逆向-破零
第一个练习逆向程序，记录方法的养成！
#include
#include
#include
int f_804870c(int *vb, int va)
{
/*804870c: 55 push %ebp
804870d: 89 e5 mov %esp,%ebp
804870f: 83 ec 10 sub $0x10,%esp
8048712: c7 45 f8 00 00 00 00 movl $0x0,-0x8(%ebp)*/
int i;
// 8048719: c7 45 fc 00 00 00 00 movl $0x0,-0x4(%ebp)
int j=0;
/*8048720: eb 18 jmp 804873a <__libc_start_main@plt+0x38a>
8048722: 8b 45 fc mov -0x4(%ebp),%eax // eax = j
8048725: 8d 14 85 00 00 00 00 lea 0x0(,%eax,4),%edx // edx = (j+4)
804872c: 8b 45 08 mov 0x8(%ebp),%eax // eax = vb
804872f: 01 d0 add %edx,%eax // eax = vb + (j+4)
8048731: 8b 00 mov (%eax),%eax // eax = vb[j]
8048733: 01 45 f8 add %eax,-0x8(%ebp) // i = i + vb[j]
8048736: 83 45 fc 01 addl $0x1,-0x4(%ebp) // j++;
804873a: 8b 45 fc mov -0x4(%ebp),%eax // eax = j
804873d: 3b 45 0c cmp 0xc(%ebp),%eax // *vb
8048740: 7c e0 jl 8048722 <__libc_start_main@plt+0x372>*/
for (i = 0; i < va; i++) {
j += vb[i];
}
/*8048742: 8b 45 f8 mov -0x8(%ebp),%eax
8048745: c9 leave
8048746: c3 ret*/
return j;
}
int f_8048747(int (*vb)[4], int va)
{
/*8048747: 55 push %ebp
8048748: 89 e5 mov %esp,%ebp
804874a: 83 ec 10 sub $0x10,%esp
804874d: c7 45 f4 00 00 00 00 movl $0x0,-0xc(%ebp)*/
int i = 0;
//8048754: c7 45 fc 00 00 00 00 movl $0x0,-0x4(%ebp)
int j = 0;
int k;
/*804875b: eb 2d jmp 804878a <__libc_start_main@plt+0x3da>
804875d: c7 45 f8 00 00 00 00 movl $0x0,-0x8(%ebp) // k = 0;
8048764: eb 1a jmp 8048780 <__libc_start_main@plt+0x3d0>
8048766: 8b 45 fc mov -0x4(%ebp),%eax // eax=j
8048769: c1 e0 04 shl $0x4,%eax // eax = i << 4
804876c: 89 c2 mov %eax,%edx // edx = i << 4
804876e: 8b 45 08 mov 0x8(%ebp),%eax // eax = vb
8048771: 01 c2 add %eax,%edx // edx = vb + i<<4
8048773: 8b 45 f8 mov -0x8(%ebp),%eax // eax = k
8048776: 8b 04 82 mov (%edx,%eax,4),%eax // eax = edx+k*4
8048779: 01 45 f4 add %eax,-0xc(%ebp) // j = j + eax
804877c: 83 45 f8 01 addl $0x1,-0x8(%ebp) // k++
8048780: 83 7d f8 03 cmpl $0x3,-0x8(%ebp)
8048784: 7e e0 jle 8048766 <__libc_start_main@plt+0x3b6>
8048786: 83 45 fc 01 addl $0x1,-0x4(%ebp)
804878a: 8b 45 fc mov -0x4(%ebp),%eax
804878d: 3b 45 0c cmp 0xc(%ebp),%eax
8048790: 7c cb jl 804875d <__libc_start_main@plt+0x3ad>*/
for (i = 0; i < va; i++) {
for (k = 0; k < 4; k++) {
j = vb[i][k];
}
}
/* 8048792: 8b 45 f4 mov -0xc(%ebp),%eax
8048795: c9 leave
8048796: c3 ret */
return j;
}
void f_804860d()
{
//804860d: 55 push %ebp
//804860e: 89 e5 mov %esp,%ebp
//8048610: 83 ec 78 sub $0x78,%esp
//8048613: c7 45 a4 0a 00 00 00 movl $0xa,-0x5c(%ebp)
//804861a: c7 45 a8 14 00 00 00 movl $0x14,-0x58(%ebp)
int a[2] = {10, 20};
// 8048621: 8d 45 a4 lea -0x5c(%ebp),%eax
// 8048624: 89 45 f4 mov %eax,-0xc(%ebp)
int *p = a;
/* 8048627: c7 45 ac 01 00 00 00 movl $0x1,-0x54(%ebp)
804862e: c7 45 b0 02 00 00 00 movl $0x2,-0x50(%ebp)
8048635: c7 45 b4 03 00 00 00 movl $0x3,-0x4c(%ebp)
804863c: c7 45 b8 f7 ff ff ff movl $0xfffffff7,-0x48(%ebp)
8048643: c7 45 bc 04 00 00 00 movl $0x4,-0x44(%ebp)
804864a: c7 45 c0 05 00 00 00 movl $0x5,-0x40(%ebp)
