有解決問題時需要反匯編,然后在匯編模式閱讀代碼,因外匯編相比于C 代碼或者其他語言更加直接的體現(xiàn)CPU的行為.本文著重分析如何閱讀匯編語句,常用的函數(shù)調(diào)用,變量定義,壓棧,出棧等行為.
C代碼
定義一個函數(shù),帶有6個參數(shù)的函數(shù)
int add(void *a,void *b,void *c,void *d,int e,int f)
{
int m = e;
int n = f;
return (*((int *)a) + *((int *)b) + *((int *)c) + *((int *)d) + m + n);
}
定義一個無參數(shù)函數(shù)
int test(void)
{
int array[100] = {0};
int b = 0;
memset(array,0x01,sizeof(array));
for(int i=0;i<100;i++)
{
b += array[i];
}
return b;
}
定義一個main函數(shù)
int main(unsigned int argc,void *argv[])
{
char p[10]= {'\0','A'};
int a = 10;
int b = 10;
int c = 100;
int d = 1000;
printf("\r\nStart test the demo\r\n");
c = add((void *)&a,(void *)&b,(void *)&c,(void *)&d,a,b);
d = test();
// d = add(NULL,NULL);
sleep(100);
return 0;
}
可執(zhí)行文件反匯編
將.c文件編譯為可執(zhí)行文件,然后將可執(zhí)行文件反匯編生成匯編碼.
1.Add 函數(shù)匯編代碼
int add(void *a,void *b,void *c,void *d,int e,int f)
{
8560: 1421 subi r14, r14, 4
8562: dd0e2000 st.w r8, (r14, 0x0)
8566: 6e3b mov r8, r14
8568: 1426 subi r14, r14, 24
856a: e588100b subi r12, r8, 12
856e: dc0c2000 st.w r0, (r12, 0x0)
8572: e408100f subi r0, r8, 16
8576: b020 st.w r1, (r0, 0x0)
8578: e4281013 subi r1, r8, 20
857c: b140 st.w r2, (r1, 0x0)
857e: e4481017 subi r2, r8, 24
8582: b260 st.w r3, (r2, 0x0)
int m = e;
8584: e4681003 subi r3, r8, 4
8588: e4480003 addi r2, r8, 4
858c: 9240 ld.w r2, (r2, 0x0)
858e: b340 st.w r2, (r3, 0x0)
int n = f;
8590: e4681007 subi r3, r8, 8
8594: e4480007 addi r2, r8, 8
8598: 9240 ld.w r2, (r2, 0x0)
859a: b340 st.w r2, (r3, 0x0)
return (*((int *)a) + *((int *)b) + *((int *)c) + *((int *)d) + m + n);
859c: e468100b subi r3, r8, 12
85a0: 9360 ld.w r3, (r3, 0x0)
85a2: 9340 ld.w r2, (r3, 0x0)
85a4: e468100f subi r3, r8, 16
85a8: 9360 ld.w r3, (r3, 0x0)
85aa: 9360 ld.w r3, (r3, 0x0)
85ac: 608c addu r2, r3
85ae: e4681013 subi r3, r8, 20
85b2: 9360 ld.w r3, (r3, 0x0)
85b4: 9360 ld.w r3, (r3, 0x0)
85b6: 608c addu r2, r3
85b8: e4681017 subi r3, r8, 24
85bc: 9360 ld.w r3, (r3, 0x0)
85be: 9360 ld.w r3, (r3, 0x0)
85c0: 608c addu r2, r3
85c2: e4681003 subi r3, r8, 4
85c6: 9360 ld.w r3, (r3, 0x0)
85c8: 608c addu r2, r3
85ca: e4681007 subi r3, r8, 8
85ce: 9360 ld.w r3, (r3, 0x0)
85d0: 60c8 addu r3, r2
}
-局部變量定義
int m = e;
8584: e4681003 subi r3, r8, 4
8588: e4480003 addi r2, r8, 4
858c: 9240 ld.w r2, (r2, 0x0)
858e: b340 st.w r2, (r3, 0x0)
int n = f;
8590: e4681007 subi r3, r8, 8
8594: e4480007 addi r2, r8, 8
8598: 9240 ld.w r2, (r2, 0x0)
859a: b340 st.w r2, (r3, 0x0)
r8 寄存器為:fp 寄存器；r14：用戶堆棧寄存器；在棧中分配4字節(jié)的空間. 4是偏移量不是大小,r8 開始向下偏移4個字節(jié)。
subi r3, r8, 4
ld 與st 指令要根據(jù)CPU框架說明解釋,這里是Csky CPU,請參閱Csky匯編手冊.
2.調(diào)用無參函數(shù)
bsr指令直接跳轉(zhuǎn)并且保存子程序的返回地址到R15寄存器中
d = test();
bsr 0x85e0 // 85e0 <test>
8726: c4004820 lsli r0, r0, 0
872a: 6c83 mov r2, r0
872c: e468101f subi r3, r8, 32
8730: b340 st.w r2, (r3, 0)
可以看到程序并沒有直接操作FP寄存器，而是在FP的基礎(chǔ)之上進行偏移，F(xiàn)P指針始終沒有移動。
函數(shù)返回
6c0f mov r0, r3
8668: 6fa3 mov sp, r8
866a: d9ee2001 ld.w r15, (sp, 0x4)
866e: d90e2000 ld.w r8, (sp, 0)
8672: 1402 addi sp, sp, 8
8674: 783c rts
函數(shù)調(diào)用返回時，首先恢復(fù)棧到FP，然后再恢復(fù)SP，最后使用rts實現(xiàn)函數(shù)跳轉(zhuǎn)。
3.調(diào)用有參函數(shù)
參數(shù)個數(shù)小于4個
參數(shù)個數(shù)大于4個
