代码还原动态调试之 pstree rsp+0x90

在一个新函数里，局部变量栈被引用；

r
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /usr/bin/pstree 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Breakpoint 2, 0x00005555555574b4 in ?? ()
=> 0x00005555555574b4:  83 3d ad 5f 00 00 00    cmpl   $0x0,0x5fad(%rip)        # 0x55555555d468
1: $rsp = (void *) 0x7fffffff9a00
(gdb) n
0x00005555555574bb in ?? ()
=> 0x00005555555574bb:  0f 84 d9 00 00 00       je     0x55555555759a
1: $rsp = (void *) 0x7fffffff9a00
(gdb) 
0x000055555555759a in ?? ()
=> 0x000055555555759a:  41 51   push   %r9
1: $rsp = (void *) 0x7fffffff9a00
(gdb) 
0x000055555555759c in ?? ()
=> 0x000055555555759c:  45 31 c9        xor    %r9d,%r9d
1: $rsp = (void *) 0x7fffffff99f8
(gdb) 
0x000055555555759f in ?? ()
=> 0x000055555555759f:  ff b4 24 a8 00 00 00    pushq  0xa8(%rsp)   // 1
1: $rsp = (void *) 0x7fffffff99f8
(gdb) 
0x00005555555575a6 in ?? ()
=> 0x00005555555575a6:  6a 00   pushq  $0x0     // 2
1: $rsp = (void *) 0x7fffffff99f0
(gdb) 
0x00005555555575a8 in ?? ()
=> 0x00005555555575a8:  6a 00   pushq  $0x0     // 3
1: $rsp = (void *) 0x7fffffff99e8
(gdb) 
0x00005555555575aa in ?? ()
=> 0x00005555555575aa:  f2 0f 10 44 24 68       movsd  0x68(%rsp),%xmm0
1: $rsp = (void *) 0x7fffffff99e0
(gdb) 
0x00005555555575b0 in ?? ()
=> 0x00005555555575b0:  eb ae   jmp    0x555555557560
1: $rsp = (void *) 0x7fffffff99e0
(gdb) 
0x0000555555557560 in ?? ()
=> 0x0000555555557560:  44 8b 84 24 ec 00 00 00 mov    0xec(%rsp),%r8d
1: $rsp = (void *) 0x7fffffff99e0
(gdb) 
0x0000555555557568 in ?? ()
=> 0x0000555555557568:  8b 8c 24 a4 00 00 00    mov    0xa4(%rsp),%ecx
1: $rsp = (void *) 0x7fffffff99e0
(gdb) 
0x000055555555756f in ?? ()
=> 0x000055555555756f:  89 de   mov    %ebx,%esi
1: $rsp = (void *) 0x7fffffff99e0
(gdb) 
0x0000555555557571 in ?? ()
=> 0x0000555555557571:  8b 94 24 a0 00 00 00    mov    0xa0(%rsp),%edx
1: $rsp = (void *) 0x7fffffff99e0
(gdb) 
0x0000555555557578 in ?? ()
=> 0x0000555555557578:  48 8b 7c 24 28  mov    0x28(%rsp),%rdi
1: $rsp = (void *) 0x7fffffff99e0
(gdb) 
0x000055555555757d in ?? ()
=> 0x000055555555757d:  e8 ce 1b 00 00  callq  0x555555559150
1: $rsp = (void *) 0x7fffffff99e0
(gdb) s
0x0000555555559150 in ?? ()
=> 0x0000555555559150:  41 57   push   %r15     // 4
1: $rsp = (void *) 0x7fffffff99d8
(gdb) n
0x0000555555559152 in ?? ()
=> 0x0000555555559152:  41 56   push   %r14     // 5
1: $rsp = (void *) 0x7fffffff99d0
(gdb) 
0x0000555555559154 in ?? ()
=> 0x0000555555559154:  45 89 c6        mov    %r8d,%r14d
1: $rsp = (void *) 0x7fffffff99c8
(gdb) 
0x0000555555559157 in ?? ()
=> 0x0000555555559157:  41 55   push   %r13     // 6
1: $rsp = (void *) 0x7fffffff99c8
(gdb) 
0x0000555555559159 in ?? ()
=> 0x0000555555559159:  41 89 d5        mov    %edx,%r13d
1: $rsp = (void *) 0x7fffffff99c0
(gdb) 
0x000055555555915c in ?? ()
=> 0x000055555555915c:  41 54   push   %r12     // 7
1: $rsp = (void *) 0x7fffffff99c0
