对于一段nasm的汇编代码
section .text global mystart ; make the main function externally visible mystart: xor bx,bx start: mov ax,1 add ax,bx jmp short next nop nop nop next: mov bx,ax ; 2 exit the program ; 2a prepare the argument for the sys call to exit push dword 0 ; exit status returned to the operating system ; 2b make the call to sys call to exit mov eax, 0x1 ; system call number for exit sub esp, 4 ; OS X (and BSD) system calls needs "extra space" on stack int 0x80 ; make the system call
生成list文件
nasm -f elf 6-2.asm -l 6-2.lst
1 section .text 2 3 global mystart ; make the main function externally visible 4 5 mystart: 6 00000000 6631DB xor bx,bx 7 00000003 66B80100 start: mov ax,1 8 00000007 6601D8 add ax,bx 9 0000000A EB03 jmp short next 10 0000000C 90 nop 11 0000000D 90 nop 12 0000000E 90 nop 13 0000000F 6689C3 next: mov bx,ax 14 15 ; 2 exit the program 16 17 ; 2a prepare the argument for the sys call to exit 18 00000012 6800000000 push dword 0 ; exit status returned to the operating system 19 20 ; 2b make the call to sys call to exit 21 00000017 B801000000 mov eax, 0x1 ; system call number for exit 22 0000001C 81EC04000000 sub esp, 4 ; OS X (and BSD) system calls needs "extra space" on stack 23 00000022 CD80 int 0x80 ; make the system call
顺带出来的.o可执行文件里的机器码：
7f45 4c46 0101 0100 0000 0000 0000 0000 0100 0300 0100 0000 0000 0000 0000 0000 4000 0000 0000 0000 3400 0000 0000 2800 0600 0300 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0100 0000 0100 0000 0600 0000 0000 0000 3001 0000 2400 0000 0000 0000 0000 0000 1000 0000 0000 0000 0700 0000 0100 0000 0000 0000 0000 0000 6001 0000 3f00 0000 0000 0000 0000 0000 0100 0000 0000 0000 1000 0000 0300 0000 0000 0000 0000 0000 a001 0000 2a00 0000 0000 0000 0000 0000 0100 0000 0000 0000 1a00 0000 0200 0000 0000 0000 0000 0000 d001 0000 7000 0000 0500 0000 0600 0000 0400 0000 1000 0000 2200 0000 0300 0000 0000 0000 0000 0000 4002 0000 1c00 0000 0000 0000 0000 0000 0100 0000 0000 0000 6631 db66 b801 0066 01d8 eb03 9090 9066 89c3 6800 0000 00b8 0100 0000 81ec 0400 0000 cd80 0000 0000 0000 0000 0000 0000 0054 6865 204e 6574 7769 6465 2041 7373 656d 626c 6572 2030 2e39 382e 3430 2028 4170 706c 6520 436f 6d70 7574 6572 2c20 496e 632e 2062 7569 6c64 2031 3129 0000 002e 7465 7874 002e 636f 6d6d 656e 7400 2e73 6873 7472 7461 6200 2e73 796d 7461 6200 2e73 7472 7461 6200 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0100 0000 0000 0000 0000 0000 0400 f1ff 0000 0000 0000 0000 0000 0000 0300 f1ff 0000 0000 0000 0000 0000 0000 0300 0100 1100 0000 0300 0000 0000 0000 0000 0100 1700 0000 0f00 0000 0000 0000 0000 0100 0900 0000 0000 0000 0000 0000 1000 0100 0036 2d31 2e61 736d 006d 7973 7461 7274 0073 7461 7274 006e 6578 7400 0000 0000
里面有一堆机器码，比原来的程序长很多
.lst文件是.asm文件翻译成机器码的结果就是一对一的翻译
