C源码:
void swap(int *a,int *b){ int c; c = *a;*a = *b; *b = c;}int main(void){ int a ; int b ; int ret; a =16; b = 64; ret = 0; swap(&a,&b); ret = a – b; return ret;}编译:gcc -g func_stack.c -o a.outobjdump -dS a.out > main.dump可以得到反汇编的汇编程序main.dump, 有对应的C程序,如下所示:a.out：文件格式 elf32-i386Disassembly of section .init:08048294 <_init>: 8048294:53push %ebx 8048295:83 ec 08sub $0x8,%esp 8048298:e8 83 00 00 00call 8048320 <__x86.get_pc_thunk.bx> 804829d:81 c3 63 1d 00 00add $0x1d63,%ebx 80482a3:8b 83 fc ff ff ffmov -0x4(%ebx),%eax 80482a9:85 c0test %eax,%eax 80482ab:74 05je80482b2 <_init+0x1e> 80482ad:e8 1e 00 00 00call 80482d0 <__gmon_start__@plt> 80482b2:83 c4 08add $0x8,%esp 80482b5:5bpop %ebx 80482b6:c3retDisassembly of section .plt:080482c0 <__gmon_start__@plt-0x10>: 80482c0:ff 35 04 a0 04 08pushl 0x804a004 80482c6:ff 25 08 a0 04 08jmp *0x804a008 80482cc:00 00add %al,(%eax)…080482d0 <__gmon_start__@plt>: 80482d0:ff 25 0c a0 04 08jmp *0x804a00c 80482d6:68 00 00 00 00push $0x0 80482db:e9 e0 ff ff ffjmp 80482c0 <_init+0x2c>080482e0 <__libc_start_main@plt>: 80482e0:ff 25 10 a0 04 08jmp *0x804a010 80482e6:68 08 00 00 00push $0x8 80482eb:e9 d0 ff ff ffjmp 80482c0 <_init+0x2c>Disassembly of section .text:080482f0 <_start>: 80482f0:31 edxor %ebp,%ebp 80482f2:5epop %esi 80482f3:89 e1mov %esp,%ecx 80482f5:83 e4 f0and $0xfffffff0,%esp 80482f8:50push %eax 80482f9:54push %esp 80482fa:52push %edx 80482fb:68 c0 84 04 08push $0x80484c0 8048300:68 50 84 04 08push $0x8048450 8048305:51push %ecx 8048306:56push %esi 8048307:68 0f 84 04 08push $0x804840f 804830c:e8 cf ff ff ffcall 80482e0 <__libc_start_main@plt> 8048311:f4hlt8048312:66 90xchg %ax,%ax 8048314:66 90xchg %ax,%ax 8048316:66 90xchg %ax,%ax 8048318:66 90xchg %ax,%ax 804831a:66 90xchg %ax,%ax 804831c:66 90xchg %ax,%ax 804831e:66 90xchg %ax,%ax08048320 <__x86.get_pc_thunk.bx>: 8048320:8b 1c 24mov (%esp),%ebx 8048323:c3ret8048324:66 90xchg %ax,%ax 8048326:66 90xchg %ax,%ax 8048328:66 90xchg %ax,%ax 804832a:66 90xchg %ax,%ax 804832c:66 90xchg %ax,%ax 804832e:66 90xchg %ax,%ax08048330 <deregister_tm_clones>: 8048330:b8 1f a0 04 08mov $0x804a01f,%eax 8048335:2d 1c a0 04 08sub $0x804a01c,%eax 804833a:83 f8 06cmp $0x6,%eax 804833d:77 01ja8048340 <deregister_tm_clones+0x10> 804833f:c3ret8048340:b8 00 00 00 00mov $0x0,%eax 8048345:85 c0test %eax,%eax 8048347:74 f6je804833f <deregister_tm_clones+0xf> 8048349:55push %ebp 804834a:89 e5mov %esp,%ebp 804834c:83 ec 18sub $0x18,%esp 804834f:c7 04 24 1c a0 