cpp反汇编之const分析

来源：互联网发布：算法的概念简单例题编辑：程序博客网时间：2024/04/30 01:59

先来分析一个简单的例子。(注意容易出错)

代码非常简单

#include<iostream>#include<cstdio>using namespace std;int main(){const int a = 1;int* b = (int*)&a;*b = 2;cout << a << endl << *b << endl;return 0;}

反汇编分析重点之处有注释

1:    #include<iostream>2:    #include<cstdio>3:    using namespace std;4:    int main(){00401560   push        ebp00401561   mov         ebp,esp00401563   sub         esp,48h00401566   push        ebx00401567   push        esi00401568   push        edi00401569   lea         edi,[ebp-48h]0040156C   mov         ecx,12h00401571   mov         eax,0CCCCCCCCh00401576   rep stos    dword ptr [edi]5:        const int a = 1;00401578   mov         dword ptr [ebp-4],16:        int* b = (int*)&a;0040157F   lea         eax,[ebp-4]00401582   mov         dword ptr [ebp-8],eax7:        *b = 2;00401585   mov         ecx,dword ptr [ebp-8]  ecx即是指针b的值00401588   mov         dword ptr [ecx],28:        cout<<a<<endl<<*b<<endl;0040158E   push        offset @ILT+195(std::endl) (004010c8)00401593   mov         edx,dword ptr [ebp-8]00401596   mov         eax,dword ptr [edx]00401598   push        eax//此处使用eax存储00401599   push        offset @ILT+195(std::endl) (004010c8)0040159E   push        1//此处即是常量a004015A0   mov         ecx,offset std::cout (0047be90)004015A5   call        @ILT+250(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004010ff)004015AA   mov         ecx,eax004015AC   call        @ILT+475(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004011e0)004015B1   mov         ecx,eax004015B3   call        @ILT+250(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004010ff)004015B8   mov         ecx,eax004015BA   call        @ILT+475(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004011e0)9:        return 0;004015BF   xor         eax,eax10:   }004015C1   pop         edi004015C2   pop         esi004015C3   pop         ebx004015C4   add         esp,48h004015C7   cmp         ebp,esp004015C9   call        __chkesp (00420550)004015CE   mov         esp,ebp004015D0   pop         ebp004015D1   ret输出:12内存寄存器分析执行00401578   mov         dword ptr [ebp-4],1 之前0018FF33  CC CC CC CC CC CC CC  烫烫烫.0018FF3A  CC CC CC CC CC CC CC  烫烫烫.0018FF41  CC CC CC CC CC CC CC  烫烫烫.0018FF48  88 FF 18 00 29 1A 42  ....).B0018FF4F  00 01 00 00 00 98 17  .......执行00401578   mov         dword ptr [ebp-4],1 之后0018FF33  CC CC CC CC CC CC CC  烫烫烫.0018FF3A  CC CC CC CC CC CC CC  烫烫烫.0018FF41  CC CC CC 01 00 00 00  烫.....  此处1即为a0018FF48  88 FF 18 00 29 1A 42  ....).B0040157F   lea         eax,[ebp-4]00401582   mov         dword ptr [ebp-8],eax EAX = 0018FF44 EBX = 7EFDE000 ECX = 00000000 EDX = 003C1810 ESI = 00000000 EDI = 0018FF48 EIP = 00401585 ESP = 0018FEF4 EBP = 0018FF48 EFL = 000002060018FF33  CC CC CC CC CC CC CC  烫烫烫.0018FF3A  CC CC CC CC CC CC 44  烫烫烫D0018FF41  FF 18 00 01 00 00 00  .......0018FF48  88 FF 18 00 29 1A 42  ....).B00401585   mov         ecx,dword ptr [ebp-8]00401588   mov         dword ptr [ecx],2 EAX = 0018FF44 EBX = 7EFDE000 ECX = 0018FF44 EDX = 003C1810 ESI = 00000000 EDI = 0018FF48 EIP = 0040158E ESP = 0018FEF4 EBP = 0018FF48 EFL = 000002060018FF33  CC CC CC CC CC CC CC  烫烫烫.0018FF3A  CC CC CC CC CC CC 44  烫烫烫D0018FF41  FF 18 00 02 00 00 00  .......  <strong>此处的地址a处被改为2</strong>0018FF48  88 FF 18 00 29 1A 42  ....).B0040158E   push        offset @ILT+195(std::endl) (004010c8)00401593   mov         edx,dword ptr [ebp-8]00401596   mov         eax,dword ptr [edx]00401598   push        eax EAX = 00000002 EBX = 7EFDE000 ECX = 0018FF44 EDX = 0018FF44 ESI = 00000000 EDI = 0018FF48 EIP = 00401598 ESP = 0018FEF0 EBP = 0018FF48 EFL = 00000206