8048651: c7 45 c4 06 00 00 00 movl $0x6,-0x3c(%ebp)
8048658: c7 45 c8 f8 ff ff ff movl $0xfffffff8,-0x38(%ebp)*/
int b[2][4] = {{1, 2, 3, -9}, {4, 5, 6, -8}};
// 804865f: 8d 45 ac lea -0x54(%ebp),%eax
// 8048662: 89 45 f0 mov %eax,-0x10(%ebp)
int (*p2)[4] = b; // 根据f_804870c函数汇编代码反向推出，有shl指令
/*8048665: c7 44 24 04 02 00 00 movl $0x2,0x4(%esp)
804866c: 00
804866d: 8b 45 f4 mov -0xc(%ebp),%eax
8048670: 89 04 24 mov %eax,(%esp)
8048673: e8 94 00 00 00 call 804870c <__libc_start_main@plt+0x35c>
8048678: 89 45 ec mov %eax,-0x14(%ebp) */
int var1 = f_804870c(p, 0x2);
/*804867b: c7 44 24 04 02 00 00 movl $0x2,0x4(%esp)
8048682: 00
8048683: 8b 45 f0 mov -0x10(%ebp),%eax
8048686: 89 04 24 mov %eax,(%esp)
8048689: e8 b9 00 00 00 call 8048747 <__libc_start_main@plt+0x397>
804868e: 89 45 e8 mov %eax,-0x18(%ebp)*/
int var2 = f_8048747(p2, 0x2);
/*8048691: c7 45 cc 04 00 00 00 movl $0x4,-0x34(%ebp)
8048698: c7 45 d0 04 00 00 00 movl $0x4,-0x30(%ebp)
804869f: c7 45 d4 04 00 00 00 movl $0x4,-0x2c(%ebp)
80486a6: c7 45 d8 05 00 00 00 movl $0x5,-0x28(%ebp)
80486ad: c7 45 dc 05 00 00 00 movl $0x5,-0x24(%ebp)
80486b4: c7 45 e0 05 00 00 00 movl $0x5,-0x20(%ebp)*/
int c[6] = {4, 4, 4, 5, 5, 5};
/*80486bb: c7 44 24 04 06 00 00 movl $0x6,0x4(%esp)
80486c2: 00
80486c3: 8d 45 cc lea -0x34(%ebp),%eax
80486c6: 89 04 24 mov %eax,(%esp)
80486c9: e8 3e 00 00 00 call 804870c <__libc_start_main@plt+0x35c>
80486ce: 89 45 e4 mov %eax,-0x1c(%ebp)*/
int var3 = f_804870c(c, 6);
/*80486d1: 8b 45 ec mov -0x14(%ebp),%eax
80486d4: 89 44 24 04 mov %eax,0x4(%esp)
80486d8: c7 04 24 44 8b 04 08 movl $0x8048b44,(%esp)
80486df: e8 ac fc ff ff call 8048390
printf("asdfasdf %d\n", var1);
/*80486e4: 8b 45 e8 mov -0x18(%ebp),%eax
80486e7: 89 44 24 04 mov %eax,0x4(%esp)
80486eb: c7 04 24 51 8b 04 08 movl $0x8048b51,(%esp)
80486f2: e8 99 fc ff ff call 8048390
printf("asdfasdf %d\n", var2);
/*80486f7: 8b 45 e4 mov -0x1c(%ebp),%eax
80486fa: 89 44 24 04 mov %eax,0x4(%esp)
80486fe: c7 04 24 5e 8b 04 08 movl $0x8048b5e,(%esp)
8048705: e8 86 fc ff ff call 8048390
printf("asdfasdf %d\n", var3);
}
void f_8048797(){}
void f_80484d0(){}
void f_8048593(){}
void f_804859b(){}
void f_80485cd(){}
void f_8048855(){}
void f_80489cc(){}
int main()
{
f_804860d();
f_8048797();
f_80484d0();
f_8048593();
f_804859b();
f_80485cd();
f_8048855();
f_80489cc();
return 0;
}
// 反汇编后的原程序代码。
array: file format elf32-i386
Disassembly of section .init:
08048358 <.init>:
8048358: 53 push %ebx
8048359: 83 ec 08 sub $0x8,%esp
804835c: e8 8f 00 00 00 call 80483f0 <__libc_start_main@plt+0x40>
8048361: 81 c3 9f 1c 00 00 add $0x1c9f,%ebx
8048367: 8b 83 fc ff ff ff mov -0x4(%ebx),%eax
804836d: 85 c0 test %eax,%eax
804836f: 74 05 je 8048376
8048371: e8 2a 00 00 00 call 80483a0 <__gmon_start__@plt>
8048376: 83 c4 08 add $0x8,%esp
8048379: 5b pop %ebx
804837a: c3 ret
Disassembly of section .plt:
08048380
8048380: ff 35 04 a0 04 08 pushl 0x804a004
8048386: ff 25 08 a0 04 08 jmp *0x804a008
804838c: 00 00 add %al,(%eax)
...
