反汇编系列(二) for

#include"stdio.h"int function(int a,int b){    int c=a+b;    int i;    for(i=0;i<50;i++)    {        c=c+i;    }    return c;}void main(){    function(1,2);} 

--- c:\users\wangchao\desktop\test\test\main.cpp -------------------------------

#include "stdio.h"

int function(int a,int b)

{

011D1A40 push ebp

011D1A41 mov ebp,esp

011D1A43 sub esp,0D8h

011D1A49 push ebx

011D1A4A push esi

011D1A4B push edi

011D1A4C lea edi,[ebp-0D8h]

011D1A52 mov ecx,36h

011D1A57 mov eax,0CCCCCCCCh

011D1A5C rep stos dword ptr es:[edi]

    int c=a+b;

011D1A5E mov eax,dword ptr [a]

011D1A61 add eax,dword ptr [b]

011D1A64 mov dword ptr [c],eax

;---------------------------------------------------------------------------------------------

    int i;

    for(i=0;i<50;i++)

011D1A67 mov dword ptr [i],0         ;i=0

011D1A6E jmp function+39h (11D1A79h) ;跳转到判断i是否大于50

                                          ∧

011D1A70 mov eax,dword ptr [i]       ;    |

011D1A73 add eax,1                   ;执行了i=i+1

011D1A76 mov dword ptr [i],eax       ;    |

                                     ;    ∨

011D1A79 cmp dword ptr [i],32h       ;判断i是否大于50

011D1A7D jge function+4Ah (11D1A8Ah) ;如果大于等于50则跳出for循环,否则继续执行.                   

                                     ;    ∧

    {                                ;    |

        c=c+i;                       ;    |

011D1A7F mov eax,dword ptr [c]       ;执行了c=c+i;

011D1A82 add eax,dword ptr [i]       ;    |

011D1A85 mov dword ptr [c],eax       ;    |

    }                                ;    ∨

011D1A88 jmp function+30h (11D1A70h) ;如果不大于跳转到执行i++的位置

;---------------------------------------------------------------------------------------------

    return c;

011D1A8A mov eax,dword ptr [c]

}

011D1A8D pop edi

011D1A8E pop esi

011D1A8F pop ebx

011D1A90 mov esp,ebp

011D1A92 pop ebp

011D1A93 ret

--- c:\users\wangchao\desktop\test\test\main.cpp -------------------------------

void main()

{

011813E0 push ebp

011813E1 mov ebp,esp

011813E3 sub esp,0C0h

011813E9 push ebx

011813EA push esi

011813EB push edi

011813EC lea edi,[ebp-0C0h]

011813F2 mov ecx,30h

011813F7 mov eax,0CCCCCCCCh

011813FC rep stos dword ptr es:[edi]

    function(1,2);

011813FE push 2

01181400 push 1

01181402 call function (11810E6h)

01181407 add esp,8

}

0118140A xor eax,eax

0118140C pop edi

0118140D pop esi

0118140E pop ebx

0118140F add esp,0C0h

01181415 cmp ebp,esp

01181417 call @ILT+315(__RTC_CheckEsp) (1181140h)

0118141C mov esp,ebp

0118141E pop ebp

0118141F ret

---

基本结构：

   MOV <循环变量>，<初始值>     ;给循环变量赋初值
   JMP B                        ;跳到第一次循环处
A: (改动循环变量）              ;修改循环变量
   ...
B：CMP <循环变量>，<限制变量>   ;检查循环条件
   JGE 跳出循环
   ...
   JMP A   ;调回去修改循环变量