200:   c7 45 d0 64 07 00 00    movl $0x764,-0x30(%rbp)   // 0x7fffffffe0f0: 0x00007fff00000764
1207:   c7 45 d4 2d 00 00 00    movl $0x2d,-0x2c(%rbp)   // 0x7fffffffe0f4: 0x555552b00000002d
120e:   c7 45 d8 c8 00 00 00    movl $0xc8,-0x28(%rbp)   // 0x7fffffffe0f8: 0x00005555000000c8
1215:   c7 45 dc 9e ff ff ff    movl $0xffffff9e,-0x24(%rbp)   // 0x7fffffffe0fc: 0x00000000ffffff9e
121c:   c7 45 e0 f7 0f 00 00    movl $0xff7,-0x20(%rbp)       // 0x7fffffffe100: 0x0000000000000ff7
1223:   c7 45 e4 05 00 00 00    movl $0x5,-0x1c(%rbp)           // 0x7fffffffe104: 0x555550a000000005
122a:   c7 45 e8 c7 cf ff ff    movl $0xffffcfc7,-0x18(%rbp)   // 0x7fffffffe108: 0x00005555ffffcfc7
1231:   c7 45 ec 3f 04 00 00    movl $0x43f,-0x14(%rbp)       // 0x7fffffffe10c: 0xffffe2100000043f
1238:   c7 45 f0 58 00 00 00    movl $0x58,-0x10(%rbp)       // 0x7fffffffe110: 0x00007fff00000058
123f:   c7 45 f4 60 79 fe ff    movl $0xfffe7960,-0xc(%rbp)   // 0x7fffffffe114: 0x21946100fffe7960
1246:   48 8d 45 d0     lea -0x30(%rbp),%rax           // 0x7fffffffe0f0: 0x0000002d00000764   rax=0x7fffffffe0f0
124a:   48 8d 0d 38 ff ff ff    lea -0xc8(%rip),%rcx # 1189 <comp>   rcx=0x555555555189
1251:   ba 04 00 00 00    mov $0x4,%edx       // edx=4
1256:   be 0a 00 00 00    mov $0xa,%esi
125b:   48 89 c7    mov %rax,%rdi       // rdi=0x7fffffffe0f0
125e:   e8 0d fe ff ff    callq 1070 <qsort@plt>   // 0x0000555555555189:comp

1263:   c7 45 cc 00 00 00 00    movl $0x0,-0x34(%rbp)
126a:   eb 20     jmp 128c <main+0xae>
126c:   8b 45 cc    mov -0x34(%rbp),%eax
126f:   48 98     cltq
1271:   8b 44 85 d0     mov -0x30(%rbp,%rax,4),%eax
1275:   89 c6     mov %eax,%esi
1277:   48 8d 3d 86 0d 00 00    lea 0xd86(%rip),%rdi # 2004 <_IO_stdin_used+0x4>
127e:   b8 00 00 00 00    mov $0x0,%eax
1283:   e8 08 fe ff ff    callq 1090 <printf@plt>
1288:   83 45 cc 01     addl $0x1,-0x34(%rbp)
128c:   83 7d cc 08     cmpl $0x8,-0x34(%rbp)
1290:   7e da     jle 126c <main+0x8e>
1292:   b8 00 00 00 00    mov $0x0,%eax
1297:   48 8b 55 f8     mov -0x8(%rbp),%rdx
129b:   64 48 33 14 25 28 00    xor %fs:0x28,%rdx
12a2:   00 00
12a4:   74 05     je 12ab <main+0xcd>
12a6:   e8 d5 fd ff ff    callq 1080 <__stack_chk_fail@plt>
12ab:   c9    leaveq
12ac:   c3    retq
12ad:   0f 1f 00    nopl (%rax)

