-
-
[求助]c程序hello world 反汇编后对eax寄存器值的疑惑
-
发表于:
2008-10-9 15:37
3697
-
[求助]c程序hello world 反汇编后对eax寄存器值的疑惑
源程序是:
#include<stdio.h>
void main()
{
printf("hello world!\n");
}
反汇编后:
00401010 >|> \55 push ebp
00401011 |. 8BEC mov ebp, esp
00401013 |. 83EC 40 sub esp, 40
00401016 |. 53 push ebx
00401017 |. 56 push esi
00401018 |. 57 push edi
00401019 |. 8D7D C0 lea edi, dword ptr [ebp-40]
0040101C |. B9 10000000 mov ecx, 10
00401021 |. B8 CCCCCCCC mov eax, CCCCCCCC
00401026 |. F3:AB rep stos dword ptr es:[edi]
00401028 |. 68 1C204200 push 0042201C ; /format = "hello world!",LF,""
0040102D |. E8 2E000000 call printf ; \printf
00401032 |. 83C4 04 add esp, 4
00401035 |. 5F pop edi
00401036 |. 5E pop esi
00401037 |. 5B pop ebx
00401038 |. 83C4 40 add esp, 40
0040103B |. 3BEC cmp ebp, esp
0040103D |. E8 9E000000 call _chkesp
00401042 |. 8BE5 mov esp, ebp
00401044 |. 5D pop ebp
00401045 \. C3 retn
对上述蓝色代码的疑惑:
mov eax,ccccccc后,eax的值位cccccccc,记得0xcc好像是int 3中断的机器码吧?在这里,堆栈大小是10*4吧,利用mov ecx,10和rep stos dword ptr es:[edi]指令对堆栈空间进行int 3指令的填充么?如果是的话,全是int 3指令能起到什么作用?
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课