1.第一个at&a 64汇编
1 .section .data 2 strFormat: 3 .asciz "%s " 4 strUseLibc: 5 .asciz "Hi, If you see me, you called c lib :)" 6 strUseSyscall: 7 .asciz "And if you see me, you called syscall. " 8 endOfStrUseSyscall: 9 10 .section .text 11 .globl _start 12 _start: 13 # 函数调用的传参已经不再单纯使用压栈的方式 14 movq $strFormat, %rdi 15 movq $strUseLibc, %rsi 16 call printf 17 18 # 系统调用的寄存器已经改变，int 0x80 也被syscall 替代 19 movq $1, %rdi 20 movq $strUseSyscall, %rsi 21 movq $(endOfStrUseSyscall-strUseSyscall), %rdx 22 movq $1, %rax 23 syscall 24 25 #另外系统调用的编号也不同了 26 movq $127, %rdi # 故意返回一个非0 值 27 movq $60, %rax 28 syscall
2 从c 转成汇编，再编译成bin
GCC 编译的背后
http://tinylab.org/behind-the-gcc-compiler/
1 #include <stdio.h> 2 #include <unistd.h> 3 4 int sum(int a) { 5 return a; 6 } 7 int main() { 8 int b = 0; 9 b = sum(1); 10 printf("hello:%d ", b); 11 _exit(0); 12 }
1 gcc -S test.c -fno-asynchronous-unwind-tables -fno-exceptions -fno-stack-protector 2 sed -i -e "s#main#_start#g" test.s 3 gcc -c test.s 4 #ld -o test test.o /usr/lib/x86_64-linux-gnu/crt1.o /usr/lib/x86_64-linux-gnu/crti.o /usr/lib/x86_64-linux-gnu/crtn.o -lc --dynamic-linker /lib64/ld-linux-x86-64.so.2 5 ld -o test test.o -lc --dynamic-linker /lib64/ld-linux-x86-64.so.2
gcc -S test.c
1 .file "test.c" 2 .text 3 .globl sum 4 .type sum, @function 5 sum: 6 .LFB0: 7 .cfi_startproc 8 pushq %rbp 9 .cfi_def_cfa_offset 16 10 .cfi_offset 6, -16 11 movq %rsp, %rbp 12 .cfi_def_cfa_register 6 13 movl %edi, -4(%rbp) 14 movl -4(%rbp), %eax 15 popq %rbp 16 .cfi_def_cfa 7, 8 17 ret 18 .cfi_endproc 19 .LFE0: 20 .size sum, .-sum 21 .section .rodata 22 .LC0: 23 .string "hello:%d " 24 .text 25 .globl main 26 .type main, @function 27 main: 28 .LFB1: 29 .cfi_startproc 30 pushq %rbp 31 .cfi_def_cfa_offset 16 32 .cfi_offset 6, -16 33 movq %rsp, %rbp 34 .cfi_def_cfa_register 6 35 subq $16, %rsp 36 movl $0, -4(%rbp) 37 movl $1, %edi 38 call sum 39 movl %eax, -4(%rbp) 40 movl -4(%rbp), %eax 41 movl %eax, %esi 42 movl $.LC0, %edi 43 movl $0, %eax 44 call printf 45 movl $0, %edi 46 call _exit 47 .cfi_endproc 48 .LFE1: 49 .size main, .-main 50 .ident "GCC: (Ubuntu 5.4.0-6ubuntu1~16.04.1) 5.4.0 20160609" 51 .section .note.GNU-stack,"",@progbits
.cfi_startproc
.cfi_def_cfa_offset
.cfi_def_cfa_register
.cfi_def_cfa
.cfi_def_cfa
这些指令叫 cfi 指令，https://cloud.tencent.com/developer/ask/102663 具体用法先不用管。
c 可用 -fno-asynchronous-unwind-tables gcc选项去除，这样方便我们看代码
cpp 必须 -fno-asynchronous-unwind-tables -fno-exceptions 一起用才能去除
movq %fs:40, %rax
xorq %fs:40, %rdx
可用 -fno-stack-protector 去除
1 .file "test.c" 2 .text 3 .globl sum 4 .type sum, @function 5 sum: 6 pushq %rbp 7 movq %rsp, %rbp 8 movl %edi, -4(%rbp) 9 movl -4(%rbp), %eax 10 popq %rbp 11 ret 12 .size sum, .-sum 13 .section .rodata 14 .LC0: 15 .string "hello:%d " 16 .text 17 .globl main 18 .type main, @function 19 main: 20 pushq %rbp 21 movq %rsp, %rbp 22 subq $16, %rsp 23 movl $0, -4(%rbp) 24 movl $1, %edi 25 call sum 26 movl %eax, -4(%rbp) 27 movl -4(%rbp), %eax 28 movl %eax, %esi 29 movl $.LC0, %edi 30 movl $0, %eax 31 call printf 32 movl $0, %edi 33 call _exit 34 .size main, .-main 35 .ident "GCC: (Ubuntu 5.4.0-6ubuntu1~16.04.1) 5.4.0 20160609" 36 .section .note.GNU-stack,"",@progbits
堆栈平衡
https://www.cnblogs.com/mysqlinternal/p/12737841.html
.rodata ro代表read only，即只读数据(const)。
字符串长度
msg: .string "Hello,world! "#要输出的字符串
len=. -msg #字串长度
用户自定义section
static int __attribute__((section(".xinit"))) hello() { printf("abc"); } 18 .section .xinit,"ax",@progbits 19 .type hello, @function 20 hello: 21 pushq %rbp 22 movq %rsp, %rbp 23 movl $.LC0, %edi 24 movl $0, %eax 25 call printf 26 nop 27 popq %rbp 28 ret 29 .size hello, .-hello
.section .xinit,"ax",@progbits
.section name [, "flags"[, @type[,flag_specific_arguments]]]
https://sourceware.org/binutils/docs/as/Section.html
http://web.mit.edu/rhel-doc/3/rhel-as-en-3/section.html
call printf 前有movl $0, %eax
https://stackoverflow.com/questions/6212665/why-is-eax-zeroed-before-a-call-to-printf