08048390
8048390: ff 25 0c a0 04 08 jmp *0x804a00c
8048396: 68 00 00 00 00 push $0x0
804839b: e9 e0 ff ff ff jmp 8048380
080483a0 <__gmon_start__@plt>:
80483a0: ff 25 10 a0 04 08 jmp *0x804a010
80483a6: 68 08 00 00 00 push $0x8
80483ab: e9 d0 ff ff ff jmp 8048380
080483b0 <__libc_start_main@plt>:
80483b0: ff 25 14 a0 04 08 jmp *0x804a014
80483b6: 68 10 00 00 00 push $0x10
80483bb: e9 c0 ff ff ff jmp 8048380
Disassembly of section .text:
080483c0 <.text>:
80483c0: 31 ed xor %ebp,%ebp
80483c2: 5e pop %esi
80483c3: 89 e1 mov %esp,%ecx
80483c5: 83 e4 f0 and $0xfffffff0,%esp
80483c8: 50 push %eax
80483c9: 54 push %esp
80483ca: 52 push %edx
80483cb: 68 20 8b 04 08 push $0x8048b20
80483d0: 68 b0 8a 04 08 push $0x8048ab0
80483d5: 51 push %ecx
80483d6: 56 push %esi
80483d7: 68 77 8a 04 08 push $0x8048a77
80483dc: e8 cf ff ff ff call 80483b0 <__libc_start_main@plt>
80483e1: f4 hlt
80483e2: 66 90 xchg %ax,%ax
80483e4: 66 90 xchg %ax,%ax
80483e6: 66 90 xchg %ax,%ax
80483e8: 66 90 xchg %ax,%ax
80483ea: 66 90 xchg %ax,%ax
80483ec: 66 90 xchg %ax,%ax
80483ee: 66 90 xchg %ax,%ax
80483f0: 8b 1c 24 mov (%esp),%ebx
80483f3: c3 ret
80483f4: 66 90 xchg %ax,%ax
80483f6: 66 90 xchg %ax,%ax
80483f8: 66 90 xchg %ax,%ax
80483fa: 66 90 xchg %ax,%ax
80483fc: 66 90 xchg %ax,%ax
80483fe: 66 90 xchg %ax,%ax
8048400: b8 1f a0 04 08 mov $0x804a01f,%eax
8048405: 2d 1c a0 04 08 sub $0x804a01c,%eax
804840a: 83 f8 06 cmp $0x6,%eax
804840d: 77 01 ja 8048410 <__libc_start_main@plt+0x60>
804840f: c3 ret
8048410: b8 00 00 00 00 mov $0x0,%eax
8048415: 85 c0 test %eax,%eax
8048417: 74 f6 je 804840f <__libc_start_main@plt+0x5f>
8048419: 55 push %ebp
804841a: 89 e5 mov %esp,%ebp
804841c: 8d 64 24 e8 lea -0x18(%esp),%esp
8048420: c7 04 24 1c a0 04 08 movl $0x804a01c,(%esp)
8048427: ff d0 call *%eax
8048429: c9 leave
804842a: c3 ret
804842b: 90 nop
804842c: 8d 74 26 00 lea 0x0(%esi,%eiz,1),%esi
8048430: b8 1c a0 04 08 mov $0x804a01c,%eax
8048435: 2d 1c a0 04 08 sub $0x804a01c,%eax
804843a: c1 f8 02 sar $0x2,%eax
804843d: 89 c2 mov %eax,%edx
804843f: c1 ea 1f shr $0x1f,%edx
8048442: 01 d0 add %edx,%eax
8048444: d1 f8 sar %eax
8048446: 75 01 jne 8048449 <__libc_start_main@plt+0x99>
8048448: c3 ret
8048449: ba 00 00 00 00 mov $0x0,%edx
804844e: 85 d2 test %edx,%edx
8048450: 74 f6 je 8048448 <__libc_start_main@plt+0x98>
8048452: 55 push %ebp
8048453: 89 e5 mov %esp,%ebp
8048455: 8d 64 24 e8 lea -0x18(%esp),%esp
8048459: 89 44 24 04 mov %eax,0x4(%esp)
804845d: c7 04 24 1c a0 04 08 movl $0x804a01c,(%esp)
8048464: ff d2 call *%edx
8048466: c9 leave
8048467: c3 ret
8048468: 90 nop
8048469: 8d b4 26 00 00 00 00 lea 0x0(%esi,%eiz,1),%esi
8048470: 80 3d 1c a0 04 08 00 cmpb $0x0,0x804a01c
8048477: 75 18 jne 8048491 <__libc_start_main@plt+0xe1>
8048479: 55 push %ebp
804847a: 89 e5 mov %esp,%ebp
804847c: 8d 64 24 f8 lea -0x8(%esp),%esp
8048480: e8 7b ff ff ff call 8048400 <__libc_start_main@plt+0x50>
8048485: c6 05 1c a0 04 08 01 movb $0x1,0x804a01c
804848c: 90 nop
804848d: 90 nop
804848e: 90 nop
804848f: 90 nop
8048490: c9 leave
8048491: c3 ret
8048492: 8d b4 26 00 00 00 00 lea 0x0(%esi,%eiz,1),%esi
8048499: 8d bc 27 00 00 00 00 lea 0x0(%edi,%eiz,1),%edi
80484a0: a1 f8 9e 04 08 mov 0x8049ef8,%eax
80484a5: 85 c0 test %eax,%eax
80484a7: 74 1f je 80484c8 <__libc_start_main@plt+0x118>
80484a9: b8 00 00 00 00 mov $0x0,%eax
80484ae: 85 c0 test %eax,%eax
80484b0: 74 16 je 80484c8 <__libc_start_main@plt+0x118>
80484b2: 55 push %ebp
80484b3: 89 e5 mov %esp,%ebp
80484b5: 8d 64 24 e8 lea -0x18(%esp),%esp
