汇编文件解析

有解决问题时需要反汇编,然后在汇编模式阅读代码,因外汇编相比于C 代码或者其他语言更加直接的体现CPU的行为.本文着重分析如何阅读汇编语句,常用的函数调用,变量定义,压栈,出栈等行为.

C代码

定义一个函数,带有6个参数的函数

int add(void *a,void *b,void *c,void *d,int e,int f)
{
    int m = e;
    int n = f;
    return (*((int *)a) + *((int *)b) + *((int *)c) + *((int *)d) + m + n);
}

定义一个无参数函数

int test(void)
{
    int array[100] = {0};
    int b = 0;

    memset(array,0x01,sizeof(array));
    for(int i=0;i<100;i++)
    {
        b += array[i];
    }
    return b;
}

定义一个main函数

int main(unsigned int argc,void *argv[])
{
    char p[10]= {'\0','A'};
    
    int a = 10;
    int b = 10;
    int c = 100;
    int d = 1000;
    printf("\r\nStart test the demo\r\n");
    
    c = add((void *)&a,(void *)&b,(void *)&c,(void *)&d,a,b);
    d = test();
  //  d = add(NULL,NULL);
    sleep(100);
    return 0;
}

可执行文件反汇编

将.c文件编译为可执行文件,然后将可执行文件反汇编生成汇编码.

1.Add 函数汇编代码

int add(void *a,void *b,void *c,void *d,int e,int f)
{
    8560:   1421        subi        r14, r14, 4
    8562:   dd0e2000    st.w        r8, (r14, 0x0)
    8566:   6e3b        mov         r8, r14
    8568:   1426        subi        r14, r14, 24
    856a:   e588100b    subi        r12, r8, 12
    856e:   dc0c2000    st.w        r0, (r12, 0x0)
    8572:   e408100f    subi        r0, r8, 16
    8576:   b020        st.w        r1, (r0, 0x0)
    8578:   e4281013    subi        r1, r8, 20
    857c:   b140        st.w        r2, (r1, 0x0)
    857e:   e4481017    subi        r2, r8, 24
    8582:   b260        st.w        r3, (r2, 0x0)
    int m = e;
    8584:   e4681003    subi        r3, r8, 4
    8588:   e4480003    addi        r2, r8, 4
    858c:   9240        ld.w        r2, (r2, 0x0)
    858e:   b340        st.w        r2, (r3, 0x0)
    int n = f;
    8590:   e4681007    subi        r3, r8, 8
    8594:   e4480007    addi        r2, r8, 8
    8598:   9240        ld.w        r2, (r2, 0x0)
    859a:   b340        st.w        r2, (r3, 0x0)
    return (*((int *)a) + *((int *)b) + *((int *)c) + *((int *)d) + m + n);
    859c:   e468100b    subi        r3, r8, 12
    85a0:   9360        ld.w        r3, (r3, 0x0)
    85a2:   9340        ld.w        r2, (r3, 0x0)
    85a4:   e468100f    subi        r3, r8, 16
    85a8:   9360        ld.w        r3, (r3, 0x0)
    85aa:   9360        ld.w        r3, (r3, 0x0)
    85ac:   608c        addu        r2, r3
    85ae:   e4681013    subi        r3, r8, 20
    85b2:   9360        ld.w        r3, (r3, 0x0)
    85b4:   9360        ld.w        r3, (r3, 0x0)
    85b6:   608c        addu        r2, r3
    85b8:   e4681017    subi        r3, r8, 24
    85bc:   9360        ld.w        r3, (r3, 0x0)
    85be:   9360        ld.w        r3, (r3, 0x0)
    85c0:   608c        addu        r2, r3
    85c2:   e4681003    subi        r3, r8, 4
    85c6:   9360        ld.w        r3, (r3, 0x0)
    85c8:   608c        addu        r2, r3
    85ca:   e4681007    subi        r3, r8, 8
    85ce:   9360        ld.w        r3, (r3, 0x0)
    85d0:   60c8        addu        r3, r2
}

-局部变量定义

 int m = e;
   8584:   e4681003    subi        r3, r8, 4
   8588:   e4480003    addi        r2, r8, 4
   858c:   9240        ld.w        r2, (r2, 0x0)
   858e:   b340        st.w        r2, (r3, 0x0)
    
int n = f;
    8590:   e4681007    subi        r3, r8, 8
    8594:   e4480007    addi        r2, r8, 8
    8598:   9240        ld.w        r2, (r2, 0x0)
    859a:   b340        st.w        r2, (r3, 0x0)

r8 寄存器为:fp 寄存器;r14:用户堆栈寄存器;在栈中分配4字节的空间. 4是偏移量不是大小,r8 开始向下偏移4个字节

subi        r3, r8, 4  

ld 与st 指令要根据CPU框架说明解释,这里是Csky CPU,请参阅Csky汇编手册.

2.调用无参函数

bsr指令直接跳转并且保存子程序的返回地址到R15寄存器中

d = test();
bsr         0x85e0  // 85e0 
8726:   c4004820    lsli        r0, r0, 0
872a:   6c83        mov         r2, r0
872c:   e468101f    subi        r3, r8, 32
8730:   b340        st.w        r2, (r3, 0)

可以看到程序并没有直接操作FP寄存器,而是在FP的基础之上进行偏移,FP指针始终没有移动。
函数返回

6c0f        mov         r0, r3
8668:   6fa3        mov         sp, r8
866a:   d9ee2001    ld.w        r15, (sp, 0x4)
866e:   d90e2000    ld.w        r8, (sp, 0)
8672:   1402        addi        sp, sp, 8
8674:   783c        rts

函数调用返回时,首先恢复栈到FP,然后再恢复SP,最后使用rts实现函数跳转。

3.调用有参函数

参数个数小于4个

参数个数大于4个

2.数组越界导致的Segmentation Fault

你可能感兴趣的:(汇编文件解析)