首页
社区
课程
招聘
[原创]一参,一局部,一返回,最简单的C程序剖析
发表于: 2022-5-27 10:24 4277

[原创]一参,一局部,一返回,最简单的C程序剖析

2022-5-27 10:24
4277

Code

#include "stdio.h"

 

int Fun(int a)

{

int x=a;

 

return x;

}

 

 

void main()

{

int res=Fun(1);

 

}

///////////////////////////////////////////////////////////////////////////

main()

00401050 55                   push        ebp

00401051 8B EC                mov         ebp,esp

00401053 83 EC 44             sub         esp,44h

//保存堆栈

00401056 53                   push        ebx

00401057 56                   push        esi

00401058 57                   push        edi

//保存寄存器

00401059 8D 7D BC             lea         edi,[ebp-44h]

//取分配缓冲区地址,默认0x40,用了一个参数0x44

0040105C B9 11 00 00 00       mov         ecx,11h

00401061 B8 CC CC CC CC       mov         eax,0CCCCCCCCh

00401066 F3 AB                rep stos    dword ptr [edi]

//重复0x11次填充int3

00401068 6A 01                push        1

0040106A E8 A5 FF FF FF       call        @ILT+15(Fun) (00401014)

//参数传递,压到缓冲区。

0040106F 83 C4 04             add         esp,4

00401072 89 45 FC             mov         dword ptr [ebp-4],eax

//平衡参数传递cdcel,取返回值到ebp-4,也就是main中局部变量res

00401075 5F                   pop         edi

00401076 5E                   pop         esi

00401077 5B                   pop         ebx

00401078 83 C4 44             add         esp,44h

0040107B 3B EC                cmp         ebp,esp

0040107D E8 0E 00 00 00       call        __chkesp (00401090)

00401082 8B E5                mov         esp,ebp

00401084 5D                   pop         ebp

00401085 C3                   ret

///////////////////////////////////////////////////////////////////////////

FUN();

00401020 55                   push        ebp

00401021 8B EC                mov         ebp,esp

00401023 83 EC 44             sub         esp,44h

00401026 53                   push        ebx

00401027 56                   push        esi

00401028 57                   push        edi

00401029 8D 7D BC             lea         edi,[ebp-44h]

0040102C B9 11 00 00 00       mov         ecx,11h

00401031 B8 CC CC CC CC       mov         eax,0CCCCCCCCh

00401036 F3 AB                rep stos    dword ptr [edi]

00401038 8B 45 08             mov         eax,dword ptr [ebp+8]

//取参数到寄存器

0040103B 89 45 FC             mov         dword ptr [ebp-4],eax

//在赋值给局部变量x

0040103E 8B 45 FC             mov         eax,dword ptr [ebp-4]

//再把局部变量赋值给寄存器,用于返回

00401041 5F                   pop         edi

00401042 5E                   pop         esi

00401043 5B                   pop         ebx

00401044 8B E5                mov         esp,ebp

00401046 5D                   pop         ebp

备注:ebp+4一般是返回值,ebp+8,+c为参数,  ebp-4,-8为局部变量。

call  FUn();
将下一行地址亚入堆栈,进子函数第一行push ebp,mov ebp,esp  这里的ebp+4也就保存了call返回地址,等待子函数FUN执行完毕,ret返回。



[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)

收藏
免费 1
支持
分享
最新回复 (0)
游客
登录 | 注册 方可回帖
返回
//