反汇编
ndisasm 6-2.o
对.o文件反汇编之后发现出来的代码很奇怪，jmp的机器码直接被连接成了其他语句，不知道怎么回事，到时候想去问问老师来的，反汇编是个啥啊～
00000000 7F45 jg 0x47 00000002 4C dec esp 00000003 46 inc esi 00000004 0101 add [ecx],eax 00000006 0100 add [eax],eax 00000008 0000 add [eax],al 0000000A 0000 add [eax],al 0000000C 0000 add [eax],al 0000000E 0000 add [eax],al 00000010 0100 add [eax],eax 00000012 0300 add eax,[eax] 00000014 0100 add [eax],eax 00000016 0000 add [eax],al 00000018 0000 add [eax],al 0000001A 0000 add [eax],al 0000001C 0000 add [eax],al 0000001E 0000 add [eax],al 00000020 40 inc eax 00000021 0000 add [eax],al 00000023 0000 add [eax],al 00000025 0000 add [eax],al 00000027 003400 add [eax+eax],dh 0000002A 0000 add [eax],al 0000002C 0000 add [eax],al 0000002E 2800 sub [eax],al 00000030 06 push es 00000031 0003 add [ebx],al 00000033 0000 add [eax],al 00000035 0000 add [eax],al 00000037 0000 add [eax],al 00000039 0000 add [eax],al 0000003B 0000 add [eax],al 0000003D 0000 add [eax],al 0000003F 0000 add [eax],al 00000041 0000 add [eax],al 00000043 0000 add [eax],al 00000045 0000 add [eax],al 00000047 0000 add [eax],al 00000049 0000 add [eax],al 0000004B 0000 add [eax],al 0000004D 0000 add [eax],al 0000004F 0000 add [eax],al 00000051 0000 add [eax],al 00000053 0000 add [eax],al 00000055 0000 add [eax],al 00000057 0000 add [eax],al 00000059 0000 add [eax],al 0000005B 0000 add [eax],al 0000005D 0000 add [eax],al 0000005F 0000 add [eax],al 00000061 0000 add [eax],al 00000063 0000 add [eax],al 00000065 0000 add [eax],al 00000067 0001 add [ecx],al 00000069 0000 add [eax],al 0000006B 0001 add [ecx],al 0000006D 0000 add [eax],al 0000006F 0006 add [esi],al 00000071 0000 add [eax],al 00000073 0000 add [eax],al 00000075 0000 add [eax],al 00000077 0030 add [eax],dh 00000079 0100 add [eax],eax 0000007B 002400 add [eax+eax],ah 0000007E 0000 add [eax],al 00000080 0000 add [eax],al 00000082 0000 add [eax],al 00000084 0000 add [eax],al 00000086 0000 add [eax],al 00000088 1000 adc [eax],al 0000008A 0000 add [eax],al 0000008C 0000 add [eax],al 0000008E 0000 add [eax],al 00000090 07 pop es 00000091 0000 add [eax],al 00000093 0001 add [ecx],al 00000095 0000 add [eax],al 00000097 0000 add [eax],al 00000099 0000 add [eax],al 0000009B 0000 add [eax],al 0000009D 0000 add [eax],al 0000009F 006001 add [eax+0x1],ah 000000A2 0000 add [eax],al 000000A4 3F aas 000000A5 0000 add [eax],al 000000A7 0000 add [eax],al 000000A9 0000 add [eax],al 000000AB 0000 add [eax],al 000000AD 0000 add [eax],al 000000AF 0001 add [ecx],al 000000B1 0000 add [eax],al 000000B3 0000 add [eax],al 000000B5 0000 add [eax],al 000000B7 0010 add [eax],dl 000000B9 0000 add [eax],al 000000BB 0003 add [ebx],al 000000BD 0000 add [eax],al 000000BF 0000 add [eax],al 000000C1 0000 add [eax],al 000000C3 0000 add [eax],al 000000C5 