Skip to content

Instantly share code, notes, and snippets.

@mawenbao
Last active August 29, 2015 14:00
Show Gist options
  • Save mawenbao/becea4b6acdc9d3dfb14 to your computer and use it in GitHub Desktop.
Save mawenbao/becea4b6acdc9d3dfb14 to your computer and use it in GitHub Desktop.
part of the command `objdump -dS a.out -j .text` output with some comments, a.out is compiled from call_stack_example.cpp
int foo2(int a, long b, int c, int d, int e, int f, int g, int i) {
push %rbp // 将caller的%rbp入栈
mov %rsp,%rbp // 初始化callee的%rbp
mov %edi,-0x4(%rbp) // a: mem[R[rbp]-0x4] = R[edi]
// 暂存寄存器的值,使其可以被重用,使用-O选项可以优化掉这部分代码
mov %rsi,-0x10(%rbp) // b
mov %edx,-0x8(%rbp) // c
mov %ecx,-0x14(%rbp) // d
mov %r8d,-0x18(%rbp) // e
mov %r9d,-0x1c(%rbp) // f
return g + i;
mov 0x18(%rbp),%eax // g在caller的stack frame的底部
mov 0x10(%rbp),%edx // i在caller的stack frame的底部
add %edx,%eax // R[eax] += R[edx]
}
pop %rbp // 将caller的rbp出栈(恢复%rbp)
retq // 将返回地址出栈,跳转到该地址处
int foo(int &a, long b) {
push %rbp // 将caller的%rbp入栈
mov %rsp,%rbp // 初始化callee的%rbp
sub $0x30,%rsp // 为当前stack frame分配0x30字节的空间
mov %rdi,-0x18(%rbp) // mem[R[rbp]-0x18] = R[rdi]
mov %rsi,-0x20(%rbp) // mem[R[rbp]-0x20] = R[rsi]
int m = 1;
movl $0x1,-0x4(%rbp) // mem[R[rbp]-0x4] = 0x1
int o[3] = {0x1, 0x2, 0x3};
movl $0x1,-0x10(%rbp) // mem[R[rbp]-0x10] = 0x1
movl $0x2,-0xc(%rbp) // mem[R[rbp]-0xc] = 0x1
movl $0x3,-0x8(%rbp) // mem[R[rbp]-0x10] = 0x1
return foo2(0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x9);
movl $0x9,0x8(%rsp) // mem[R[rsp]+0x8] = 0x9; 参数太多,无法用寄存器传递参数0x9
movl $0x7,(%rsp) // mem[$[rsp]] = 0x7; 参数太多,无法用寄存器传递参数0x7
mov $0x6,%r9d // R[r9d] = 0x6 使用寄存器传递函数参数,下同
mov $0x5,%r8d // R[r8d] = 0x5
mov $0x4,%ecx // R[ecx] = 0x4
mov $0x3,%edx // R[edx] = 0x3
mov $0x2,%esi // R[esi] = 0x2
mov $0x1,%edi // R[edi] = 0x1
callq 4004ed <_Z4foo2iliiiiii> // 调用foo2
}
leaveq // 将caller的rbp出栈(恢复%rbp),将已保存的局部变量和临时变量出栈
retq // 将返回地址出栈,跳转到该地址处
int main() {
push %rbp // 将caller的%rbp入栈
mov %rsp,%rbp // 初始化callee的%rbp
sub $0x10,%rsp // 为当前stack frame分配0x10字节的空间
int z = 0xa;
movl $0xa,-0x8(%rbp) // mem[R[%rbp]-0x8] = 0xa
int r = foo(z, 0xb);
lea -0x8(%rbp),%rax // R[rax] = &z
mov $0xb,%esi // R[esi] = 0xb
mov %rax,%rdi // R[rdi] = R[rax]
callq 400513 <_Z3fooRil> // 调用foo
mov %eax,-0x4(%rbp) // mem[R[rbp]-0x4] = R[eax] (%eax保存foo的返回值)
return r;
mov -0x4(%rbp),%eax // R[eax] = mem[R[rbp]-0x4]
}
leaveq // 将caller的rbp出栈(恢复%rbp),将已保存的局部变量和临时变量出栈
retq // 将返回地址出栈,跳转到该地址处
nopl (%rax)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment