汇编与反汇编

对于一段nasm的汇编代码

section .text

global mystart ; make the main function externally visible

mystart:
xor bx,bx
start: mov ax,1
add ax,bx
jmp short next
nop
nop
nop
next: mov bx,ax

; 2 exit the program

; 2a prepare the argument for the sys call to exit
push dword 0 ; exit status returned to the operating system

; 2b make the call to sys call to exit
mov eax, 0x1 ; system call number for exit
sub esp, 4 ; OS X (and BSD) system calls needs "extra space" on stack
int 0x80 ; make the system call

　　

生成list文件
nasm -f elf 6-2.asm -l 6-2.lst

1 section .text
2 
3 global mystart ; make the main function externally visible
4 
5 mystart:
6 00000000 6631DB xor bx,bx
7 00000003 66B80100 start: mov ax,1
8 00000007 6601D8 add ax,bx
9 0000000A EB03 jmp short next
10 0000000C 90 nop
11 0000000D 90 nop
12 0000000E 90 nop
13 0000000F 6689C3 next: mov bx,ax
14 
15 ; 2 exit the program
16 
17 ; 2a prepare the argument for the sys call to exit
18 00000012 6800000000 push dword 0 ; exit status returned to the operating system
19 
20 ; 2b make the call to sys call to exit
21 00000017 B801000000 mov eax, 0x1 ; system call number for exit
22 0000001C 81EC04000000 sub esp, 4 ; OS X (and BSD) system calls needs "extra space" on stack
23 00000022 CD80 int 0x80 ; make the system call

　　

顺带出来的.o可执行文件里的机器码：

7f45 4c46 0101 0100 0000 0000 0000 0000
0100 0300 0100 0000 0000 0000 0000 0000
4000 0000 0000 0000 3400 0000 0000 2800
0600 0300 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0100 0000 0100 0000
0600 0000 0000 0000 3001 0000 2400 0000
0000 0000 0000 0000 1000 0000 0000 0000
0700 0000 0100 0000 0000 0000 0000 0000
6001 0000 3f00 0000 0000 0000 0000 0000
0100 0000 0000 0000 1000 0000 0300 0000
0000 0000 0000 0000 a001 0000 2a00 0000
0000 0000 0000 0000 0100 0000 0000 0000
1a00 0000 0200 0000 0000 0000 0000 0000
d001 0000 7000 0000 0500 0000 0600 0000
0400 0000 1000 0000 2200 0000 0300 0000
0000 0000 0000 0000 4002 0000 1c00 0000
0000 0000 0000 0000 0100 0000 0000 0000
6631 db66 b801 0066 01d8 eb03 9090 9066
89c3 6800 0000 00b8 0100 0000 81ec 0400
0000 cd80 0000 0000 0000 0000 0000 0000
0054 6865 204e 6574 7769 6465 2041 7373
656d 626c 6572 2030 2e39 382e 3430 2028
4170 706c 6520 436f 6d70 7574 6572 2c20
496e 632e 2062 7569 6c64 2031 3129 0000
002e 7465 7874 002e 636f 6d6d 656e 7400
2e73 6873 7472 7461 6200 2e73 796d 7461
6200 2e73 7472 7461 6200 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0100 0000 0000 0000 0000 0000 0400 f1ff
0000 0000 0000 0000 0000 0000 0300 f1ff
0000 0000 0000 0000 0000 0000 0300 0100
1100 0000 0300 0000 0000 0000 0000 0100
1700 0000 0f00 0000 0000 0000 0000 0100
0900 0000 0000 0000 0000 0000 1000 0100
0036 2d31 2e61 736d 006d 7973 7461 7274
0073 7461 7274 006e 6578 7400 0000 0000

　　

里面有一堆机器码，比原来的程序长很多
.lst文件是.asm文件翻译成机器码的结果就是一对一的翻译

反汇编
ndisasm 6-2.o
对.o文件反汇编之后发现出来的代码很奇怪，jmp的机器码直接被连接成了其他语句，不知道怎么回事，到时候想去问问老师来的，反汇编是个啥啊～

00000000 7F45 jg 0x47
00000002 4C dec esp
00000003 46 inc esi
00000004 0101 add [ecx],eax
00000006 0100 add [eax],eax
00000008 0000 add [eax],al
0000000A 0000 add [eax],al
0000000C 0000 add [eax],al
0000000E 0000 add [eax],al
00000010 0100 add [eax],eax
00000012 0300 add eax,[eax]
00000014 0100 add [eax],eax
00000016 0000 add [eax],al
00000018 0000 add [eax],al
0000001A 0000 add [eax],al
0000001C 0000 add [eax],al
0000001E 0000 add [eax],al
00000020 40 inc eax
00000021 0000 add [eax],al
00000023 0000 add [eax],al
00000025 0000 add [eax],al
00000027 003400 add [eax+eax],dh
0000002A 0000 add [eax],al
0000002C 0000 add [eax],al
0000002E 2800 sub [eax],al
00000030 06 push es
00000031 0003 add [ebx],al
00000033 0000 add [eax],al
00000035 0000 add [eax],al
00000037 0000 add [eax],al
00000039 0000 add [eax],al
0000003B 0000 add [eax],al
0000003D 0000 add [eax],al
0000003F 0000 add [eax],al
00000041 0000 add [eax],al
00000043 0000 add [eax],al
00000045 0000 add [eax],al
00000047 0000 add [eax],al
00000049 0000 add [eax],al
0000004B 0000 add [eax],al
0000004D 0000 add [eax],al
0000004F 0000 add [eax],al
00000051 0000 add [eax],al
00000053 0000 add [eax],al
00000055 0000 add [eax],al
00000057 0000 add [eax],al
00000059 0000 add [eax],al
0000005B 0000 add [eax],al
0000005D 0000 add [eax],al
0000005F 0000 add [eax],al
00000061 0000 add [eax],al
00000063 0000 add [eax],al
00000065 0000 add [eax],al
00000067 0001 add [ecx],al
00000069 0000 add [eax],al
0000006B 0001 add [ecx],al
0000006D 0000 add [eax],al
0000006F 0006 add [esi],al
00000071 0000 add [eax],al
00000073 0000 add [eax],al
00000075 0000 add [eax],al
00000077 0030 add [eax],dh
00000079 0100 add [eax],eax
0000007B 002400 add [eax+eax],ah
0000007E 0000 add [eax],al
00000080 0000 add [eax],al
00000082 0000 add [eax],al
00000084 0000 add [eax],al
00000086 0000 add [eax],al
00000088 1000 adc [eax],al
0000008A 0000 add [eax],al
0000008C 0000 add [eax],al
0000008E 0000 add [eax],al
00000090 07 pop es
00000091 0000 add [eax],al
00000093 0001 add [ecx],al
00000095 0000 add [eax],al
00000097 0000 add [eax],al
00000099 0000 add [eax],al
0000009B 0000 add [eax],al
0000009D 0000 add [eax],al
0000009F 006001 add [eax+0x1],ah
000000A2 0000 add [eax],al
000000A4 3F aas
000000A5 0000 add [eax],al
000000A7 0000 add [eax],al
000000A9 0000 add [eax],al
000000AB 0000 add [eax],al
000000AD 0000 add [eax],al
000000AF 0001 add [ecx],al
000000B1 0000 add [eax],al
000000B3 0000 add [eax],al
000000B5 0000 add [eax],al
000000B7 0010 add [eax],dl
000000B9 0000 add [eax],al
000000BB 0003 add [ebx],al
000000BD 0000 add [eax],al
000000BF 0000 add [eax],al
000000C1 0000 add [eax],al
000000C3 0000 add [eax],al
000000C5 0000 add [eax],al
000000C7 00A00100002A add [eax+0x2a000001],ah
000000CD 0000 add [eax],al
000000CF 0000 add [eax],al
000000D1 0000 add [eax],al
000000D3 0000 add [eax],al
000000D5 0000 add [eax],al
000000D7 0001 add [ecx],al
000000D9 0000 add [eax],al
000000DB 0000 add [eax],al
000000DD 0000 add [eax],al
000000DF 001A add [edx],bl
000000E1 0000 add [eax],al
000000E3 0002 add [edx],al
000000E5 0000 add [eax],al
000000E7 0000 add [eax],al
000000E9 0000 add [eax],al
000000EB 0000 add [eax],al
000000ED 0000 add [eax],al
000000EF 00D0 add al,dl
000000F1 0100 add [eax],eax
000000F3 007000 add [eax+0x0],dh
000000F6 0000 add [eax],al
000000F8 0500000006 add eax,0x6000000
000000FD 0000 add [eax],al
000000FF 000400 add [eax+eax],al
00000102 0000 add [eax],al
00000104 1000 adc [eax],al
00000106 0000 add [eax],al
00000108 2200 and al,[eax]
0000010A 0000 add [eax],al
0000010C 0300 add eax,[eax]
0000010E 0000 add [eax],al
00000110 0000 add [eax],al
00000112 0000 add [eax],al
00000114 0000 add [eax],al
00000116 0000 add [eax],al
00000118 40 inc eax
00000119 0200 add al,[eax]
0000011B 001C00 add [eax+eax],bl
0000011E 0000 add [eax],al
00000120 0000 add [eax],al
00000122 0000 add [eax],al
00000124 0000 add [eax],al