80484b9: c7 04 24 f8 9e 04 08 movl $0x8049ef8,(%esp)
80484c0: ff d0 call *%eax
80484c2: c9 leave
80484c3: e9 68 ff ff ff jmp 8048430 <__libc_start_main@plt+0x80>
80484c8: e9 63 ff ff ff jmp 8048430 <__libc_start_main@plt+0x80>
80484cd: 66 90 xchg %ax,%ax
80484cf: 90 nop
80484d0: 55 push %ebp
80484d1: 89 e5 mov %esp,%ebp
80484d3: 81 ec c0 01 00 00 sub $0x1c0,%esp
80484d9: c7 45 d0 03 00 00 00 movl $0x3,-0x30(%ebp)
80484e0: c7 45 d4 02 00 00 00 movl $0x2,-0x2c(%ebp)
80484e7: c7 45 d8 01 00 00 00 movl $0x1,-0x28(%ebp)
80484ee: c7 45 dc 00 00 00 00 movl $0x0,-0x24(%ebp)
80484f5: c7 45 e0 03 00 00 00 movl $0x3,-0x20(%ebp)
80484fc: c7 45 e4 02 00 00 00 movl $0x2,-0x1c(%ebp)
8048503: c7 45 e8 01 00 00 00 movl $0x1,-0x18(%ebp)
804850a: c7 45 ec 00 00 00 00 movl $0x0,-0x14(%ebp)
8048511: c7 45 f0 03 00 00 00 movl $0x3,-0x10(%ebp)
8048518: c7 45 f4 02 00 00 00 movl $0x2,-0xc(%ebp)
804851f: c7 45 f8 01 00 00 00 movl $0x1,-0x8(%ebp)
8048526: c7 45 fc 00 00 00 00 movl $0x0,-0x4(%ebp)
804852d: c7 85 40 fe ff ff 01 movl $0x1,-0x1c0(%ebp)
8048534: 00 00 00
8048537: c7 85 44 fe ff ff 01 movl $0x1,-0x1bc(%ebp)
804853e: 00 00 00
8048541: c7 85 48 fe ff ff 01 movl $0x1,-0x1b8(%ebp)
8048548: 00 00 00
804854b: c7 85 4c fe ff ff 01 movl $0x1,-0x1b4(%ebp)
8048552: 00 00 00
8048555: c7 85 50 fe ff ff 01 movl $0x1,-0x1b0(%ebp)
804855c: 00 00 00
804855f: c7 85 54 fe ff ff 01 movl $0x1,-0x1ac(%ebp)
8048566: 00 00 00
8048569: c7 85 58 fe ff ff 01 movl $0x1,-0x1a8(%ebp)
8048570: 00 00 00
8048573: c7 85 5c fe ff ff 01 movl $0x1,-0x1a4(%ebp)
804857a: 00 00 00
804857d: c7 85 60 fe ff ff 01 movl $0x1,-0x1a0(%ebp)
8048584: 00 00 00
8048587: c7 85 64 fe ff ff 01 movl $0x1,-0x19c(%ebp)
804858e: 00 00 00
8048591: c9 leave
8048592: c3 ret
8048593: 55 push %ebp
8048594: 89 e5 mov %esp,%ebp
8048596: 83 ec 60 sub $0x60,%esp
8048599: c9 leave
804859a: c3 ret
804859b: 55 push %ebp
804859c: 89 e5 mov %esp,%ebp
804859e: 83 ec 60 sub $0x60,%esp
80485a1: c7 45 d8 64 00 00 00 movl $0x64,-0x28(%ebp)
80485a8: c7 45 b0 32 00 00 00 movl $0x32,-0x50(%ebp)
80485af: c6 45 a6 61 movb $0x61,-0x5a(%ebp)
80485b3: c6 45 a7 62 movb $0x62,-0x59(%ebp)
80485b7: c6 45 a8 63 movb $0x63,-0x58(%ebp)
80485bb: c6 45 a9 64 movb $0x64,-0x57(%ebp)
80485bf: c6 45 aa 65 movb $0x65,-0x56(%ebp)
80485c3: c6 45 ab 66 movb $0x66,-0x55(%ebp)
80485c7: c6 45 ac 00 movb $0x0,-0x54(%ebp)
80485cb: c9 leave
80485cc: c3 ret
80485cd: 55 push %ebp
80485ce: 89 e5 mov %esp,%ebp
80485d0: 83 ec 30 sub $0x30,%esp
80485d3: c7 45 d0 01 00 00 00 movl $0x1,-0x30(%ebp)
80485da: c7 45 d4 02 00 00 00 movl $0x2,-0x2c(%ebp)
80485e1: c7 45 d8 03 00 00 00 movl $0x3,-0x28(%ebp)
80485e8: c7 45 dc 04 00 00 00 movl $0x4,-0x24(%ebp)
80485ef: c7 45 e0 05 00 00 00 movl $0x5,-0x20(%ebp)
80485f6: c7 45 e4 06 00 00 00 movl $0x6,-0x1c(%ebp)
80485fd: c7 45 e8 07 00 00 00 movl $0x7,-0x18(%ebp)
8048604: c7 45 ec 08 00 00 00 movl $0x8,-0x14(%ebp)
804860b: c9 leave
804860c: c3 ret
804860d: 55 push %ebp
804860e: 89 e5 mov %esp,%ebp
8048610: 83 ec 78 sub $0x78,%esp
8048613: c7 45 a4 0a 00 00 00 movl $0xa,-0x5c(%ebp)
804861a: c7 45 a8 14 00 00 00 movl $0x14,-0x58(%ebp)
8048621: 8d 45 a4 lea -0x5c(%ebp),%eax
8048624: 89 45 f4 mov %eax,-0xc(%ebp)
8048627: c7 45 ac 01 00 00 00 movl $0x1,-0x54(%ebp)
804862e: c7 45 b0 02 00 00 00 movl $0x2,-0x50(%ebp)
8048635: c7 45 b4 03 00 00 00 movl $0x3,-0x4c(%ebp)
804863c: c7 45 b8 f7 ff ff ff movl $0xfffffff7,-0x48(%ebp)
8048643: c7 45 bc 04 00 00 00 movl $0x4,-0x44(%ebp)
804864a: c7 45 c0 05 00 00 00 movl $0x5,-0x40(%ebp)
8048651: c7 45 c4 06 00 00 00 movl $0x6,-0x3c(%ebp)
