协助使用C代码和汇编代码绘制堆栈
我想绘制一个堆栈,因为它会出现在secondCall函数的“返回计数”行之前。 我试图绘制它,以便显示三个活动函数main,firstCall和secondCall的所有三个帧(或激活记录)。
有人会帮我完成堆栈图吗? 我试图在调用下一个函数之前绘制基本(ebp)和堆栈(esp)指针的位置,因为它们位于每个堆栈帧中。
C代码如下:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
int secondCall(int a, int b) {
int count;
count = write(STDOUT_FILENO, &"hellon", 6);
count += write(STDOUT_FILENO, &"jbnd007n", 8);
count += a + b;
return count;
}
int firstCall(void) {
int local;
local = secondCall(4, 2);
return local;
}
int main(int argc, char** argv) {
int result;
result = firstCall();
return (EXIT_SUCCESS);
}
汇编代码如下:
.file "A3Program2.c"
.section .rodata
.LC0:
.string "hellon"
.LC1:
.string "jbnd007n"
.text
.globl secondCall
.type secondCall, @function
secondCall:
pushl %ebp
movl %esp, %ebp
subl $40, %esp
movl $6, 8(%esp)
movl $.LC0, 4(%esp)
movl $1, (%esp)
call write
movl %eax, -12(%ebp)
movl $8, 8(%esp)
movl $.LC1, 4(%esp)
movl $1, (%esp)
call write
addl %eax, -12(%ebp)
movl 12(%ebp), %eax
movl 8(%ebp), %edx
leal (%edx,%eax), %eax
addl %eax, -12(%ebp)
movl -12(%ebp), %eax
leave
ret
.size secondCall, .-secondCall
.globl firstCall
.type firstCall, @function
firstCall:
pushl %ebp
movl %esp, %ebp
subl $40, %esp
movl $2, 4(%esp)
movl $4, (%esp)
call secondCall
movl %eax, -12(%ebp)
movl -12(%ebp), %eax
leave
ret
.size firstCall, .-firstCall
.globl main
.type main, @function
main:
pushl %ebp
movl %esp, %ebp
andl $-16, %esp
subl $16, %esp
call firstCall
movl %eax, 12(%esp)
movl $0, %eax
leave
ret
.size main, .-main
.ident "GCC: (Ubuntu/Linaro 4.4.4-14ubuntu5) 4.4.5"
.section .note.GNU-stack,"",@progbits
我现在的堆栈绘图是:
+------------------------------+ high address
| original position of stack pointer
+------------------------------+
| saved value of ebp <- ebp (base pointer when in main)
+------------------------------+
| alignment spacing (don’t really know how big until runtime)
+------------------------------+
|
+------------------------------+
|
+------------------------------+
|
+------------------------------+
...
Each line represents 4 bytes (from lowest address (left) to highest address (right)).
我不会为你做所有的事情,但这里有详细的解释,告诉你如何看待发生的事情。
进入main
栈时,看起来像这样:
: (whatever) :
+-----------------------------------+
| return address (in main's caller) | <- %esp
+-----------------------------------+
标准序幕码:
pushl %ebp
movl %esp, %ebp
: (whatever) :
+-----------------------------------+
| return address (in main's caller) |
+-----------------------------------+
| saved %ebp | <- new %ebp = %esp
+-----------------------------------+
通过调零%esp
的最后4位,可将堆栈降至16字节边界:
andl $-16, %esp
: (whatever) :
+-----------------------------------+
| return address (in main's caller) |
+-----------------------------------+
| saved %ebp | <- new %ebp
+-----------------------------------+
: some unknown amount of space :
: (0, 4, 8 or 12 bytes) : <- %esp
+-----------------------------------+
...这是你到达的地方。 继续:
这会从堆栈指针中减去16个字节,从而为main
使用创建16个字节的保留空间:
subl $16, %esp
: (whatever) :
+-----------------------------------+
| return address (in main's caller) |
+-----------------------------------+
| saved %ebp | <- %ebp
+-----------------------------------+
: some unknown amount of space :
: (0, 4, 8 or 12 bytes) :
+-----------------------------------+
| 16 bytes of reserved space |
| |
| |
| | <- %esp
+-----------------------------------+
现在main
来电firstCall
; 该call
指令会推送返回地址,因此在firstCall
刚刚输入后,堆栈将如下所示:
call firstCall
: (whatever) :
+-----------------------------------+
| return address (in main's caller) |
+-----------------------------------+
| saved %ebp | <- %ebp
+-----------------------------------+
: some unknown amount of space :
: (0, 4, 8 or 12 bytes) :
+-----------------------------------+
| 16 bytes of reserved space |
| |
| |
| |
+-----------------------------------+
| return address (in main) | <- %esp
+-----------------------------------+
由于firstCall
结束时的ret
指令,返回地址将在返回main
时再次弹出。
...等等。 只需按照相同的方式跟踪代码,遵循%esp
正在做的事情。
另一件可能需要解释的事情是在各种例程的结尾代码中出现的leave
。 所以下面是main
工作原理:
就在离main
结束点leave
之前,堆栈看起来像这样(我们已经从firstCall
返回并将值存储在保留空间中):
: (whatever) :
+-----------------------------------+
| return address (to main's caller) |
+-----------------------------------+
| saved %ebp | <- %ebp
+-----------------------------------+
: some unknown amount of space :
: (0, 4, 8 or 12 bytes) :
+-----------------------------------+
| %eax returned by firstCall |
| (and 12 bytes that were never |
| used) |
| | <- %esp
+-----------------------------------+
leave
等同于movl %ebp, %esp
然后是popl %ebp
。 所以:
movl %ebp, %esp ; (first part of "leave")
: (whatever) :
+-----------------------------------+
| return address (in main's caller) |
+-----------------------------------+
| saved %ebp | <- %esp = current %ebp
+-----------------------------------+
: some unknown amount of space : }
: (0, 4, 8 or 12 bytes) : }
+-----------------------------------+ } all of this stuff is
| %eax returned by firstCall | } irrelevant now
| (and 12 bytes that were never | }
| used) | }
| | }
+-----------------------------------+
popl %ebp ; (second part of "leave")
: (whatever) :
+-----------------------------------+
| return address (in main's caller) | <- %esp (%ebp has now been restored to the
+-----------------------------------+ value it had on entry to "main")
(and now-irrelevant stuff below)
最后, ret
弹出返回地址并在任何被称为main
内部继续执行。
在gdb
中的return count
行打破,然后使用x/30xw $esp
等打印堆栈。 你可以更早打破并注意$esp
然后进入你想要登录的堆栈部分,以获得比我猜测的30个单词更精确的计数。
上一篇: Assistance to draw a stack using C code and assembly code
下一篇: How is the stack pointer changed in this program with call and ret