c++ 反汇编 堆变量

  • malloc

_malloc

0037E8C0 8B FF                mov         edi,edi  
0037E8C2 55                   push        ebp  
0037E8C3 8B EC                mov         ebp,esp  
0037E8C5 6A 00                push        0  
0037E8C7 6A 00                push        0  
0037E8C9 6A 01                push        1  
0037E8CB 8B 45 08             mov         eax,dword ptr [size]  
0037E8CE 50                   push        eax  
0037E8CF E8 CE 4D FB FF       call        __malloc_dbg (03336A2h)  
0037E8D4 83 C4 10             add         esp,10h  
0037E8D7 5D                   pop         ebp  
0037E8D8 C3                   ret  

__malloc_dbg

0038C420 8B FF                mov         edi,edi  
0038C422 55                   push        ebp  
0038C423 8B EC                mov         ebp,esp  
0038C425 8B 45 14             mov         eax,dword ptr [line_number]  
0038C428 50                   push        eax  
0038C429 8B 4D 10             mov         ecx,dword ptr [file_name]  
0038C42C 51                   push        ecx  
0038C42D 8B 55 0C             mov         edx,dword ptr [block_use]  
0038C430 52                   push        edx  
0038C431 8B 45 08             mov         eax,dword ptr [size]  
0038C434 50                   push        eax  
0038C435 E8 36 CF FF FF       call        heap_alloc_dbg (0389370h)  
0038C43A 83 C4 10             add         esp,10h  
0038C43D 5D                   pop         ebp  
0038C43E C3                   ret  

heap_alloc_dbg

00389370 8B FF                mov         edi,edi  
00389372 55                   push        ebp  
00389373 8B EC                mov         ebp,esp  
00389375 83 EC 0C             sub         esp,0Ch  
00389378 E8 73 7D FA FF       call        __query_new_mode (03310F0h)  
0038937D 85 C0                test        eax,eax  
0038937F 74 06                je          heap_alloc_dbg+17h (0389387h)  
00389381 C6 45 FF 01          mov         byte ptr [ebp-1],1  
00389385 EB 04                jmp         heap_alloc_dbg+1Bh (038938Bh)  
00389387 C6 45 FF 00          mov         byte ptr [ebp-1],0  
0038938B 8A 45 FF             mov         al,byte ptr [ebp-1]  
0038938E 88 45 FE             mov         byte ptr [should_call_new_handler],al  
00389391 8B 4D 14             mov         ecx,dword ptr [line_number]  
00389394 51                   push        ecx  
00389395 8B 55 10             mov         edx,dword ptr [file_name]  
00389398 52                   push        edx  
00389399 8B 45 0C             mov         eax,dword ptr [block_use]  
0038939C 50                   push        eax  
0038939D 8B 4D 08             mov         ecx,dword ptr [size]  
003893A0 51                   push        ecx  
003893A1 E8 6A 00 00 00       call        heap_alloc_dbg_internal (0389410h)  
003893A6 83 C4 10             add         esp,10h  
003893A9 89 45 F8             mov         dword ptr [ebp-8],eax  
003893AC 83 7D F8 00          cmp         dword ptr [ebp-8],0  
003893B0 74 05                je          heap_alloc_dbg+47h (03893B7h)  
003893B2 8B 45 F8             mov         eax,dword ptr [ebp-8]  
003893B5 EB 35                jmp         heap_alloc_dbg+7Ch (03893ECh)  
003893B7 0F B6 55 FE          movzx       edx,byte ptr [should_call_new_handler]  
003893BB 85 D2                test        edx,edx  
003893BD 74 10                je          heap_alloc_dbg+5Fh (03893CFh)  
003893BF 8B 45 08             mov         eax,dword ptr [size]  
003893C2 50                   push        eax  
003893C3 E8 96 82 FA FF       call        __callnewh (033165Eh)  
003893C8 83 C4 04             add         esp,4  
003893CB 85 C0                test        eax,eax  
003893CD 75 1B                jne         heap_alloc_dbg+7Ah (03893EAh)  
003893CF E8 01 8E FA FF       call        __errno (03321D5h)  
003893D4 89 45 F4             mov         dword ptr [ebp-0Ch],eax  
003893D7 83 7D F4 00          cmp         dword ptr [ebp-0Ch],0  
003893DB 74 09                je          heap_alloc_dbg+76h (03893E6h)  
003893DD 8B 4D F4             mov         ecx,dword ptr [ebp-0Ch]  
003893E0 C7 01 0C 00 00 00    mov         dword ptr [ecx],0Ch  
003893E6 33 C0                xor         eax,eax  
003893E8 EB 02                jmp         heap_alloc_dbg+7Ch (03893ECh)  
003893EA EB A5                jmp         heap_alloc_dbg+21h (0389391h)  
003893EC 8B E5                mov         esp,ebp  
003893EE 5D                   pop         ebp  
003893EF C3                   ret  
  • free