8048658: c7 45 c8 f8 ff ff ff movl $0xfffffff8,-0x38(%ebp)
804865f: 8d 45 ac lea -0x54(%ebp),%eax
8048662: 89 45 f0 mov %eax,-0x10(%ebp)
8048665: c7 44 24 04 02 00 00 movl $0x2,0x4(%esp)
804866c: 00
804866d: 8b 45 f4 mov -0xc(%ebp),%eax
8048670: 89 04 24 mov %eax,(%esp)
8048673: e8 94 00 00 00 call 804870c <__libc_start_main@plt+0x35c>
8048678: 89 45 ec mov %eax,-0x14(%ebp)
804867b: c7 44 24 04 02 00 00 movl $0x2,0x4(%esp)
8048682: 00
8048683: 8b 45 f0 mov -0x10(%ebp),%eax
8048686: 89 04 24 mov %eax,(%esp)
8048689: e8 b9 00 00 00 call 8048747 <__libc_start_main@plt+0x397>
804868e: 89 45 e8 mov %eax,-0x18(%ebp)
8048691: c7 45 cc 04 00 00 00 movl $0x4,-0x34(%ebp)
8048698: c7 45 d0 04 00 00 00 movl $0x4,-0x30(%ebp)
804869f: c7 45 d4 04 00 00 00 movl $0x4,-0x2c(%ebp)
80486a6: c7 45 d8 05 00 00 00 movl $0x5,-0x28(%ebp)
80486ad: c7 45 dc 05 00 00 00 movl $0x5,-0x24(%ebp)
80486b4: c7 45 e0 05 00 00 00 movl $0x5,-0x20(%ebp)
80486bb: c7 44 24 04 06 00 00 movl $0x6,0x4(%esp)
80486c2: 00
80486c3: 8d 45 cc lea -0x34(%ebp),%eax
80486c6: 89 04 24 mov %eax,(%esp)
80486c9: e8 3e 00 00 00 call 804870c <__libc_start_main@plt+0x35c>
80486ce: 89 45 e4 mov %eax,-0x1c(%ebp)
80486d1: 8b 45 ec mov -0x14(%ebp),%eax
80486d4: 89 44 24 04 mov %eax,0x4(%esp)
80486d8: c7 04 24 44 8b 04 08 movl $0x8048b44,(%esp)
80486df: e8 ac fc ff ff call 8048390
80486e4: 8b 45 e8 mov -0x18(%ebp),%eax
80486e7: 89 44 24 04 mov %eax,0x4(%esp)
80486eb: c7 04 24 51 8b 04 08 movl $0x8048b51,(%esp)
80486f2: e8 99 fc ff ff call 8048390
80486f7: 8b 45 e4 mov -0x1c(%ebp),%eax
80486fa: 89 44 24 04 mov %eax,0x4(%esp)
80486fe: c7 04 24 5e 8b 04 08 movl $0x8048b5e,(%esp)
8048705: e8 86 fc ff ff call 8048390
804870a: c9 leave
804870b: c3 ret
804870c: 55 push %ebp
804870d: 89 e5 mov %esp,%ebp
804870f: 83 ec 10 sub $0x10,%esp
8048712: c7 45 f8 00 00 00 00 movl $0x0,-0x8(%ebp)
8048719: c7 45 fc 00 00 00 00 movl $0x0,-0x4(%ebp)
8048720: eb 18 jmp 804873a <__libc_start_main@plt+0x38a>
8048722: 8b 45 fc mov -0x4(%ebp),%eax
8048725: 8d 14 85 00 00 00 00 lea 0x0(,%eax,4),%edx
804872c: 8b 45 08 mov 0x8(%ebp),%eax
804872f: 01 d0 add %edx,%eax
8048731: 8b 00 mov (%eax),%eax
8048733: 01 45 f8 add %eax,-0x8(%ebp)
8048736: 83 45 fc 01 addl $0x1,-0x4(%ebp)
804873a: 8b 45 fc mov -0x4(%ebp),%eax
804873d: 3b 45 0c cmp 0xc(%ebp),%eax
8048740: 7c e0 jl 8048722 <__libc_start_main@plt+0x372>
8048742: 8b 45 f8 mov -0x8(%ebp),%eax
8048745: c9 leave
8048746: c3 ret
8048747: 55 push %ebp
8048748: 89 e5 mov %esp,%ebp
804874a: 83 ec 10 sub $0x10,%esp
804874d: c7 45 f4 00 00 00 00 movl $0x0,-0xc(%ebp)
8048754: c7 45 fc 00 00 00 00 movl $0x0,-0x4(%ebp)
804875b: eb 2d jmp 804878a <__libc_start_main@plt+0x3da>
804875d: c7 45 f8 00 00 00 00 movl $0x0,-0x8(%ebp)
8048764: eb 1a jmp 8048780 <__libc_start_main@plt+0x3d0>
8048766: 8b 45 fc mov -0x4(%ebp),%eax
8048769: c1 e0 04 shl $0x4,%eax
804876c: 89 c2 mov %eax,%edx
804876e: 8b 45 08 mov 0x8(%ebp),%eax
8048771: 01 c2 add %eax,%edx
8048773: 8b 45 f8 mov -0x8(%ebp),%eax
8048776: 8b 04 82 mov (%edx,%eax,4),%eax
8048779: 01 45 f4 add %eax,-0xc(%ebp)
804877c: 83 45 f8 01 addl $0x1,-0x8(%ebp)
8048780: 83 7d f8 03 cmpl $0x3,-0x8(%ebp)
8048784: 7e e0 jle 8048766 <__libc_start_main@plt+0x3b6>
8048786: 83 45 fc 01 addl $0x1,-0x4(%ebp)
804878a: 8b 45 fc mov -0x4(%ebp),%eax
804878d: 3b 45 0c cmp 0xc(%ebp),%eax
8048790: 7c cb jl 804875d <__libc_start_main@plt+0x3ad>
8048792: 8b 45 f4 mov -0xc(%ebp),%eax
8048795: c9 leave
8048796: c3 ret
8048797: 55 push %ebp
8048798: 89 e5 mov %esp,%ebp
