Symbian中反汇编代码分析

来源：互联网发布：sql 加合计行编辑：程序博客网时间：2024/05/17 07:43

这是比较初级的东西，只是看看栈的分配而已。

源代码

TInt CMyAppDocument::AssembleAdd()
{
TInt result = 0;
TInt a = 2;
TInt b = 3;
result = a+b;
return result;
}

反汇编后

{
0x31312820 <CMyAppDocument::AssembleAdd>:    push ebp
0x31312821 <CMyAppDocument::AssembleAdd+1>: mov   ebp,esp
0x31312823 <CMyAppDocument::AssembleAdd+3>: sub   esp,0x10
0x31312826 <CMyAppDocument::AssembleAdd+6>: push ecx
0x31312827 <CMyAppDocument::AssembleAdd+7>: push edi
0x31312828 <CMyAppDocument::AssembleAdd+8>: lea   edi,dword ptr [esp+0x8]

0x3131282c <CMyAppDocument::AssembleAdd+12>: mov   eax,0xcccccccc
0x31312831 <CMyAppDocument::AssembleAdd+17>: stosd
0x31312832 <CMyAppDocument::AssembleAdd+18>: stosd
0x31312833 <CMyAppDocument::AssembleAdd+19>: stosd
0x31312834 <CMyAppDocument::AssembleAdd+20>: stosd
0x31312835 <CMyAppDocument::AssembleAdd+21>: pop   edi
0x31312836 <CMyAppDocument::AssembleAdd+22>: pop   ecx
0x31312837 <CMyAppDocument::AssembleAdd+23>: mov   dword ptr [ebp-0x10],ecx
TInt result = 0;
0x3131283a <CMyAppDocument::AssembleAdd+26>: mov   dword ptr [ebp-0x4],0x0
TInt a = 2;
0x31312841 <CMyAppDocument::AssembleAdd+33>: mov   dword ptr [ebp-0x8],0x2
TInt b = 3;
0x31312848 <CMyAppDocument::AssembleAdd+40>: mov   dword ptr [ebp-0xc],0x3
result = a+b;
0x3131284f <CMyAppDocument::AssembleAdd+47>: mov   edx,dword ptr [ebp-0x8]
0x31312852 <CMyAppDocument::AssembleAdd+50>: add   edx,dword ptr [ebp-0xc]
0x31312855 <CMyAppDocument::AssembleAdd+53>: mov   dword ptr [ebp-0x4],edx
return result;
0x31312858 <CMyAppDocument::AssembleAdd+56>: mov   eax,dword ptr [ebp-0x4]

}
0x3131285b <CMyAppDocument::AssembleAdd+59>: leave

0x3131285c <CMyAppDocument::AssembleAdd+60>: ret near

栈空间分析：

|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------| <High address of memory>
|       ESP        | ;Before push EBP
|------------------|
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
PUSH ebp
MOV ebp,esp
|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------|
|                  | ;ESP-0x10
|------------------|
|                  | ;ESP-0xC
|------------------|
|                  | ;ESP-0x8
|------------------|
|                  | ;ESP-0x4
|------------------|
|     EBP          | ;Current ESP
|------------------| <High address of memory>

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
SUB esp,0x10
|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------|
|                  | ;Current ESP
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|      EBP         |
|------------------| <High address of memory>

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
PUSH ecx
|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------|
|      ECX         | ;Current ESP
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|      EBP         |
|------------------| <High address of memory>

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
PUSH edi
|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------|
|      EDI         | ;Current ESP
|------------------|
|      ECX         |
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|      EBP         |
|------------------| <High address of memory>

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
LEA edi,dword ptr[esp+0x8]
|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------|
|      EDI         | ;Current ESP, edi pointer to ESP+0x8
|------------------|
|      ECX         |
|------------------|
|                  | ;ESP+0x8, EDI pointer to here
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|      EBP         |
|------------------| <High address of memory>

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
MOV EAX,0xCCCCCCCC
|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------|
|      EDI         | ;Current ESP, edi pointer to ESP+0x8
|------------------|
|      ECX         |
|------------------|
|                  | ;ESP+0x8, EDI pointer to here
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|                  |
|------------------|
|      EBP         |
|------------------| <High address of memory>
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
STOSD

STOSD
STOSD
STOSD
|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------|
|      EDI         | ;Current ESP, edi pointer to ESP+0x8
|------------------|
|      ECX         |
|------------------|
|   0xCCCCCCCC     | ;ESP+0x8, First EDI pointer to here
|------------------|
|   0xCCCCCCCC     | ;Second EDI pointer to here
|------------------|
|   0xCCCCCCCC     | ;Third EDI pointer to here
|------------------|
|   0xCCCCCCCC     | ;Fourth EDI pointer to here
|------------------|
|      EBP         |
|------------------| <High address of memory>

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
POP edi
POP ecx
|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------|
|   0xCCCCCCCC     | ;Current ESP
|------------------|
|   0xCCCCCCCC     |
|------------------|
|   0xCCCCCCCC     |
|------------------|
|   0xCCCCCCCC     |
|------------------|
|      EBP         |
|------------------| <High address of memory>

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
MOV dword ptr[ebp-0x10],ECX ;Address[0x2F873920],contents at memory[586A7107]<===>0x07716A58(Little-endian)
|------------------| <Low address of memory>
|                  |
|------------------|
|     ......       |
|------------------|
|   0x2F873920     | ;EBP-0x10, and mov the content of ECX to here
|------------------|
|   0xCCCCCCCC     | ;Current ESP
|------------------|
|   0xCCCCCCCC     |
|------------------|
|   0xCCCCCCCC     |
|------------------|
|   0xCCCCCCCC     |
|------------------|
|      EBP         |
|------------------| <High address of memory>

剩下的和上面的类似，就不再列出了。