(gdb) 
0x000055555555915e in ?? ()
=> 0x000055555555915e:  41 89 f4        mov    %esi,%r12d
1: $rsp = (void *) 0x7fffffff99b8
(gdb) 
0x0000555555559161 in ?? ()
=> 0x0000555555559161:  55      push   %rbp     // 8
1: $rsp = (void *) 0x7fffffff99b8
(gdb) 
0x0000555555559162 in ?? ()
=> 0x0000555555559162:  4c 89 cd        mov    %r9,%rbp
1: $rsp = (void *) 0x7fffffff99b0
(gdb) 
0x0000555555559165 in ?? ()
=> 0x0000555555559165:  53      push   %rbx     // 9
1: $rsp = (void *) 0x7fffffff99b0
(gdb) 
0x0000555555559166 in ?? ()
=> 0x0000555555559166:  48 83 ec 28     sub    $0x28,%rsp       // 14
1: $rsp = (void *) 0x7fffffff99a8
(gdb) 
0x000055555555916a in ?? ()
=> 0x000055555555916a:  48 8b 1d 17 43 00 00    mov    0x4317(%rip),%rbx        # 0x55555555d488
1: $rsp = (void *) 0x7fffffff9980
(gdb) 
0x0000555555559171 in ?? ()
=> 0x0000555555559171:  8b 44 24 68     mov    0x68(%rsp),%eax
1: $rsp = (void *) 0x7fffffff9980
(gdb) 
0x0000555555559175 in ?? ()
=> 0x0000555555559175:  89 4c 24 10     mov    %ecx,0x10(%rsp)
1: $rsp = (void *) 0x7fffffff9980
(gdb) 
0x0000555555559179 in ?? ()
=> 0x0000555555559179:  f2 0f 11 44 24 18       movsd  %xmm0,0x18(%rsp)
1: $rsp = (void *) 0x7fffffff9980
(gdb) 
0x000055555555917f in ?? ()
=> 0x000055555555917f:  89 44 24 14     mov    %eax,0x14(%rsp)
1: $rsp = (void *) 0x7fffffff9980
(gdb) 
0x0000555555559183 in ?? ()
=> 0x0000555555559183:  48 85 db        test   %rbx,%rbx
1: $rsp = (void *) 0x7fffffff9980
(gdb) 
0x0000555555559186 in ?? ()
=> 0x0000555555559186:  75 18   jne    0x5555555591a0
1: $rsp = (void *) 0x7fffffff9980
(gdb) 
0x0000555555559188 in ?? ()
=> 0x0000555555559188:  e9 3b 02 00 00  jmpq   0x5555555593c8
1: $rsp = (void *) 0x7fffffff9980
(gdb) 
0x00005555555593c8 in ?? ()
=> 0x00005555555593c8:  48 8b 4c 24 70  mov    0x70(%rsp),%rcx
1: $rsp = (void *) 0x7fffffff9980
(gdb) x/xg $rsp+0x70
0x7fffffff99f0: 0x0000000000000000
(gdb) n
0x00005555555593cd in ?? ()
=> 0x00005555555593cd:  44 89 f2        mov    %r14d,%edx
1: $rsp = (void *) 0x7fffffff9980
(gdb) 
0x00005555555593d0 in ?? ()
=> 0x00005555555593d0:  44 89 e6        mov    %r12d,%esi
1: $rsp = (void *) 0x7fffffff9980
(gdb) 
0x00005555555593d3 in ?? ()
=> 0x00005555555593d3:  e8 f8 fb ff ff  callq  0x555555558fd0   // 15
1: $rsp = (void *) 0x7fffffff9980
(gdb) s
0x0000555555558fd0 in ?? ()
=> 0x0000555555558fd0:  41 57   push   %r15     // 16
1: $rsp = (void *) 0x7fffffff9978
(gdb) n
0x0000555555558fd2 in ?? ()
=> 0x0000555555558fd2:  41 56   push   %r14     // 17
1: $rsp = (void *) 0x7fffffff9970
(gdb) 
0x0000555555558fd4 in ?? ()
=> 0x0000555555558fd4:  49 89 fe        mov    %rdi,%r14
1: $rsp = (void *) 0x7fffffff9968
(gdb) 
0x0000555555558fd7 in ?? ()
=> 0x0000555555558fd7:  bf c8 00 00 00  mov    $0xc8,%edi
1: $rsp = (void *) 0x7fffffff9968
(gdb) 
0x0000555555558fdc in ?? ()
=> 0x0000555555558fdc:  41 55   push   %r13     // 18
1: $rsp = (void *) 0x7fffffff9968