804879a: 57 push %edi
804879b: 56 push %esi
804879c: 53 push %ebx
804879d: 83 ec 3c sub $0x3c,%esp
80487a0: 89 e0 mov %esp,%eax
80487a2: 89 45 c0 mov %eax,-0x40(%ebp)
80487a5: c7 45 e4 03 00 00 00 movl $0x3,-0x1c(%ebp)
80487ac: c7 45 e0 04 00 00 00 movl $0x4,-0x20(%ebp)
80487b3: 8b 5d e0 mov -0x20(%ebp),%ebx
80487b6: 8b 7d e4 mov -0x1c(%ebp),%edi
80487b9: 8d 43 ff lea -0x1(%ebx),%eax
80487bc: 89 45 dc mov %eax,-0x24(%ebp)
80487bf: 8d 47 ff lea -0x1(%edi),%eax
80487c2: 89 45 d8 mov %eax,-0x28(%ebp)
80487c5: 89 5d c4 mov %ebx,-0x3c(%ebp)
80487c8: 89 d8 mov %ebx,%eax
80487ca: ba 00 00 00 00 mov $0x0,%edx
80487cf: 89 f9 mov %edi,%ecx
80487d1: bb 00 00 00 00 mov $0x0,%ebx
80487d6: 89 d6 mov %edx,%esi
80487d8: 0f af f1 imul %ecx,%esi
80487db: 89 75 bc mov %esi,-0x44(%ebp)
80487de: 89 de mov %ebx,%esi
80487e0: 0f af f0 imul %eax,%esi
80487e3: 03 75 bc add -0x44(%ebp),%esi
80487e6: f7 e1 mul %ecx
80487e8: 8d 0c 16 lea (%esi,%edx,1),%ecx
80487eb: 89 ca mov %ecx,%edx
80487ed: 8b 45 c4 mov -0x3c(%ebp),%eax
80487f0: ba 00 00 00 00 mov $0x0,%edx
80487f5: 89 f9 mov %edi,%ecx
80487f7: bb 00 00 00 00 mov $0x0,%ebx
80487fc: 89 d6 mov %edx,%esi
80487fe: 0f af f1 imul %ecx,%esi
8048801: 89 75 bc mov %esi,-0x44(%ebp)
8048804: 89 de mov %ebx,%esi
8048806: 0f af f0 imul %eax,%esi
8048809: 03 75 bc add -0x44(%ebp),%esi
804880c: f7 e1 mul %ecx
804880e: 8d 0c 16 lea (%esi,%edx,1),%ecx
8048811: 89 ca mov %ecx,%edx
8048813: 8b 55 c4 mov -0x3c(%ebp),%edx
8048816: 89 f8 mov %edi,%eax
8048818: 0f af c2 imul %edx,%eax
804881b: c1 e0 02 shl $0x2,%eax
804881e: 8d 50 03 lea 0x3(%eax),%edx
8048821: b8 10 00 00 00 mov $0x10,%eax
8048826: 83 e8 01 sub $0x1,%eax
8048829: 01 d0 add %edx,%eax
804882b: bf 10 00 00 00 mov $0x10,%edi
8048830: ba 00 00 00 00 mov $0x0,%edx
8048835: f7 f7 div %edi
8048837: 6b c0 10 imul $0x10,%eax,%eax
804883a: 29 c4 sub %eax,%esp
804883c: 89 e0 mov %esp,%eax
804883e: 83 c0 03 add $0x3,%eax
8048841: c1 e8 02 shr $0x2,%eax
8048844: c1 e0 02 shl $0x2,%eax
8048847: 89 45 d4 mov %eax,-0x2c(%ebp)
804884a: 8b 65 c0 mov -0x40(%ebp),%esp
804884d: 8d 65 f4 lea -0xc(%ebp),%esp
8048850: 5b pop %ebx
8048851: 5e pop %esi
8048852: 5f pop %edi
8048853: 5d pop %ebp
8048854: c3 ret
8048855: 55 push %ebp
8048856: 89 e5 mov %esp,%ebp
8048858: 83 ec 38 sub $0x38,%esp
804885b: c7 45 e4 01 00 00 00 movl $0x1,-0x1c(%ebp)
8048862: c7 45 e8 02 00 00 00 movl $0x2,-0x18(%ebp)
8048869: c7 45 ec 03 00 00 00 movl $0x3,-0x14(%ebp)
8048870: c7 45 f0 04 00 00 00 movl $0x4,-0x10(%ebp)
8048877: c7 45 f4 09 00 00 00 movl $0x9,-0xc(%ebp)
804887e: 8d 45 e4 lea -0x1c(%ebp),%eax
8048881: 83 c0 14 add $0x14,%eax
8048884: 89 45 e0 mov %eax,-0x20(%ebp)
8048887: 8d 45 e4 lea -0x1c(%ebp),%eax
804888a: 83 c0 01 add $0x1,%eax
804888d: 89 45 dc mov %eax,-0x24(%ebp)
8048890: 8d 45 e4 lea -0x1c(%ebp),%eax
8048893: 83 c0 14 add $0x14,%eax
8048896: 89 45 d8 mov %eax,-0x28(%ebp)
8048899: 8d 45 e4 lea -0x1c(%ebp),%eax
804889c: 89 44 24 04 mov %eax,0x4(%esp)
80488a0: c7 04 24 6b 8b 04 08 movl $0x8048b6b,(%esp)
80488a7: e8 e4 fa ff ff call 8048390
80488ac: 8d 45 e4 lea -0x1c(%ebp),%eax
80488af: 89 44 24 04 mov %eax,0x4(%esp)
80488b3: c7 04 24 75 8b 04 08 movl $0x8048b75,(%esp)
80488ba: e8 d1 fa ff ff call 8048390
80488bf: 8d 45 e4 lea -0x1c(%ebp),%eax
80488c2: 83 c0 04 add $0x4,%eax
80488c5: 89 44 24 04 mov %eax,0x4(%esp)
80488c9: c7 04 24 6b 8b 04 08 movl $0x8048b6b,(%esp)
80488d0: e8 bb fa ff ff call 8048390
80488d5: 8d 45 e4 lea -0x1c(%ebp),%eax
80488d8: 83 c0 14 add $0x14,%eax
80488db: 89 44 24 04 mov %eax,0x4(%esp)
80488df: c7 04 24 75 8b 04 08 movl $0x8048b75,(%esp)
80488e6: e8 a5 fa ff ff call 8048390
80488eb: 8b 45 d8 mov -0x28(%ebp),%eax
80488ee: 89 44 24 04 mov %eax,0x4(%esp)
80488f2: c7 04 24 7f 8b 04 08 movl $0x8048b7f,(%esp)
80488f9: e8 92 fa ff ff call 8048390
80488fe: 8b 45 d8 mov -0x28(%ebp),%eax
8048901: 89 44 24 04 mov %eax,0x4(%esp)
8048905: c7 04 24 8c 8b 04 08 movl $0x8048b8c,(%esp)
804890c: e8 7f fa ff ff call 8048390
8048911: 8d 45 d8 lea -0x28(%ebp),%eax
8048914: 89 44 24 04 mov %eax,0x4(%esp)
8048918: c7 04 24 97 8b 04 08 movl $0x8048b97,(%esp)
804891f: e8 6c fa ff ff call 8048390
8048924: 8b 45 e0 mov -0x20(%ebp),%eax
8048927: 8b 00 mov (%eax),%eax
8048929: 89 44 24 04 mov %eax,0x4(%esp)
804892d: c7 04 24 a3 8b 04 08 movl $0x8048ba3,(%esp)
8048934: e8 57 fa ff ff call 8048390
8048939: 8b 45 e0 mov -0x20(%ebp),%eax
804893c: 8b 00 mov (%eax),%eax
804893e: 89 44 24 04 mov %eax,0x4(%esp)
8048942: c7 04 24 b2 8b 04 08 movl $0x8048bb2,(%esp)
8048949: e8 42 fa ff ff call 8048390
804894e: 8b 45 e0 mov -0x20(%ebp),%eax
8048951: 89 44 24 04 mov %eax,0x4(%esp)
8048955: c7 04 24 bd 8b 04 08 movl $0x8048bbd,(%esp)
804895c: e8 2f fa ff ff call 8048390
8048961: 8b 45 e0 mov -0x20(%ebp),%eax
8048964: 89 44 24 04 mov %eax,0x4(%esp)
8048968: c7 04 24 b2 8b 04 08 movl $0x8048bb2,(%esp)
804896f: e8 1c fa ff ff call 8048390
8048974: 8d 45 e0 lea -0x20(%ebp),%eax
8048977: 89 44 24 04 mov %eax,0x4(%esp)
804897b: c7 04 24 ca 8b 04 08 movl $0x8048bca,(%esp)
8048982: e8 09 fa ff ff call 8048390
8048987: 8b 45 e0 mov -0x20(%ebp),%eax
804898a: 83 e8 04 sub $0x4,%eax
804898d: 8b 00 mov (%eax),%eax
804898f: 89 44 24 04 mov %eax,0x4(%esp)
8048993: c7 04 24 d6 8b 04 08 movl $0x8048bd6,(%esp)
804899a: e8 f1 f9 ff ff call 8048390
804899f: 8b 45 dc mov -0x24(%ebp),%eax
80489a2: 89 44 24 04 mov %eax,0x4(%esp)
80489a6: c7 04 24 e5 8b 04 08 movl $0x8048be5,(%esp)
80489ad: e8 de f9 ff ff call 8048390
80489b2: 8d 45 dc lea -0x24(%ebp),%eax
80489b5: 89 44 24 04 mov %eax,0x4(%esp)
80489b9: c7 04 24 f0 8b 04 08 movl $0x8048bf0,(%esp)
80489c0: e8 cb f9 ff ff call 8048390
80489c5: b8 00 00 00 00 mov $0x0,%eax
80489ca: c9 leave
80489cb: c3 ret
80489cc: 55 push %ebp
80489cd: 89 e5 mov %esp,%ebp
80489cf: 57 push %edi
80489d0: 53 push %ebx
80489d1: 83 ec 40 sub $0x40,%esp
80489d4: 8d 5d cc lea -0x34(%ebp),%ebx
80489d7: b8 00 00 00 00 mov $0x0,%eax
80489dc: ba 0a 00 00 00 mov $0xa,%edx
80489e1: 89 df mov %ebx,%edi
80489e3: 89 d1 mov %edx,%ecx
80489e5: f3 ab rep stos %eax,%es:(%edi)
80489e7: c7 45 cc 0b 00 00 00 movl $0xb,-0x34(%ebp)
80489ee: c7 45 d0 0f 00 00 00 movl $0xf,-0x30(%ebp)
80489f5: c7 45 d4 14 00 00 00 movl $0x14,-0x2c(%ebp)
80489fc: c7 45 d8 19 00 00 00 movl $0x19,-0x28(%ebp)
8048a03: c7 45 dc 1e 00 00 00 movl $0x1e,-0x24(%ebp)
8048a0a: 8d 45 cc lea -0x34(%ebp),%eax
8048a0d: 83 c0 08 add $0x8,%eax
8048a10: 89 45 f4 mov %eax,-0xc(%ebp)
8048a13: 8b 45 f4 mov -0xc(%ebp),%eax
8048a16: 8b 00 mov (%eax),%eax
8048a18: 89 44 24 04 mov %eax,0x4(%esp)
8048a1c: c7 04 24 fc 8b 04 08 movl $0x8048bfc,(%esp)
8048a23: e8 68 f9 ff ff call 8048390
8048a28: 8b 45 f4 mov -0xc(%ebp),%eax
8048a2b: 83 e8 04 sub $0x4,%eax
8048a2e: 8b 00 mov (%eax),%eax
8048a30: 89 44 24 04 mov %eax,0x4(%esp)
8048a34: c7 04 24 fc 8b 04 08 movl $0x8048bfc,(%esp)
8048a3b: e8 50 f9 ff ff call 8048390
8048a40: 8b 45 f4 mov -0xc(%ebp),%eax
8048a43: 83 e8 08 sub $0x8,%eax
8048a46: 8b 00 mov (%eax),%eax
8048a48: 89 44 24 04 mov %eax,0x4(%esp)
8048a4c: c7 04 24 fc 8b 04 08 movl $0x8048bfc,(%esp)
8048a53: e8 38 f9 ff ff call 8048390