_free

0037E890 8B FF                mov         edi,edi  
0037E892 55                   push        ebp  
0037E893 8B EC                mov         ebp,esp  
0037E895 83 EC 08             sub         esp,8  
0037E898 C7 45 FC 00 00 00 00 mov         dword ptr [extra_instructions_for_patching_libraries],0  
0037E89F 8B 45 FC             mov         eax,dword ptr [extra_instructions_for_patching_libraries]  
0037E8A2 89 45 F8             mov         dword ptr [ebp-8],eax  
0037E8A5 6A 01                push        1  
0037E8A7 8B 4D 08             mov         ecx,dword ptr [block]  
0037E8AA 51                   push        ecx  
0037E8AB E8 52 52 FB FF       call        __free_dbg (0333B02h)  
0037E8B0 83 C4 08             add         esp,8  
0037E8B3 8B E5                mov         esp,ebp  
0037E8B5 5D                   pop         ebp  
0037E8B6 C3                   ret 

__free_dbg

0038C2E0 8B FF                mov         edi,edi  
0038C2E2 55                   push        ebp  
0038C2E3 8B EC                mov         ebp,esp  
0038C2E5 6A FE                push        0FFFFFFFEh  
0038C2E7 68 78 71 3F 00       push        3F7178h  
0038C2EC 68 C0 BC 33 00       push        offset _except_handler4 (033BCC0h)  
0038C2F1 64 A1 00 00 00 00    mov         eax,dword ptr fs:[00000000h]  
0038C2F7 50                   push        eax  
0038C2F8 83 C4 F0             add         esp,0FFFFFFF0h  
0038C2FB 53                   push        ebx  
0038C2FC 56                   push        esi  
0038C2FD 57                   push        edi  
0038C2FE A1 0C 80 3F 00       mov         eax,dword ptr [__security_cookie (03F800Ch)]  
0038C303 31 45 F8             xor         dword ptr [ebp-8],eax  
0038C306 33 C5                xor         eax,ebp  
0038C308 50                   push        eax  
0038C309 8D 45 F0             lea         eax,[ebp-10h]  
0038C30C 64 A3 00 00 00 00    mov         dword ptr fs:[00000000h],eax  
0038C312 6A 00                push        0  
0038C314 E8 F0 52 FA FF       call        ___acrt_lock (0331609h)  
0038C319 83 C4 04             add         esp,4  
0038C31C C7 45 FC 00 00 00 00 mov         dword ptr [ebp-4],0  
0038C323 83 7D 0C FF          cmp         dword ptr [block_use],0FFFFFFFFh  
0038C327 75 1A                jne         _free_dbg+63h (038C343h)  
0038C329 83 7D 08 00          cmp         dword ptr [block],0  
0038C32D 74 14                je          _free_dbg+63h (038C343h)  
0038C32F 8B 45 08             mov         eax,dword ptr [block]  
0038C332 50                   push        eax  
0038C333 E8 28 D0 FF FF       call        header_from_block (0389360h)  
0038C338 83 C4 04             add         esp,4  
0038C33B 8B 48 10             mov         ecx,dword ptr [eax+10h]  
0038C33E 89 4D E4             mov         dword ptr [ebp-1Ch],ecx  
0038C341 EB 06                jmp         _free_dbg+69h (038C349h)  
0038C343 8B 55 0C             mov         edx,dword ptr [block_use]  
0038C346 89 55 E4             mov         dword ptr [ebp-1Ch],edx  
0038C349 8B 45 E4             mov         eax,dword ptr [ebp-1Ch]  
0038C34C 89 45 E0             mov         dword ptr [ebp-20h],eax  
0038C34F 8B 4D E0             mov         ecx,dword ptr [ebp-20h]  
0038C352 51                   push        ecx  
0038C353 8B 55 08             mov         edx,dword ptr [block]  
0038C356 52                   push        edx  
0038C357 E8 34 CA FF FF       call        free_dbg_nolock (0388D90h)  
0038C35C 83 C4 08             add         esp,8  
0038C35F C7 45 FC FE FF FF FF mov         dword ptr [ebp-4],0FFFFFFFEh  
0038C366 E8 02 00 00 00       call        _free_dbg+8Dh (038C36Dh)  
0038C36B EB 0B                jmp         $LN10 (038C378h)  
0038C36D 6A 00                push        0  
0038C36F E8 79 69 FA FF       call        ___acrt_unlock (0332CEDh)  
0038C374 83 C4 04             add         esp,4 