(gdb) 
0x0000555555558fde in ?? ()
=> 0x0000555555558fde:  41 89 d5        mov    %edx,%r13d
1: $rsp = (void *) 0x7fffffff9960
(gdb) 
0x0000555555558fe1 in ?? ()
=> 0x0000555555558fe1:  41 54   push   %r12     // 19
1: $rsp = (void *) 0x7fffffff9960
(gdb) 
0x0000555555558fe3 in ?? ()
=> 0x0000555555558fe3:  55      push   %rbp     // 20
1: $rsp = (void *) 0x7fffffff9958
(gdb) 
0x0000555555558fe4 in ?? ()
=> 0x0000555555558fe4:  89 f5   mov    %esi,%ebp
1: $rsp = (void *) 0x7fffffff9950
(gdb) 
0x0000555555558fe6 in ?? ()
=> 0x0000555555558fe6:  53      push   %rbx     // 21
1: $rsp = (void *) 0x7fffffff9950
(gdb) 
0x0000555555558fe7 in ?? ()
=> 0x0000555555558fe7:  48 89 cb        mov    %rcx,%rbx
1: $rsp = (void *) 0x7fffffff9948
(gdb) 
0x0000555555558fea in ?? ()
=> 0x0000555555558fea:  48 81 ec d8 00 00 00    sub    $0xd8,%rsp       // 48
1: $rsp = (void *) 0x7fffffff9948
(gdb) 
0x0000555555558ff1 in ?? ()
=> 0x0000555555558ff1:  64 48 8b 04 25 28 00 00 00      mov    %fs:0x28,%rax
1: $rsp = (void *) 0x7fffffff9870
(gdb) 
0x0000555555558ffa in ?? ()
=> 0x0000555555558ffa:  48 89 84 24 c8 00 00 00 mov    %rax,0xc8(%rsp)
1: $rsp = (void *) 0x7fffffff9870
(gdb) 
0x0000555555559002 in ?? ()
=> 0x0000555555559002:  31 c0   xor    %eax,%eax
1: $rsp = (void *) 0x7fffffff9870
(gdb) 
0x0000555555559004 in ?? ()
=> 0x0000555555559004:  e8 37 d6 ff ff  callq  0x555555556640 <malloc@plt>
1: $rsp = (void *) 0x7fffffff9870
(gdb) 
0x0000555555559009 in ?? ()
=> 0x0000555555559009:  48 85 c0        test   %rax,%rax
1: $rsp = (void *) 0x7fffffff9870
(gdb) 
0x000055555555900c in ?? ()
=> 0x000055555555900c:  0f 84 1f 01 00 00       je     0x555555559131
1: $rsp = (void *) 0x7fffffff9870
(gdb) 
0x0000555555559012 in ?? ()
=> 0x0000555555559012:  4c 89 f6        mov    %r14,%rsi
1: $rsp = (void *) 0x7fffffff9870
(gdb) 
0x0000555555559015 in ?? ()
=> 0x0000555555559015:  ba 42 00 00 00  mov    $0x42,%edx
1: $rsp = (void *) 0x7fffffff9870
(gdb) 
0x000055555555901a in ?? ()
=> 0x000055555555901a:  48 89 c7        mov    %rax,%rdi
1: $rsp = (void *) 0x7fffffff9870
(gdb) 
0x000055555555901d in ?? ()
=> 0x000055555555901d:  49 89 c4        mov    %rax,%r12
1: $rsp = (void *) 0x7fffffff9870
(gdb) 
0x0000555555559020 in ?? ()
=> 0x0000555555559020:  e8 1b d4 ff ff  callq  0x555555556440 <strncpy@plt>
1: $rsp = (void *) 0x7fffffff9870
(gdb) 
0x0000555555559025 in ?? ()
=> 0x0000555555559025:  48 8b 05 5c 44 00 00    mov    0x445c(%rip),%rax        # 0x55555555d488
1: $rsp = (void *) 0x7fffffff9870
(gdb) 
0x000055555555902c in ?? ()
=> 0x000055555555902c:  45 89 6c 24 5c  mov    %r13d,0x5c(%r12)
1: $rsp = (void *) 0x7fffffff9870
(gdb) 

Breakpoint 1, 0x0000555555559031 in ?? ()
=> 0x0000555555559031:  4c 8d bc 24 90 00 00 00 lea    0x90(%rsp),%r15      // 48-18=30, 地址在sub    $0xd8,%rsp 分配的内存中
1: $rsp = (void *) 0x7fffffff9870           
(gdb) x/xg $rsp+0x90
0x7fffffff9900: 0x0000000000000000