试图了解主拆卸第一指示 [英] trying to understand the main disassembly first instructions

问题描述

您好我有一些拆解程序（Linux）的我写的更好的理解它是如何工作的，我注意到主函数总是开头：

hi I have disassembled some programs (linux) I wrote to understand better how it works, and I noticed that the main function always begins with:

lea    ecx,[esp+0x4] ; I assume this is for getting the adress of the first argument of the main...why ?
and    esp,0xfffffff0 ; ??? is the compiler trying to align the stack pointer on 16 bytes ???
push   DWORD PTR [ecx-0x4] ; I understand the assembler is pushing the return adress....why ?
push   ebp                
mov    ebp,esp
push   ecx  ;why is ecx pushed too ??

所以我的问题是：为什么这一切的工作就完成了？
我只知道使用的：

so my question is: why all this work is done ?? I only understand the use of:

push   ebp                
mov    ebp,esp

剩下的，似乎对我没用......

the rest seems useless to me...

推荐答案

我有一个它去：

;# As you have already noticed, the compiler wants to align the stack
;# pointer on a 16 byte boundary before it pushes anything. That's
;# because certain instructions' memory access needs to be aligned
;# that way.
;# So in order to first save the original offset of esp (+4), it
;# executes the first instruction:
lea    ecx,[esp+0x4]
;# Now alignment can happen. Without the previous insn the next one
;# would have made the original esp unrecoverable:
and    esp,0xfffffff0
;# Next it pushes the return addresss and creates a stack frame. I
;# assume it now wants to make the stack look like a normal
;# subroutine call:
push   DWORD PTR [ecx-0x4]
push   ebp
mov    ebp,esp
;# Remember that ecx is still the only value that can restore the
;# original esp. Since ecx may be garbled by any subroutine calls,
;# it has to save it somewhere:
push   ecx

这篇关于试图了解主拆卸第一指示的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！