08048510 <callfoo>:
08048510: 55 pushl %ebp # old frame pointer is pushed to the stack
08048511: 89 e5 movl %esp,%ebp # frame pointer = stack pointer
08048513: 83 ec 08 subl $0x8,%esp # allocates 8 bytes for stack
08048516: 83 c4 f4 addl $0xfffffff4,%esp # this I believe allocates 4 bytes to the stack??
08048519: 68 9c 85 04 08 pushl $0x804859c # push string address
0804851e: e8 d1 ff ff ff call 80484f4 <foo> # call foo, which takes the string address as param1
08048523: 89 ec movl %ebp,%esp # (after foo) does similar to return out of function
08048525: 5d popl %ebp
08048526: c3 ret
080484f4 <foo>:
080484f4: 55 pushl %ebp # push old frame pointer
080484f5: 89 e5 movl %esp,%ebp # frame pointer = stack pointer
080484f7: 83 ec 18 subl $0x18,%esp # allocate 24 bytes
080484fa: 8b 45 08 movl 0x8(%ebp),%eax # moves the param1 (string pointer) into eax
080484fd: 83 c4 f8 addl $0xfffffff8,%esp # allocates 8 more bytes (?)
08048500: 50 pushl %eax # push x # pushes param1 to stack
08048501: 8d 45 fc leal 0xfffffffc(%ebp),%eax # adds 12 to the frame pointer, puts it in eax(?)
08048504: 50 pushl %eax # push buf (which apparently is located in eax and 0xc(%ebp)
08048505: e8 ba fe ff ff call 80483c4 <strcpy> # copies the string from param1 into buf
0804850a: 89 ec movl %ebp,%esp # puts stack pointer into ebp
0804850c: 5d popl %ebp # pops ebp (returns back to other function)
0804850d: c3 ret
(a) 在执行完这些操作后,我猜测buf[0]的值为
0x64636261
。一个char占据一个字节,在小端模式下,它也可以被读成这样:buf[0] = 0x61626364
(但我不知道我的教授是否会接受这个答案)。然而,我不明白buf[2]怎么等于0x08040069
或者0x69000408
。它有最后一个字符,然后是一个空字符,但是04
和08
代表什么?(b) 我不确定如何得到(b)或(c)。我在哪里获取
esp
的值以找出在foo
开头放入ebp
的内容呢?总体上,我对这最后两个问题感到困惑... 能帮忙吗? :(
addl $0xfffffff4,%esp # 我相信这会在堆栈中分配4个字节?
0 - 0xfffffff4 = 0x0C = 12十进制字节等效指令:subl $0xC,%esp
- fileoffset