[英]Addressing of instruction pointer in Mac OS X x86-64
I wanted to understand a litte more about assembly and wrote a little example: 我想了解更多有关装配的信息,并写了一个小例子:
#include <stdio.h>
#include <math.h>
void f() {
unsigned char i[4];
i[0] = 5;
i[1] = 6;
i[2] = 7;
i[3] = 8;
int j = 0;
for(j=0; j < 20; j++)
printf("%02X\n", i[j]);
}
int main() {
int i[5];
i[0] = 3;
i[1] = 3;
i[2] = 3;
i[3] = 3;
i[4] = 3;
f();
return 0;
}
My goal was to see the actual return address for the instruction pointer, laid down by the call to callq in main(), when it started f(). 我的目标是查看指令指针的实际返回地址,当它启动f()时,由main()中callq的调用确定。
I used gdb to disassemble main() and got the following 我使用gdb来反汇编main()并获得以下内容
Dump of assembler code for function main:
0x0000000100000eb0 <main+0>: push %rbp
0x0000000100000eb1 <main+1>: mov %rsp,%rbp
0x0000000100000eb4 <main+4>: sub $0x20,%rsp
0x0000000100000eb8 <main+8>: movl $0x3,-0x1c(%rbp)
0x0000000100000ebf <main+15>: movl $0x3,-0x18(%rbp)
0x0000000100000ec6 <main+22>: movl $0x3,-0x14(%rbp)
0x0000000100000ecd <main+29>: movl $0x3,-0x10(%rbp)
0x0000000100000ed4 <main+36>: movl $0x3,-0xc(%rbp)
0x0000000100000edb <main+43>: callq 0x100000e40 <f>
0x0000000100000ee0 <main+48>: movl $0x0,-0x8(%rbp)
0x0000000100000ee7 <main+55>: mov -0x8(%rbp),%eax
0x0000000100000eea <main+58>: mov %eax,-0x4(%rbp)
0x0000000100000eed <main+61>: mov -0x4(%rbp),%eax
0x0000000100000ef0 <main+64>: add $0x20,%rsp
0x0000000100000ef4 <main+68>: pop %rbp
0x0000000100000ef5 <main+69>: retq
so i was expecting to find the laid down instruction pointer return address to be 0x0000000100000ee0, as this is the next instruction after callq. 所以我期待找到放下的指令返回地址为0x0000000100000ee0,因为这是callq之后的下一条指令。 When I run my program I get ( I grouped these in groups of 4 so you can read them better):
当我运行我的程序时,我得到了(我将它们分组为4组,以便您可以更好地阅读它们):
05
06
07
08
40
1B
08
56
FF
7F
00
00
E0
EE
B7
09
01
00
00
00
00
00
00
00
03
00
00
00
03
00
00
00
03
00
00
00
03
00
00
00
Ok, so I can see my 5,6,7,8 that I wrote into my local variable in f() and I can see the local variables of main() those 4-byte integers, which have been set to 3. After 5,6,7,8 (this is a 64 bit system) I would have expected the next 8 bytes to encode the previous value of the %rbp register, and THEN the next 8 bytes to contain the return address for the instruction pointer. 好的,所以我可以看到我在f()中写入我的局部变量的5,6,7,8并且我可以看到main()的局部变量那些4字节整数,它们已被设置为3。 5,6,7,8(这是一个64位系统)我希望接下来的8个字节能够编码%rbp寄存器的前一个值,然后接下来的8个字节来包含指令指针的返回地址。 So the return address should be
所以返回地址应该是
E0
EE
B7
09
01
00
00
00
Now when I compare this to the 0x0000000100000ee0 that I am expecting from gdb, I can see the 00000001 in the last 4 bytes and I can see the e0 from 00000ee0 in the very first byte. 现在当我将它与我期望从gdb中得到的0x0000000100000ee0进行比较时,我可以看到最后4个字节中的00000001,并且我可以在第一个字节中看到00000ee0中的e0。 But why am I not getting exactly what I am expecting?
但为什么我没有得到我所期待的呢? I thought about byte-ordering (Mac OS X is little endian I believe), but that would not explain what I see here, from what I understood.
我想过字节排序(我相信Mac OS X是小端),但这不能解释我在这里看到的内容,从我的理解。
Any input is welcome, 欢迎任何意见,
Thank you guys, 感谢大伙们,
Christoph 克里斯托夫
Try this program and run it multiple times. 试试这个程序并多次运行它。
#include <stdio.h>
int
main(int argc, char **argv)
{
int foo;
printf("%p %p\n", main, &foo);
return 0;
}
I'm pretty sure that you'll get different addresses every time. 我很确定你每次都会得到不同的地址。 MacOS has position independent binaries and the stack changes positions all the time too.
MacOS具有位置无关的二进制文件,堆栈也一直在改变位置。 This is a security feature.
这是一项安全功能。
If you run your program in gdb, you'll probably get what you expect since gdb disables the randomization to make debugging easier. 如果你在gdb中运行你的程序,你可能会得到你所期望的,因为gdb禁用随机化以使调试更容易。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.