After some research, I find 3 articles about these topic to clearly clarify how function is calling. http://unixwiz.net/techtips/win32-callconv-asm.html http://www.installsetupconfig.com/win32programming/processtoolhelpapis12_1.html http://joshcarter.com/books/pragprowrimo_2009/functions_and_parameters ne of the "big picture" issues in looking at compiled C code is the function-calling conventions. These are the methods that a calling function and a called function agree on how parameters and return values should be passed between them, and how the stack is used by the function itself. The layout of the stack constitutes the "stack frame", and knowing how this works can go a long way to decoding how something works. In C and modern CPU design conventions, the stack frame is a chunk of memory, allocated from the stack, at run-time, each time a function is called, to store its automatic variables. Hence nested or recursive calls to the same function, each successively obtain their own separate frames. Physically, a function's stack frame is the area between the addresses contained in esp, the stack pointer, and ebp, the frame pointer (base pointer in Intel terminology). Thus, if a function pushes more values onto the stack, it is effectively growing its frame. This is a very low-level view: the picture as seen from the C/C++ programmer is illustrated elsewhere: • Unixwiz.net Tech Tip: Intel x86 Function-call Conventions - C Programmer's View For the sake of discussion, we're using the terms that the Microsoft Visual C compiler uses to describe these conventions, even though other platforms may use other terms. It's important to note that these are merely conventions, and any collection of cooperating code can agree on nearly anything. There are other conventions (passing parameters in registers, for instance) that behave differently, and of course the optimizer can make mincemeat of any clear picture as well. Our focus here is to provide an overview, and not an authoritative definition for these conventions. In both __cdecl and __stdcall conventions, the same set of three registers is involved in the function-call frame: Virtually everybody in the Intel assembler world uses the Intel notation, but the GNU C compiler uses what they call the "AT&T syntax" for backwards compatibility. This seems to us to be a really dumb idea, but it's a fact of life. There are minor notational differences between the two notations, but by far the most annoying is that the AT&T syntax reverses the source and destination operands. To move the immediate value 4 into the EAX register: More recent GNU compilers have a way to generate the Intel syntax, but it's not clear if the GNU assembler takes it. In any case, we'll use the Intel notation exclusively. There are other minor differences that are not of much concern to the reverse engineer. The best way to understand the stack organization is to see each step in calling a function with the __cdecl conventions. These steps are taken automatically by the compiler, and though not all of them are used in every case (sometimes no parameters, sometimes no local variables, sometimes no saved registers), but this shows the overall mechanism employed. The __stdcall convention is mainly used by the Windows API, and it's a bit more compact than __cdecl. The main difference is that any given function has a hard-coded set of parameters, and this cannot vary from call to call like it can in C (no "variadic functions"). Because the size of the parameter block is fixed, the burden of cleaning these parameters off the stack can be shifted to the called function, instead of being done by the calling function as in __cdecl. There are several effects of this: As an offshoot of #2, Microsoft Visual C takes special care of functions that are B{__stdcall}. Since the number of parameters is known at compile time, the compiler encodes the parameter byte count in the symbol name itself, and this means that calling the function wrong leads to a link error. For instance, the function int foo(int a, int b) would generate — at the assembler level — the symbol "_foo@8", where "8" is the number of bytes expected. This means that not only will a call with 1 or 3 parameters not resolve (due to the size mismatch), but neither will a call expecting the __cdecl parameters (which looks for _foo). It's a clever mechanism that avoids a lot of problems. The x86 architecture provides a number of built-in mechanisms for assisting with frame management, but they don't seem to be commonly used by C compilers. Of particular interest is theENTER instruction, which handles most of the function-prolog code. We're pretty sure these are functionally equivalent, but our 80386 processor reference suggests that the ENTER version is more compact (6 bytes -vs- 9) but slower (15 clocks -vs- 6). The newer processors are probably harder to pin down, but somebody has probably figured out that ENTER is slower. Sigh.Register use in the stack frame
*--ESP = value; // push
value = *ESP++; // pop
Assembler notation
mov $4, %eax // AT&T notation
mov eax, 4 // Intel notation
Calling a __cdecl function
push ebp
mov ebp, esp // ebp « esp
16(%ebp)
- third function parameter
12(%ebp)
- second function parameter
8(%ebp)
- first function parameter
4(%ebp)
- old %EIP (the function's "return address")
0(%ebp)
- old %EBP (previous function's base pointer)
-4(%ebp)
- first local variable
-8(%ebp)
- second local variable
-12(%ebp)
- third local variable
__cdecl -vs- __stdcall
Variations and Notes
ENTER 10,0 PUSH ebp
MOV ebp, esp
SUB esp, 10
发表评论
-
ffmpeg compile
2010-11-11 16:09 1027http://www.defendingthetruth.co ... -
Open port 80
2010-11-07 11:12 869vi /etc/sysconfig/iptables ... -
Install fast cgi & nginx in fedora
2010-11-07 10:52 1029http://www.cyberciti.biz/faq/rh ... -
Presentation Notes of workshop
2009-11-07 16:18 0they felt that the industry in ... -
化蛋abc
2009-06-12 17:12 0这是两张来自于澳洲的最新ATB 化蛋图片,我们仍然没有他的具体 ... -
Exchange consultant
2007-06-29 15:01 1041Today Exchange consultant: Ques ... -
To do list
2007-03-14 12:36 8361. Let everyone know what's SQA ... -
What will you consider, if you're the director...
2007-03-09 21:27 1069What will you consider, if you' ... -
Tips from the R&D Top Manager
2007-02-27 14:22 777Although there are most concept ... -
Prepare the process definition
2007-02-14 15:07 785Lesson1: Minor preparation you ...
相关推荐
push ebp mov ebp,esp
本文档主要介绍高级语言反汇编之后的汇编代码中寄存器EBP的作用。
汇编语言是一门本来是很基础很古老的语言, 由于它的代码可读性可移植性较差, 现在已经很少有人用。 但它的优点也是显而易见的, 很高的效率,不受编译器限制的随意性,对硬件的直接操作(保护模式下需要系统支持)...
[pwn]ROP:通过ESP和EBP间接控制EIP-附件资源
通过EBP EIP来找函数调用堆栈 通过EBP EIP来找函数调用堆栈 通过EBP EIP来找函数调用堆栈 通过EBP EIP来找函数调用堆栈
SRM COOKBOOK 文档 SAP SRM Advanced EBP Cookbook(1).pdf
逆向错误分析的源程序,用VC2005实现!
新手学习基础 要知道数据类型是什么!!!排除ebp esp尽量找eax edi
[ring3反作弊篇] 基于EBP遍历调用栈及模块名 注意:这是一份C++ Ring3 入门级的反作弊示例代码,基于函数调用栈的检测
初学SRM很不错的一本书,详细的配置步骤。
This is a version of mistletoe maintained by the Excutable Book Project (EBP). It tracks the myst branch of ExecutableBookProject/mistletoe which eventually it is hoped will be merged into mistletoe ...
SAP SRM overview 官方文档
长期有氧运动对大鼠心肌p70S6K和4EBP1表达的影响,廖静雯,曾凡星,目的:观察p70S6K和4EBP1信号分子在长期有氧运动所致心肌肥大中的变化特点,以期为运动对心肌肥大的影响及相关蛋白合成的机制提供更�
该工具通过解析每个传输流中 PMT 和 EBP 结构 ( EBP_info() ) 中的 EBP 描述符 ( EBP_descriptor ),然后比较不同流中的 EBP PTS 值以验证它们是否相同来实现此目的。 执行了无数其他验证,包括: 验证 EBP 结构中...
绝对好用 现已绝版 要是喜欢就来下载吧 分数也不高 但是绝对是超值的
常用汇编指令汇总 如: MOV 传送字或字节。 MOVSX 先符号扩展,再传送。...PUSHAD 把EAX,ECX,EDX,EBX,ESP,EBP,ESI,EDI依次压入堆栈。 POPAD 把EDI,ESI,EBP,ESP,EBX,EDX,ECX,EAX依次弹出堆栈。
mov ebp,esp -------可做为花指令的开头句 jmp 入口地址 ------跳到程序入口地址 与它效果一样的还有(以下三个): push 入口地址 retn jb 入口地址 jnb 入口地址 mov eax,入口地址 jmp eax *****************...
ExpectationBackpropagation-EBP_Matlab_Code-archive-refs-heads-master.zip
MLP和EBP算法matlab源代码.zip