/*
* arm
*/
00000000004005ac <comp>:
4005ac:   d10083ff    sub   sp, sp, #0x20
4005b0:   f90007e0    str   x0, [sp, #8]
4005b4:   f90003e1    str   x1, [sp]
4005b8:   f94007e0    ldr   x0, [sp, #8]
4005bc:   f9000fe0    str   x0, [sp, #24]
4005c0:   f94003e0    ldr   x0, [sp]
4005c4:   f9000be0    str   x0, [sp, #16]
4005c8:   f9400fe0    ldr   x0, [sp, #24]
4005cc:   b9400001    ldr   w1, [x0]
4005d0:   f9400be0    ldr   x0, [sp, #16]
4005d4:   b9400000    ldr   w0, [x0]
4005d8:   6b00003f    cmp   w1, w0
4005dc:   54000061    b.ne   4005e8 <comp+0x3c> // b.any
4005e0:   52800000    mov   w0, #0x0    // #0
4005e4:   1400000a    b   40060c <comp+0x60>
4005e8:   f9400fe0    ldr   x0, [sp, #24]
4005ec:   b9400001    ldr   w1, [x0]
4005f0:   f9400be0    ldr   x0, [sp, #16]
4005f4:   b9400000    ldr   w0, [x0]
4005f8:   6b00003f    cmp   w1, w0
4005fc:   5400006a    b.ge   400608 <comp+0x5c> // b.tcont
400600:   12800000    mov   w0, #0xffffffff     // #-1
400604:   14000002    b   40060c <comp+0x60>
400608:   52800020    mov   w0, #0x1    // #1
40060c:   910083ff    add   sp, sp, #0x20
400610:   d65f03c0    ret

0000000000400614 <main>:
400614:   a9bb7bfd    stp   x29, x30, [sp, #-80]!
400618:   910003fd    mov   x29, sp
40061c:   b9001fa0    str   w0, [x29, #28]
400620:   f9000ba1    str   x1, [x29, #16]
400624:   90000000    adrp   x0, 400000 <_init-0x428>
400628:   911dc001    add   x1, x0, #0x770
40062c:   910083a0    add   x0, x29, #0x20
400630:   a9400c22    ldp   x2, x3, [x1]
400634:   a9000c02    stp   x2, x3, [x0]
400638:   a9410c22    ldp   x2, x3, [x1, #16]
40063c:   a9010c02    stp   x2, x3, [x0, #16]
400640:   f9401021    ldr   x1, [x1, #32]
400644:   f9001001    str   x1, [x0, #32]
400648:   90000000    adrp   x0, 400000 <_init-0x428>
40064c:   9116b001    add   x1, x0, #0x5ac
400650:   910083a0    add   x0, x29, #0x20
400654:   aa0103e3    mov   x3, x1
400658:   d2800082    mov   x2, #0x4    // #4
40065c:   d2800141    mov   x1, #0xa    // #10
400660:   97ffff80    bl   400460 <qsort@plt>
400664:   b9004fbf    str   wzr, [x29, #76]
400668:   1400000b    b   400694 <main+0x80>
40066c:   b9804fa0    ldrsw   x0, [x29, #76]
400670:   d37ef400    lsl   x0, x0, #2
400674:   910083a1    add   x1, x29, #0x20
400678:   b8606821    ldr   w1, [x1, x0]
40067c:   90000000    adrp   x0, 400000 <_init-0x428>
400680:   911d8000    add   x0, x0, #0x760
400684:   97ffff87    bl   4004a0 <printf@plt>
400688:   b9404fa0    ldr   w0, [x29, #76]
40068c:   11000400    add   w0, w0, #0x1
400690:   b9004fa0    str   w0, [x29, #76]
400694:   b9404fa0    ldr   w0, [x29, #76]
400698:   7100201f    cmp   w0, #0x8
40069c:   54fffe8d    b.le   40066c <main+0x58>
4006a0:   52800000    mov   w0, #0x0    // #0
4006a4:   a8c57bfd    ldp   x29, x30, [sp], #80
4006a8:   d65f03c0    ret
4006ac:   00000000    .inst   0x00000000 ; undefined