资源描述：
《函数反汇编以及栈结构分析》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。
1、#includeusingnamespacestd;intfunc(inta,intb);voidmain(){intx=1;inty=2;intz=func(x,y);}intfunc(inta,intb){returna+b;}汇编解析：voidmain(){//这个函数头产生的汇编代码是：main:013E13A0pushebp013E13A1movebp,esp013E13A3subesp,0E4h013E13A9pushebx013E13AApushesi013E13ABpushedi013E13AClea
2、edi,[ebp-0E4h]013E13B2movecx,39h013E13B7moveax,0CCCCCCCCh013E13BCrepstosdwordptres:[edi]*******************************************************intx=1;inty=2;//这个的汇编代码是：013E13BEmovdwordptr[x],1013E13C5movdwordptr[y],2*******************************************************
3、//接下来就是函数的调用了，先是把参数压栈013E13CCmoveax,dwordptr[y]013E13CFpusheax013E13D0movecx,dwordptr[x]013E13D3pushecx//参数压栈后就是调用函数013E13D4callfunc(13E11D1h)//在这个地方用F11调试步进，可以进入子函数func的汇编代码，如下：013E11D1jmpfunc(13E35B0h)func:013E35B0pushebp013E35B1movebp,esp013E35B3subesp,0C0h013E35B9pus
4、hebx013E35BApushesi013E35BBpushedi013E35BCleaedi,[ebp-0C0h]013E35C2movecx,30h013E35C7moveax,0CCCCCCCCh013E35CCrepstosdwordptres:[edi]013E35CEmoveax,dwordptr[a]013E35D1addeax,dwordptr[b]013E35D4popedi013E35D5popesi013E35D6popebx013E35D7movesp,ebp013E35D9popebp013E35DAret/
5、/func函数执行完毕后返回主函数中013E13D9addesp,8013E13DCmovdwordptr[z],eax013E13DFxoreax,eax013E13E1popedi013E13E2popesi013E13E3popebx013E13E4addesp,0E4h013E13EAcmpebp,esp013E13ECcall@ILT+315(__RTC_CheckEsp)(13E1140h)013E13F1movesp,ebp013E13F3popebp013E13F4ret接下来再看看各个寄存器都是怎么变的，里面存的什么东
6、西1首先进入main函数最开始：再看看此时的寄存器的内容：EAX = 00851D88EBX = 7E0BC000ECX = 00854A30EDX = 00000001ESI = 00000000EDI = 00000000EIP = 013E13A0ESP = 009BF76CEBP = 009BF7B8EFL = 000002022再进行单步调试：再观察一下寄存器的内容：EAX = 00851D88EBX = 7E0BC000ECX = 00854A30EDX = 00000001ESI = 00000000EDI = 00000
7、000EIP = 013E13A1ESP = 009BF768EBP = 009BF7B8EFL = 00000202我们发现esp的值少了4，这就说明了函数压栈时是从高字节到低字节递减，越是后压进来的越是字节低。3再把esp的值保存一下再看一下寄存器的内容：EAX = 00851D88EBX = 7E0BC000ECX = 00854A30EDX = 00000001ESI = 00000000EDI = 00000000EIP = 013E13A3ESP = 009BF768EBP = 009BF768EFL = 00000202E
8、bp就保存了esp的值4再步进到直到main函数调用func函数之前我们再观察内存的情况连续定义的变量，他们在内存中紧挨着，之间相差4个字节。其实在堆栈中每次内存偏移必须是4个字节的整数倍。这个在参数数目以