稍作修改后

#include<iostream>#include<cstdio>using namespace std;int main(){const int a = 1;int* b = (int*)&a;*b = 2;cout << a << endl << *b << endl;b = new int(8);cout << a << endl << *b << endl;return 0;}

反汇编分析

1:    #include<iostream>2:    #include<cstdio>3:    using namespace std;4:    int main(){00401560   push        ebp00401561   mov         ebp,esp00401563   sub         esp,50h00401566   push        ebx00401567   push        esi00401568   push        edi00401569   lea         edi,[ebp-50h]0040156C   mov         ecx,14h00401571   mov         eax,0CCCCCCCCh00401576   rep stos    dword ptr [edi]5:        const int a = 1;00401578   mov         dword ptr [ebp-4],16:        int* b = (int*)&a;0040157F   lea         eax,[ebp-4]00401582   mov         dword ptr [ebp-8],eax7:        *b = 2;00401585   mov         ecx,dword ptr [ebp-8]00401588   mov         dword ptr [ecx],28:        cout << a << endl << *b << endl;0040158E   push        offset @ILT+195(std::endl) (004010c8)00401593   mov         edx,dword ptr [ebp-8]00401596   mov         eax,dword ptr [edx]00401598   push        eax00401599   push        offset @ILT+195(std::endl) (004010c8)0040159E   push        1004015A0   mov         ecx,offset std::cout (0047be90)004015A5   call        @ILT+250(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004010ff)004015AA   mov         ecx,eax004015AC   call        @ILT+475(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004011e0)004015B1   mov         ecx,eax004015B3   call        @ILT+250(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004010ff)004015B8   mov         ecx,eax004015BA   call        @ILT+475(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004011e0)9:        b = new int(8);004015BF   push        4004015C1   call        operator new (004205d0)004015C6   add         esp,4004015C9   mov         dword ptr [ebp-0Ch],eax004015CC   cmp         dword ptr [ebp-0Ch],0004015D0   je          main+83h (004015e3)004015D2   mov         ecx,dword ptr [ebp-0Ch]004015D5   mov         dword ptr [ecx],8004015DB   mov         edx,dword ptr [ebp-0Ch]004015DE   mov         dword ptr [ebp-10h],edx004015E1   jmp         main+8Ah (004015ea)004015E3   mov         dword ptr [ebp-10h],0004015EA   mov         eax,dword ptr [ebp-10h]004015ED   mov         dword ptr [ebp-8],eax10:       cout << a << endl << *b << endl;004015F0   push        offset @ILT+195(std::endl) (004010c8)004015F5   mov         ecx,dword ptr [ebp-8]004015F8   mov         edx,dword ptr [ecx]004015FA   push        edx004015FB   push        offset @ILT+195(std::endl) (004010c8)00401600   push        100401602   mov         ecx,offset std::cout (0047be90)00401607   call        @ILT+250(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004010ff)0040160C   mov         ecx,eax0040160E   call        @ILT+475(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004011e0)00401613   mov         ecx,eax00401615   call        @ILT+250(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004010ff)0040161A   mov         ecx,eax0040161C   call        @ILT+475(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004011e0)11:       return 0;00401621   xor         eax,eax12:   }00401623   pop         edi00401624   pop         esi00401625   pop         ebx00401626   add         esp,50h00401629   cmp         ebp,esp0040162B   call        __chkesp (004205f0)00401630   mov         esp,ebp00401632   pop         ebp00401633   ret输出:1218执行此句后 9:        b = new int(8);内存变化0018FF33  CC CC CC CC CC C8 07  烫烫倘.0018FF3A  54 00 C8 07 54 00 C8  T...T..0018FF41  07 54 00 02 00 00 00  .T.....  a地址处还是2  <strong>说明编译器把const变量直接用常数代替,其内存还是可以改的</strong>0018FF48  88 FF 18 00 A9 1A 42  ......B0018FF4F  00 01 00 00 00 98 17  .......0018FF56  54 00 10 18 54 00 00  T...T..

0 0