In addition to Weibo, there is also WeChat
Please pay attention
WeChat public account
Shulou
2025-02-28 Update From: SLTechnology News&Howtos shulou NAV: SLTechnology News&Howtos > Network Security >
Share
Shulou(Shulou.com)06/01 Report--
When the function is called:
1. Stack needle register esp ebp
When the esp increases, the stack space decreases, and when the stack space decreases, the ebp points to the stack base address unchanged.
two。 When calling the function, the parameters press the stack from right to left, the stack space direction is from the high address (bottom of the stack) to the low address (top of the stack), and then press the return address. After the function address is put into the stack, EBP enters the stack, and then gives the value of the current ESP to EBP, the corresponding assembly instruction:
Push ebpmov ebp esp
This is equivalent to entering the stack space of this function.
The following is the reprinted content:
Http://blog.163.com/yichangjun1989@126/blog/static/131972028201442221956603/
# include
Int func (int param1, int param2,int param3)
{
Int var1 = param1
Int var2 = param2
Int var3 = param3
Printf ("var1=%d,var2=%d,var3=%d", var1,var2,var3)
Return var1
}
Int main (int argc, char* argv [])
{
Int result = func (1, 2, 3)
Return 0
}
First of all, it is explained that the distribution of variables in the stack is from high address to low address, and EBP is the pointer to the bottom of the stack, which is unchanged in the procedure call, also known as the frame pointer. ESP points to the top of the stack, moves when the program is executed, ESP reduces allocation space, ESP increases free space, and ESP is also known as stack pointer.
Let's analyze the calling process of the function step by step.
1. The function main executes, and the parameters of main are gradually pushed into the stack from right to left, and finally the return address is pressed.
two。 Execute line 15, with three parameters pushed into the stack from left to right, and from param3 to param1, as shown in the following figure:
3. Then the return address is stacked: at this time, the distribution in the stack is as follows:
4. When the function is called in line 3, after entering the function through the jump instruction, the function address enters the stack, EBP enters the stack, and then the value of the current ESP is given to EBP, the corresponding assembly instruction:
Push ebpmov ebp esp
At this point, the top and bottom of the stack point to the same location, and the distribution in the stack is as follows:
5. Line 5 starts execution, and int var1 = param1; int var2 = param2; int var3 = param3; is stored in the order in which it is declared. Corresponding compilation:
Mov 0x8 (ebp), eaxmov eax,-0x4 (ebp)
Assign the content of the address [EBP+0x8] to EAX, that is, assign the value of param to EAX, and then put the value of EAX in the address of [EBP-4], that is, assign the value of EAX to var1, complete the C code int var1 = param1, and other variables are the same.
6. Line 9, output the result, line 10 executes the corresponding assembly code:
Mov-0x4 (% ebp),% eax
Finally, the return value of the function is saved through the eax register.
7. After calling the execution function, the local variable var3,var2,var1 goes out of the stack at one time, EBP recovers the original value, the return address goes out of the stack, the original execution address is found, the param1,param2,param3 goes out of the stack in turn, and the function call is finished.
Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.
Views: 0
*The comments in the above article only represent the author's personal views and do not represent the views and positions of this website. If you have more insights, please feel free to contribute and share.
Continue with the installation of the previous hadoop.First, install zookooper1. Decompress zookoope
"Every 5-10 years, there's a rare product, a really special, very unusual product that's the most un
© 2024 shulou.com SLNews company. All rights reserved.