关于Delphi中参数的传递和函数值的返回
function add1(a:Integer):Integer; //一个参数
begin
add1:=a+a;
end;
function add2(a,b:Integer):Integer; //两个参数
begin
add2:=a+b;
end;
function add3(a,b,c:Integer):Integer; //三个参数
begin
add3:=a+b+c;
end;
function add4(a,b,c,d:Integer):Integer; //四个参数
begin
add4:=a+b+c+d;
end;
function add5(a,b,c,d,e:Integer):Integer; //五个参数
begin
add5:=a+b+c+d+e;
end;
function add6:Integer; //加入一些局部变量
var local1,local2,local3,local4,local5:Integer;
begin
local1:=1;
local2:=2;
local3:=3;
local4:=4;
local5:=5;
add6:=local1+local2+local3+local4+local5;
end;
function add7(a,b,c,d,e:Integer):Integer; //利用result来返回
begin
result:=a+b+c+d+e;
end;
function add8(a,b,c,d,e:Integer):Integer;StdCall;//StdCall调用方式
begin
add8:=a+b+c+d+e;
end;
procedure TForm1.Button1Click(Sender: TObject);
var a,b,c,d,e:Integer;
s1,s2,s3,s4,s5,s6,s7,s8,s:Integer;
begin
a:=1; b:=2; c:=3; d:=4; e:=5;
s1:=add1(a);
s2:=add2(a,b);
s3:=add3(a,b,c);
s4:=add4(a,b,c,d);
s5:=add5(a,b,c,d,e);
s6:=add6;
s7:=add7(a,b,c,d,e);
s8:=add8(a,b,c,d,e);
s:=s1+s2+s3+s4+s5+s6+s7+s8; //必须要有这么几句
MessageDlg(IntToStr(s),mtConfirmation,[mbOK],0); //不然编译器根本不去处理返回值
end;
004403EC 55 push ebp
004403ED 8BEC mov ebp, esp
004403EF 83C4D8 add esp, -$28 ;空出地方放局部变量
004403F2 53 push ebx
004403F3 56 push esi
004403F4 57 push edi
004403F5 33C9 xor ecx, ecx
004403F7 894DD8 mov [ebp-$28], ecx
004403FA 33C0 xor eax, eax
004403FC 55 push ebp
* Possible String Reference to: '轹-?腽_^[?]?
|
004403FD 68E9044400 push $004404E9
***** TRY
|
00440402 64FF30 push dword ptr fs:[eax] ;这是DELPHI的例行公事
00440405 648920 mov fs:[eax], esp ;据我观察只要调用VCL库的都要SEH
00440408 BB01000000 mov ebx, $00000001 ;a:=1
0044040D BE02000000 mov esi, $00000002 ;b:=2
00440412 BF03000000 mov edi, $00000003 ;c:=3
00440417 C745FC04000000 mov dword ptr [ebp-$04], $00000004 ;d:=4
0044041E C745F805000000 mov dword ptr [ebp-$08], $00000005 ;e:=5
可以看出DELPHI的确不一样，把EBX，ESI，EDI能用的寄存器全都用上了，实在不行了才用[ebp-xx]，
从下面的分析中也能看出这一点，DELPHI在能用寄存器时决不用堆栈。
00440425 8BC3 mov eax, ebx ;这是add1的参数啦,不用PUSH的
* Reference to : TForm1.Proc_00440360()
|
00440427 E834FFFFFF call 00440360 ;CALL add1
{
00440360 03C0 add eax, eax
00440362 C3 ret ;这样的确很快哟
}
0044042C 8945F4 mov [ebp-$0C], eax ;s1:=add1(a)
0044042F 8BD6 mov edx, esi ;add2的参数EDX=2
00440431 8BC3 mov eax, ebx ;add2的参数EAX=1
* Reference to : TForm1.Proc_00440364()
|
00440433 E82CFFFFFF call 00440364 ;CALL add2
{
00440364 03D0 add edx, eax
00440366 8BC2 mov eax, edx
00440368 C3 ret
}
00440438 8945F0 mov [ebp-$10], eax ;s2:=add2(a,b)
0044043B 8BCF mov ecx, edi ;add3的参数ECX=3
0044043D 8BD6 mov edx, esi ;EDX=2
0044043F 8BC3 mov eax, ebx ;EAX=1
* Reference to : TForm1.Proc_0044036C()
|
00440441 E826FFFFFF call 0044036C ;CALL add3
{
0044036C 03D0 add edx, eax
0044036E 03CA add ecx, edx
00440370 8BC1 mov eax, ecx
00440372 C3 ret
}
00440446 8945EC mov [ebp-$14], eax ;s3:=add3(a,b,c)
00440449 8B45FC mov eax, [ebp-$04] ;[EBP-4]=4
