Last active
August 29, 2015 14:00
-
-
Save mawenbao/becea4b6acdc9d3dfb14 to your computer and use it in GitHub Desktop.
part of the command `objdump -dS a.out -j .text` output with some comments, a.out is compiled from call_stack_example.cpp
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
int foo2(int a, long b, int c, int d, int e, int f, int g, int i) { | |
push %rbp // 将caller的%rbp入栈 | |
mov %rsp,%rbp // 初始化callee的%rbp | |
mov %edi,-0x4(%rbp) // a: mem[R[rbp]-0x4] = R[edi] | |
// 暂存寄存器的值,使其可以被重用,使用-O选项可以优化掉这部分代码 | |
mov %rsi,-0x10(%rbp) // b | |
mov %edx,-0x8(%rbp) // c | |
mov %ecx,-0x14(%rbp) // d | |
mov %r8d,-0x18(%rbp) // e | |
mov %r9d,-0x1c(%rbp) // f | |
return g + i; | |
mov 0x18(%rbp),%eax // g在caller的stack frame的底部 | |
mov 0x10(%rbp),%edx // i在caller的stack frame的底部 | |
add %edx,%eax // R[eax] += R[edx] | |
} | |
pop %rbp // 将caller的rbp出栈(恢复%rbp) | |
retq // 将返回地址出栈,跳转到该地址处 | |
int foo(int &a, long b) { | |
push %rbp // 将caller的%rbp入栈 | |
mov %rsp,%rbp // 初始化callee的%rbp | |
sub $0x30,%rsp // 为当前stack frame分配0x30字节的空间 | |
mov %rdi,-0x18(%rbp) // mem[R[rbp]-0x18] = R[rdi] | |
mov %rsi,-0x20(%rbp) // mem[R[rbp]-0x20] = R[rsi] | |
int m = 1; | |
movl $0x1,-0x4(%rbp) // mem[R[rbp]-0x4] = 0x1 | |
int o[3] = {0x1, 0x2, 0x3}; | |
movl $0x1,-0x10(%rbp) // mem[R[rbp]-0x10] = 0x1 | |
movl $0x2,-0xc(%rbp) // mem[R[rbp]-0xc] = 0x1 | |
movl $0x3,-0x8(%rbp) // mem[R[rbp]-0x10] = 0x1 | |
return foo2(0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x9); | |
movl $0x9,0x8(%rsp) // mem[R[rsp]+0x8] = 0x9; 参数太多,无法用寄存器传递参数0x9 | |
movl $0x7,(%rsp) // mem[$[rsp]] = 0x7; 参数太多,无法用寄存器传递参数0x7 | |
mov $0x6,%r9d // R[r9d] = 0x6 使用寄存器传递函数参数,下同 | |
mov $0x5,%r8d // R[r8d] = 0x5 | |
mov $0x4,%ecx // R[ecx] = 0x4 | |
mov $0x3,%edx // R[edx] = 0x3 | |
mov $0x2,%esi // R[esi] = 0x2 | |
mov $0x1,%edi // R[edi] = 0x1 | |
callq 4004ed <_Z4foo2iliiiiii> // 调用foo2 | |
} | |
leaveq // 将caller的rbp出栈(恢复%rbp),将已保存的局部变量和临时变量出栈 | |
retq // 将返回地址出栈,跳转到该地址处 | |
int main() { | |
push %rbp // 将caller的%rbp入栈 | |
mov %rsp,%rbp // 初始化callee的%rbp | |
sub $0x10,%rsp // 为当前stack frame分配0x10字节的空间 | |
int z = 0xa; | |
movl $0xa,-0x8(%rbp) // mem[R[%rbp]-0x8] = 0xa | |
int r = foo(z, 0xb); | |
lea -0x8(%rbp),%rax // R[rax] = &z | |
mov $0xb,%esi // R[esi] = 0xb | |
mov %rax,%rdi // R[rdi] = R[rax] | |
callq 400513 <_Z3fooRil> // 调用foo | |
mov %eax,-0x4(%rbp) // mem[R[rbp]-0x4] = R[eax] (%eax保存foo的返回值) | |
return r; | |
mov -0x4(%rbp),%eax // R[eax] = mem[R[rbp]-0x4] | |
} | |
leaveq // 将caller的rbp出栈(恢复%rbp),将已保存的局部变量和临时变量出栈 | |
retq // 将返回地址出栈,跳转到该地址处 | |
nopl (%rax) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment