数组的实现机制

分析个二维数组的程序

int main(){int a[3][4]={{1,2,3,4},{5,6,7,8},{9,10,11,12}};int i,j;for (i=0;i<3;i++)for (j=0;j<4;j++){a[i][j]*=2;printf("%d",a[i][j]);}return 0;}

反汇编代码如下：

int main(){00F913A0 push ebp 00F913A1 mov ebp,esp 00F913A3 sub esp,110h 00F913A9 push ebx 00F913AA push esi 00F913AB push edi 00F913AC lea edi,[ebp-110h] 00F913B2 mov ecx,44h 00F913B7 mov eax,0CCCCCCCCh 00F913BC rep stos dword ptr es:[edi] int a[3][4]={{1,2,3,4},{5,6,7,8},{9,10,11,12}};00F913BE mov dword ptr [a],1 ；局部变量a[0][0]=100F913C5 mov dword ptr [ebp-30h],2 ；局部变量a[0][1]=2，依此类推00F913CC mov dword ptr [ebp-2Ch],3 00F913D3 mov dword ptr [ebp-28h],4 00F913DA mov dword ptr [ebp-24h],5 00F913E1 mov dword ptr [ebp-20h],6 00F913E8 mov dword ptr [ebp-1Ch],7 00F913EF mov dword ptr [ebp-18h],8 00F913F6 mov dword ptr [ebp-14h],9 00F913FD mov dword ptr [ebp-10h],0Ah 00F91404 mov dword ptr [ebp-0Ch],0Bh 00F9140B mov dword ptr [ebp-8],0Ch ；局部变量a[2][3]=12int i,j;for (i=0;i<3;i++)00F91412 mov dword ptr [i],0 ；i=000F91419 jmp main+84h (0F91424h) ；典型的for循环结构，无条件跳转到00F9141B mov eax,dword ptr [i] ；eax=i00F9141E add eax,1 ；eax加100F91421 mov dword ptr [i],eax ；i加100F91424 cmp dword ptr [i],3 ；i<3吗00F91428 jge main+0F0h (0F91490h) ；如果i>=3，就跳转到for (j=0;j<4;j++)00F9142A mov dword ptr [j],0 ；j=000F91431 jmp main+9Ch (0F9143Ch) ；典型的for循环，无条件跳转到00F91433 mov eax,dword ptr [j] ；eax=j00F91436 add eax,1 ；00F91439 mov dword ptr [j],eax ；j加100F9143C cmp dword ptr [j],4 ；j<4吗00F91440 jge main+0EEh (0F9148Eh) ；如果j>=4，就跳转到{a[i][j]*=2;00F91442 mov eax,dword ptr [i] ；eax=i00F91445 shl eax,4 ；i=i*2^4=i*1600F91448 lea ecx,a[eax] ；ecx指向a[i]00F9144C mov edx,dword ptr [j] ；edx=j00F9144F mov eax,dword ptr [ecx+edx*4] ；eax=a[i][j]00F91452 shl eax,1 ；eax=eax*200F91454 mov ecx,dword ptr [i] ；ecx=i00F91457 shl ecx,4 ；i=i*1600F9145A lea edx,a[ecx] ；edx指向a[i]00F9145E mov ecx,dword ptr [j] ；ecx=j00F91461 mov dword ptr [edx+ecx*4],eax ；eax存入a[i][j]printf("%d",a[i][j]);00F91464 mov eax,dword ptr [i] ；eax=i00F91467 shl eax,4 ；i=i*1600F9146A lea ecx,a[eax] ；ecx指向a[i]00F9146E mov esi,esp ；esi存放当前堆栈指针00F91470 mov edx,dword ptr [j] ；edx=j00F91473 mov eax,dword ptr [ecx+edx*4] ；eax=a[i][j]00F91476 push eax ；a[i][j]入栈00F91477 push offset string "%d" (0F9573Ch) ；字符串”%d”地址入栈00F9147C call dword ptr [__imp__printf (0F982BCh)] ；调用printf函数00F91482 add esp,8 00F91485 cmp esi,esp 00F91487 call @ILT+310(__RTC_CheckEsp) (0F9113Bh) 00F9148C jmp main+93h (0F91433h) ；无条件跳转到}00F9148E jmp main+7Bh (0F9141Bh) ；无条件跳转到return 0;00F91490 xor eax,eax ；清空eax}00F91492 push edx 00F91493 mov ecx,ebp 00F91495 push eax 00F91496 lea edx,[ (0F914B8h)] 00F9149C call @ILT+130(@_RTC_CheckStackVars@8) (0F91087h) 00F914A1 pop eax 00F914A2 pop edx 00F914A3 pop edi 00F914A4 pop esi 00F914A5 pop ebx 00F914A6 add esp,110h ；从栈中弹出110h字节00F914AC cmp ebp,esp 00F914AE call @ILT+310(__RTC_CheckEsp) (0F9113Bh) 00F914B3 mov esp,ebp 00F914B5 pop ebp 00F914B6 ret

在VC6.0中反汇编得到的实现a[i][j]*=2的代码略有不同

edx=i*16  ；因为数组每行数据有4个，每个4字节

eax=j

mov ecx,dword ptr[edx+eax*4+422a30h]  ；422a30h是数组在内存的起始地址