04 08 movl $0x804a01c,(%esp) 8048356:ff d0call *%eax 8048358:c9leave 8048359:c3ret804835a:8d b6 00 00 00 00lea 0x0(%esi),%esi08048360 <register_tm_clones>: 8048360:b8 1c a0 04 08mov $0x804a01c,%eax 8048365:2d 1c a0 04 08sub $0x804a01c,%eax 804836a:c1 f8 02sar $0x2,%eax 804836d:89 c2mov %eax,%edx 804836f:c1 ea 1fshr $0x1f,%edx 8048372:01 d0add %edx,%eax 8048374:d1 f8sar %eax 8048376:75 01jne 8048379 <register_tm_clones+0x19> 8048378:c3ret8048379:ba 00 00 00 00mov $0x0,%edx 804837e:85 d2test %edx,%edx 8048380:74 f6je8048378 <register_tm_clones+0x18> 8048382:55push %ebp 8048383:89 e5mov %esp,%ebp 8048385:83 ec 18sub $0x18,%esp 8048388:89 44 24 04mov %eax,0x4(%esp) 804838c:c7 04 24 1c a0 04 08 movl $0x804a01c,(%esp) 8048393:ff d2call *%edx 8048395:c9leave 8048396:c3ret8048397:89 f6mov %esi,%esi 8048399:8d bc 27 00 00 00 00 lea 0x0(%edi,%eiz,1),%edi080483a0 <__do_global_dtors_aux>: 80483a0:80 3d 1c a0 04 08 00 cmpb $0x0,0x804a01c 80483a7:75 13jne 80483bc <__do_global_dtors_aux+0x1c> 80483a9:55push %ebp 80483aa:89 e5mov %esp,%ebp 80483ac:83 ec 08sub $0x8,%esp 80483af:e8 7c ff ff ffcall 8048330 <deregister_tm_clones> 80483b4:c6 05 1c a0 04 08 01 movb $0x1,0x804a01c 80483bb:c9leave 80483bc:f3 c3repz ret 80483be:66 90xchg %ax,%ax080483c0 <frame_dummy>: 80483c0:a1 10 9f 04 08mov 0x8049f10,%eax 80483c5:85 c0test %eax,%eax 80483c7:74 1fje80483e8 <frame_dummy+0x28> 80483c9:b8 00 00 00 00mov $0x0,%eax 80483ce:85 c0test %eax,%eax 80483d0:74 16je80483e8 <frame_dummy+0x28> 80483d2:55push %ebp 80483d3:89 e5mov %esp,%ebp 80483d5:83 ec 18sub $0x18,%esp 80483d8:c7 04 24 10 9f 04 08 movl $0x8049f10,(%esp) 80483df:ff d0call *%eax 80483e1:c9leave 80483e2:e9 79 ff ff ffjmp 8048360 <register_tm_clones> 80483e7:90nop 80483e8:e9 73 ff ff ffjmp 8048360 <register_tm_clones>080483ed <swap>:/*main.c代码：*/void swap(int *a,int *b){ 80483ed:55push %ebp 80483ee:89 e5mov %esp,%ebp 80483f0:83 ec 10sub $0x10,%esp int c; c = *a; 80483f3:8b 45 08mov 0x8(%ebp),%eax 80483f6:8b 00mov (%eax),%eax 80483f8:89 45 fcmov %eax,-0x4(%ebp) *a = *b; 80483fb:8b 45 0cmov 0xc(%ebp),%eax 80483fe:8b 10mov (%eax),%edx 8048400:8b 45 08mov 0x8(%ebp),%eax 8048403:89 10mov %edx,(%eax) *b = c; 8048405:8b 45 0cmov 0xc(%ebp),%eax 8048408:8b 55 fcmov -0x4(%ebp),%edx 804840b:89 10mov %edx,(%eax)} 804840d:c9leave 804840e:c3ret0804840f <main>:int main(void){ 804840f:55push %ebp 8048410:89 e5mov %esp,%ebp 8048412:83 ec 18sub $0x18,%esp int a ; int b ; int ret; a =16; 8048415:c7 45 f4 10 00 00 