8048a58: 8b 45 f0 mov -0x10(%ebp),%eax
8048a5b: 89 44 24 04 mov %eax,0x4(%esp)
8048a5f: c7 04 24 fc 8b 04 08 movl $0x8048bfc,(%esp)
8048a66: e8 25 f9 ff ff call 8048390
8048a6b: b8 00 00 00 00 mov $0x0,%eax
8048a70: 83 c4 40 add $0x40,%esp
8048a73: 5b pop %ebx
8048a74: 5f pop %edi
8048a75: 5d pop %ebp
8048a76: c3 ret
8048a77: 55 push %ebp
8048a78: 89 e5 mov %esp,%ebp
8048a7a: 83 e4 f0 and $0xfffffff0,%esp
8048a7d: e8 8b fb ff ff call 804860d <__libc_start_main@plt+0x25d>
8048a82: e8 10 fd ff ff call 8048797 <__libc_start_main@plt+0x3e7>
8048a87: e8 44 fa ff ff call 80484d0 <__libc_start_main@plt+0x120>
8048a8c: e8 02 fb ff ff call 8048593 <__libc_start_main@plt+0x1e3>
8048a91: e8 05 fb ff ff call 804859b <__libc_start_main@plt+0x1eb>
8048a96: e8 32 fb ff ff call 80485cd <__libc_start_main@plt+0x21d>
8048a9b: e8 b5 fd ff ff call 8048855 <__libc_start_main@plt+0x4a5>
8048aa0: e8 27 ff ff ff call 80489cc <__libc_start_main@plt+0x61c>
8048aa5: b8 00 00 00 00 mov $0x0,%eax
8048aaa: c9 leave
8048aab: c3 ret
8048aac: 66 90 xchg %ax,%ax
8048aae: 66 90 xchg %ax,%ax
8048ab0: 55 push %ebp
8048ab1: 57 push %edi
8048ab2: 31 ff xor %edi,%edi
8048ab4: 56 push %esi
8048ab5: 53 push %ebx
8048ab6: e8 35 f9 ff ff call 80483f0 <__libc_start_main@plt+0x40>
8048abb: 81 c3 45 15 00 00 add $0x1545,%ebx
8048ac1: 83 ec 1c sub $0x1c,%esp
8048ac4: 8b 6c 24 30 mov 0x30(%esp),%ebp
8048ac8: 8d b3 f4 fe ff ff lea -0x10c(%ebx),%esi
8048ace: e8 85 f8 ff ff call 8048358
8048ad3: 8d 83 f0 fe ff ff lea -0x110(%ebx),%eax
8048ad9: 29 c6 sub %eax,%esi
8048adb: c1 fe 02 sar $0x2,%esi
8048ade: 85 f6 test %esi,%esi
8048ae0: 74 27 je 8048b09 <__libc_start_main@plt+0x759>
8048ae2: 8d b6 00 00 00 00 lea 0x0(%esi),%esi
8048ae8: 8b 44 24 38 mov 0x38(%esp),%eax
8048aec: 89 2c 24 mov %ebp,(%esp)
8048aef: 89 44 24 08 mov %eax,0x8(%esp)
8048af3: 8b 44 24 34 mov 0x34(%esp),%eax
8048af7: 89 44 24 04 mov %eax,0x4(%esp)
8048afb: ff 94 bb f0 fe ff ff call *-0x110(%ebx,%edi,4)
8048b02: 83 c7 01 add $0x1,%edi
8048b05: 39 f7 cmp %esi,%edi
8048b07: 75 df jne 8048ae8 <__libc_start_main@plt+0x738>
8048b09: 83 c4 1c add $0x1c,%esp
8048b0c: 5b pop %ebx
8048b0d: 5e pop %esi
8048b0e: 5f pop %edi
8048b0f: 5d pop %ebp
8048b10: c3 ret
8048b11: eb 0d jmp 8048b20 <__libc_start_main@plt+0x770>
8048b13: 90 nop
8048b14: 90 nop
8048b15: 90 nop
8048b16: 90 nop
8048b17: 90 nop
8048b18: 90 nop
8048b19: 90 nop
8048b1a: 90 nop
8048b1b: 90 nop
8048b1c: 90 nop
8048b1d: 90 nop
8048b1e: 90 nop
8048b1f: 90 nop
8048b20: f3 c3 repz ret
8048b22: 66 90 xchg %ax,%ax
Disassembly of section .fini:
08048b24 <.fini>:
8048b24: 53 push %ebx
8048b25: 83 ec 08 sub $0x8,%esp
8048b28: e8 c3 f8 ff ff call 80483f0 <__libc_start_main@plt+0x40>
8048b2d: 81 c3 d3 14 00 00 add $0x14d3,%ebx
8048b33: 83 c4 08 add $0x8,%esp
8048b36: 5b pop %ebx
8048b37: c3 ret
// 源代码
#define COLS 4
int sum2d(int ar[][COLS], int rows);
int sum (int ar[], int n);
int aaa()
{
int total1, total2, total3;
int *pt1;
int (*pt2)[COLS];
pt1 = (int [2]) {10, 20};
pt2 = (int [2][COLS]) { {1, 2, 3, -9}, {4, 5, 6,-8} };
total1 = sum(pt1, 2);
total2 = sum2d(pt2, 2);
total3 = sum((int[]){4,4,4,5,5,5},6);
printf("total1 = %d\n", total1); // 30
printf("total2 = %d\n", total2); // 4
printf("total3 = %d\n", total3); // 27
}
int sum(int ar[], int n)
{
int i;
int total = 0;
for (i = 0; i < n; i++)
total += ar[i];
return total;
}
int sum2d(int ar[][COLS], int rows)
{
int r;
int c;
int tot = 0;
for (r = 0; r < rows; r++)
for (c = 0; c < COLS; c++)
tot += ar[r][c];
return tot;
}
int main()
{
aaa();
return 0;
}