  • new[]
  1: //
     2: // new_array.cpp
     3: //
     4: //      Copyright (c) Microsoft Corporation. All rights reserved.
     5: //
     6: // Defines the array operator new.
     7: //
     8: #include <vcruntime_internal.h>
     9: #include <vcruntime_new.h>
    10: 
    11: ////////////////////////////////////
    12: // new() Fallback Ordering
    13: //
    14: // +----------+
    15: // |new_scalar<---------------+
    16: // +----^-----+               |
    17: //      |                     |
    18: // +----+-------------+  +----+----+
    19: // |new_scalar_nothrow|  |new_array|
    20: // +------------------+  +----^----+
    21: //                            |
    22: //               +------------+----+
    23: //               |new_array_nothrow|
    24: //               +-----------------+
    25: 
    26: void* __CRTDECL operator new[](size_t const size)
    27: {
003375D0 55                   push        ebp  
003375D1 8B EC                mov         ebp,esp  
    28:     return operator new(size);
003375D3 8B 45 08             mov         eax,dword ptr [size]  
003375D6 50                   push        eax  
003375D7 E8 DB BF FF FF       call        operator new (03335B7h)  
003375DC 83 C4 04             add         esp,4  
    29: }
003375DF 5D                   pop         ebp  
003375E0 C3                   ret 
  • delete[]
     1: //
     2: // delete_array.cpp
     3: //
     4: //      Copyright (c) Microsoft Corporation. All rights reserved.
     5: //
     6: // Defines the array operator delete.
     7: //
     8: #include <vcruntime_internal.h>
     9: #include <vcruntime_new.h>
    10: 
    11: ////////////////////////////////////////////////////////////////
    12: // delete() Fallback Ordering
    13: //
    14: // +-------------+
    15: // |delete_scalar<----+-----------------------+
    16: // +--^----------+    |                       |
    17: //    |               |                       |
    18: // +--+---------+  +--+---------------+  +----+----------------+
    19: // |delete_array|  |delete_scalar_size|  |delete_scalar_nothrow|
    20: // +--^----^----+  +------------------+  +---------------------+
    21: //    |    |
    22: //    |    +-------------------+
    23: //    |                        |
    24: // +--+--------------+  +------+-------------+
    25: // |delete_array_size|  |delete_array_nothrow|
    26: // +-----------------+  +--------------------+
    27: 
    28: _CRT_SECURITYCRITICAL_ATTRIBUTE
    29: void __CRTDECL operator delete[](void* const block) noexcept
    30: {
003375F0 55                   push        ebp  
003375F1 8B EC                mov         ebp,esp  
    31:     operator delete(block);
003375F3 8B 45 08             mov         eax,dword ptr [block]  
003375F6 50                   push        eax  
003375F7 E8 0E A9 FF FF       call        operator delete (0331F0Ah)  
003375FC 83 C4 04             add         esp,4  
    32: }
003375FF 5D                   pop         ebp  
00337600 C3                   ret 
原文地址:https://www.cnblogs.com/DirWang/p/12168852.html