00000126 0000 add [eax],al
00000128 0100 add [eax],eax
0000012A 0000 add [eax],al
0000012C 0000 add [eax],al
0000012E 0000 add [eax],al
00000130 6631DB xor bx,bx
00000133 66B80100 mov ax,0x1
00000137 6601D8 add ax,bx
0000013A EB03 jmp short 0x13f
0000013C 90 nop
0000013D 90 nop
0000013E 90 nop
0000013F 6689C3 mov bx,ax
00000142 6800000000 push dword 0x0
00000147 B801000000 mov eax,0x1
0000014C 81EC04000000 sub esp,0x4
00000152 CD80 int 0x80
00000154 0000 add [eax],al
00000156 0000 add [eax],al
00000158 0000 add [eax],al
0000015A 0000 add [eax],al
0000015C 0000 add [eax],al
0000015E 0000 add [eax],al
00000160 00546865 add [eax+ebp*2+0x65],dl
00000164 204E65 and [esi+0x65],cl
00000167 7477 jz 0x1e0
00000169 6964652041737365 imul esp,[ebp+0x20],dword 0x65737341
00000171 6D insd
00000172 626C6572 bound ebp,[ebp+0x72]
00000176 2030 and [eax],dh
00000178 2E3938 cmp [cs:eax],edi
0000017B 2E3430 cs xor al,0x30
0000017E 2028 and [eax],ch
00000180 41 inc ecx
00000181 7070 jo 0x1f3
00000183 6C insb
00000184 6520436F and [gs:ebx+0x6f],al
00000188 6D insd
00000189 7075 jo 0x200
0000018B 7465 jz 0x1f2
0000018D 722C jc 0x1bb
0000018F 20496E and [ecx+0x6e],cl
00000192 632E arpl [esi],bp
00000194 206275 and [edx+0x75],ah
00000197 696C642031312900 imul ebp,[esp+0x20],dword 0x293131
0000019F 0000 add [eax],al
000001A1 2E7465 cs jz 0x209
000001A4 7874 js 0x21a
000001A6 002E add [esi],ch
000001A8 636F6D arpl [edi+0x6d],bp
000001AB 6D insd
000001AC 656E gs outsb
000001AE 7400 jz 0x1b0
000001B0 2E7368 cs jnc 0x21b
000001B3 7374 jnc 0x229
000001B5 7274 jc 0x22b
000001B7 61 popa
000001B8 6200 bound eax,[eax]
000001BA 2E7379 cs jnc 0x236
000001BD 6D insd
000001BE 7461 jz 0x221
000001C0 6200 bound eax,[eax]
000001C2 2E7374 cs jnc 0x239
000001C5 7274 jc 0x23b
000001C7 61 popa
000001C8 6200 bound eax,[eax]
000001CA 0000 add [eax],al
000001CC 0000 add [eax],al
000001CE 0000 add [eax],al
000001D0 0000 add [eax],al
000001D2 0000 add [eax],al
000001D4 0000 add [eax],al
000001D6 0000 add [eax],al
000001D8 0000 add [eax],al
000001DA 0000 add [eax],al
000001DC 0000 add [eax],al
000001DE 0000 add [eax],al
000001E0 0100 add [eax],eax
000001E2 0000 add [eax],al
000001E4 0000 add [eax],al
000001E6 0000 add [eax],al
000001E8 0000 add [eax],al
000001EA 0000 add [eax],al
000001EC 0400 add al,0x0
000001EE F1 int1
000001EF FF00 inc dword [eax]
000001F1 0000 add [eax],al
000001F3 0000 add [eax],al
000001F5 0000 add [eax],al
000001F7 0000 add [eax],al
000001F9 0000 add [eax],al
000001FB 0003 add [ebx],al
000001FD 00F1 add cl,dh
000001FF FF00 inc dword [eax]
00000201 0000 add [eax],al
00000203 0000 add [eax],al
00000205 0000 add [eax],al
00000207 0000 add [eax],al
00000209 0000 add [eax],al
0000020B 0003 add [ebx],al
0000020D 0001 add [ecx],al
0000020F 0011 add [ecx],dl
00000211 0000 add [eax],al
00000213 0003 add [ebx],al
00000215 0000 add [eax],al
00000217 0000 add [eax],al
00000219 0000 add [eax],al
0000021B 0000 add [eax],al
0000021D 0001 add [ecx],al
0000021F 0017 add [edi],dl
00000221 0000 add [eax],al
00000223 000F add [edi],cl
00000225 0000 add [eax],al
00000227 0000 add [eax],al
00000229 0000 add [eax],al
0000022B 0000 add [eax],al
0000022D 0001 add [ecx],al
0000022F 0009 add [ecx],cl
00000231 0000 add [eax],al
00000233 0000 add [eax],al
00000235 0000 add [eax],al
00000237 0000 add [eax],al
00000239 0000 add [eax],al
0000023B 0010 add [eax],dl
0000023D 0001 add [ecx],al
0000023F 0000 add [eax],al
00000241 362D312E6173 ss sub eax,0x73612e31
00000247 6D insd
00000248 006D79 add [ebp+0x79],ch
0000024B 7374 jnc 0x2c1
0000024D 61 popa
0000024E 7274 jc 0x2c4
00000250 007374 add [ebx+0x74],dh
00000253 61 popa
00000254 7274 jc 0x2ca
00000256 006E65 add [esi+0x65],ch
00000259 7874 js 0x2cf
0000025B 0000 add [eax],al
0000025D 0000 add [eax],al
0000025F 00 db 0x00

　　

后来明白了，因为写的时候没有把代码段数据段堆栈分开来，所以在反汇编的时候机器没有按相应的规则去反编译出来。

转载于:https://www.cnblogs.com/sparkmorry/p/3505563.html