0044044C 50 push eax ;终于看见PUSH了噢
0044044D 8BCF mov ecx, edi ;ECX=3
0044044F 8BD6 mov edx, esi ;EDX=2
00440451 8BC3 mov eax, ebx ;EAX=1
* Reference to : TForm1.Proc_00440374()
|
00440453 E81CFFFFFF call 00440374 ;CALL add4
{
00440374 55 push ebp
00440375 8BEC mov ebp, esp ;这是C里面的方式啦
00440377 03D0 add edx, eax
00440379 03CA add ecx, edx
0044037B 034D08 add ecx, [ebp+$08];[EBP+8]本来是第一个参数的
0044037E 8BC1 mov eax, ecx ;这里[EBP+8]是第四个参数
00440380 5D pop ebp
00440381 C20400 ret $0004
}
00440458 8945E8 mov [ebp-$18], eax ;s4:=add4(a,b,c,d)
0044045B 8B45FC mov eax, [ebp-$04] ;[EBP-4]=4
0044045E 50 push eax ;注意:先压进去的是第四个参数
0044045F 8B45F8 mov eax, [ebp-$08] ;[EBP-8]=5
00440462 50 push eax ;再压进第五个参数,Pascal从左至右
00440463 8BCF mov ecx, edi ;ECX=3
00440465 8BD6 mov edx, esi ;EDX=2
00440467 8BC3 mov eax, ebx ;EAX=1
* Reference to : TForm1.Proc_00440384()
|
00440469 E816FFFFFF call 00440384 ;CALL add5(a,b,c,d,e)
0044046E 8945E4 mov [ebp-$1C], eax ;s5=add5(a,b,c,d,e)
* Reference to : TForm1.Proc_00440398()
|
00440471 E822FFFFFF call 00440398 ;add6 看看DLEPHI怎么处理局部变量
{
00440398 53 push ebx
00440399 56 push esi
0044039A B801000000 mov eax, $00000001
0044039F BA02000000 mov edx, $00000002
004403A4 B903000000 mov ecx, $00000003
004403A9 BB04000000 mov ebx, $00000004
004403AE BE05000000 mov esi, $00000005;哈哈，果然不出所料
004403B3 03D0 add edx, eax ;它用上了一切能用的寄存器
004403B5 03CA add ecx, edx ;各位可以试试加上十来个局部变量
004403B7 03D9 add ebx, ecx ;看它能坚持到几时:D
004403B9 03F3 add esi, ebx
004403BB 8BC6 mov eax, esi
004403BD 5E pop esi
004403BE 5B pop ebx
004403BF C3 ret
}
00440476 8945E0 mov [ebp-$20], eax
00440479 8B45FC mov eax, [ebp-$04]
0044047C 50 push eax
0044047D 8B45F8 mov eax, [ebp-$08]
00440480 50 push eax
00440481 8BCF mov ecx, edi
00440483 8BD6 mov edx, esi
00440485 8BC3 mov eax, ebx
* Reference to : TForm1.Proc_004403C0() ;我想看看用result是不是有不同
|
00440487 E834FFFFFF call 004403C0 ;其实和add5一样的，不写了
0044048C 8945DC mov [ebp-$24], eax
0044048F 8B45F8 mov eax, [ebp-$08]
00440492 50 push eax ;PUSH 5
00440493 8B45FC mov eax, [ebp-$04]
00440496 50 push eax ;PUSH 4
00440497 57 push edi ;PUSH 3
00440498 56 push esi ;PUSH 2
00440499 53 push ebx ;PUSH 1
* Reference to : TForm1.Proc_004403D4()
|
0044049A E835FFFFFF call 004403D4 ;这个眼熟的吧，从右至左的StdCall方式
{
004403D4 55 push ebp
004403D5 8BEC mov ebp, esp
004403D7 8B4508 mov eax, [ebp+$08]
004403DA 03450C add eax, [ebp+$0C]
004403DD 034510 add eax, [ebp+$10]
004403E0 034514 add eax, [ebp+$14]
004403E3 034518 add eax, [ebp+$18]
004403E6 5D pop ebp
004403E7 C21400 ret $0014 ;我还是觉得这样好看一些:)
}
* Reference to Form1
|
0044049F 8B5DF4 mov ebx, [ebp-$0C]
004404A2 035DF0 add ebx, [ebp-$10]
004404A5 035DEC add ebx, [ebp-$14]
004404A8 035DE8 add ebx, [ebp-$18]
004404AB 035DE4 add ebx, [ebp-$1C]
004404AE 035DE0 add ebx, [ebp-$20]
004404B1 035DDC add ebx, [ebp-$24]
004404B4 03D8 add ebx, eax ;加起来
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