00 movl $0x10,-0xc(%ebp) b = 64; 804841c:c7 45 f8 40 00 00 00 movl $0x40,-0x8(%ebp) ret = 0; 8048423:c7 45 fc 00 00 00 00 movl $0x0,-0x4(%ebp) swap(&a,&b); 804842a:8d 45 f8lea -0x8(%ebp),%eax 804842d:89 44 24 04mov %eax,0x4(%esp) 8048431:8d 45 f4lea -0xc(%ebp),%eax 8048434:89 04 24mov %eax,(%esp) 8048437:e8 b1 ff ff ffcall 80483ed <swap> ret = a – b; 804843c:8b 55 f4mov -0xc(%ebp),%edx 804843f:8b 45 f8mov -0x8(%ebp),%eax 8048442:29 c2sub %eax,%edx 8048444:89 d0mov %edx,%eax 8048446:89 45 fcmov %eax,-0x4(%ebp) return ret; 8048449:8b 45 fcmov -0x4(%ebp),%eax} 804844c:c9leave 804844d:c3ret804844e:66 90xchg %ax,%ax08048450 <__libc_csu_init>: 8048450:55push %ebp 8048451:57push %edi 8048452:31 ffxor %edi,%edi 8048454:56push %esi 8048455:53push %ebx 8048456:e8 c5 fe ff ffcall 8048320 <__x86.get_pc_thunk.bx> 804845b:81 c3 a5 1b 00 00add $0x1ba5,%ebx 8048461:83 ec 1csub $0x1c,%esp 8048464:8b 6c 24 30mov 0x30(%esp),%ebp 8048468:8d b3 0c ff ff fflea -0xf4(%ebx),%esi 804846e:e8 21 fe ff ffcall 8048294 <_init> 8048473:8d 83 08 ff ff fflea -0xf8(%ebx),%eax 8048479:29 c6sub %eax,%esi 804847b:c1 fe 02sar $0x2,%esi 804847e:85 f6test %esi,%esi 8048480:74 27je80484a9 <__libc_csu_init+0x59> 8048482:8d b6 00 00 00 00lea 0x0(%esi),%esi 8048488:8b 44 24 38mov 0x38(%esp),%eax 804848c:89 2c 24mov %ebp,(%esp) 804848f:89 44 24 08mov %eax,0x8(%esp) 8048493:8b 44 24 34mov 0x34(%esp),%eax 8048497:89 44 24 04mov %eax,0x4(%esp) 804849b:ff 94 bb 08 ff ff ff call *-0xf8(%ebx,%edi,4) 80484a2:83 c7 01add $0x1,%edi 80484a5:39 f7cmp %esi,%edi 80484a7:75 dfjne 8048488 <__libc_csu_init+0x38> 80484a9:83 c4 1cadd $0x1c,%esp 80484ac:5bpop %ebx 80484ad:5epop %esi 80484ae:5fpop %edi 80484af:5dpop %ebp 80484b0:c3ret80484b1:eb 0djmp 80484c0 <__libc_csu_fini> 80484b3:90nop 80484b4:90nop 80484b5:90nop 80484b6:90nop 80484b7:90nop 80484b8:90nop 80484b9:90nop 80484ba:90nop 80484bb:90nop 80484bc:90nop 80484bd:90nop 80484be:90nop 80484bf:90nop080484c0 <__libc_csu_fini>: 80484c0:f3 c3repz ret Disassembly of section .fini:080484c4 <_fini>: 80484c4:53push %ebx 80484c5:83 ec 08sub $0x8,%esp 80484c8:e8 53 fe ff ffcall 8048320 <__x86.get_pc_thunk.bx> 80484cd:81 c3 33 1b 00 00add $0x1b33,%ebx 80484d3:83 c4 08add $0x8,%esp 80484d6:5bpop %ebx 80484d7:c3ret
注:
1. 按照习惯栈底放在栈顶上面,栈向下生长,地址递减.
2. 汇编的指令+操作数,操作数可以是立即数(常数,如$0x8)/寄存器/存储器(存储器会有寻址方式). 常用的指令包括mov/sub/add/push/pop/leave/ret/call等.
3. esp是栈顶指针, ebp是帧指针–栈底指针. 函数的参数入栈是从右到左,是可以控制的
具体汇编可以参考如下链接,写的很详细:
点击打开链接
点击打开链接
，带着我的相机和电脑，远离繁华，走向空旷。