0000 add [eax],al 000000C7 00A00100002A add [eax+0x2a000001],ah 000000CD 0000 add [eax],al 000000CF 0000 add [eax],al 000000D1 0000 add [eax],al 000000D3 0000 add [eax],al 000000D5 0000 add [eax],al 000000D7 0001 add [ecx],al 000000D9 0000 add [eax],al 000000DB 0000 add [eax],al 000000DD 0000 add [eax],al 000000DF 001A add [edx],bl 000000E1 0000 add [eax],al 000000E3 0002 add [edx],al 000000E5 0000 add [eax],al 000000E7 0000 add [eax],al 000000E9 0000 add [eax],al 000000EB 0000 add [eax],al 000000ED 0000 add [eax],al 000000EF 00D0 add al,dl 000000F1 0100 add [eax],eax 000000F3 007000 add [eax+0x0],dh 000000F6 0000 add [eax],al 000000F8 0500000006 add eax,0x6000000 000000FD 0000 add [eax],al 000000FF 000400 add [eax+eax],al 00000102 0000 add [eax],al 00000104 1000 adc [eax],al 00000106 0000 add [eax],al 00000108 2200 and al,[eax] 0000010A 0000 add [eax],al 0000010C 0300 add eax,[eax] 0000010E 0000 add [eax],al 00000110 0000 add [eax],al 00000112 0000 add [eax],al 00000114 0000 add [eax],al 00000116 0000 add [eax],al 00000118 40 inc eax 00000119 0200 add al,[eax] 0000011B 001C00 add [eax+eax],bl 0000011E 0000 add [eax],al 00000120 0000 add [eax],al 00000122 0000 add [eax],al 00000124 0000 add [eax],al 00000126 0000 add [eax],al 00000128 0100 add [eax],eax 0000012A 0000 add [eax],al 0000012C 0000 add [eax],al 0000012E 0000 add [eax],al 00000130 6631DB xor bx,bx 00000133 66B80100 mov ax,0x1 00000137 6601D8 add ax,bx 0000013A EB03 jmp short 0x13f 0000013C 90 nop 0000013D 90 nop 0000013E 90 nop 0000013F 6689C3 mov bx,ax 00000142 6800000000 push dword 0x0 00000147 B801000000 mov eax,0x1 0000014C 81EC04000000 sub esp,0x4 00000152 CD80 int 0x80 00000154 0000 add [eax],al 00000156 0000 add [eax],al 00000158 0000 add [eax],al 0000015A 0000 add [eax],al 0000015C 0000 add [eax],al 0000015E 0000 add [eax],al 00000160 00546865 add [eax+ebp*2+0x65],dl 00000164 204E65 and [esi+0x65],cl 00000167 7477 jz 0x1e0 00000169 6964652041737365 imul esp,[ebp+0x20],dword 0x65737341 00000171 6D insd 00000172 626C6572 bound ebp,[ebp+0x72] 00000176 2030 and [eax],dh 00000178 2E3938 cmp [cs:eax],edi 0000017B 2E3430 cs xor al,0x30 0000017E 2028 and [eax],ch 00000180 41 inc ecx 00000181 7070 jo 0x1f3 00000183 6C insb 00000184 6520436F and [gs:ebx+0x6f],al 00000188 6D insd 00000189 7075 jo 0x200 0000018B 7465 jz 0x1f2 0000018D 722C jc 0x1bb 0000018F 20496E and [ecx+0x6e],cl 00000192 632E arpl [esi],bp 00000194 206275 and [edx+0x75],ah 00000197 696C642031312900 imul ebp,[esp+0x20],dword 0x293131 0000019F 0000 add [eax],al 000001A1 2E7465 cs jz 0x209 000001A4 7874 js 0x21a 000001A6 002E add [esi],ch 000001A8 636F6D arpl [edi+0x6d],bp 000001AB 6D insd 000001AC 656E gs outsb 000001AE 7400 jz 0x1b0 000001B0 2E7368 cs jnc 0x21b 000001B3 7374 jnc 0x229 000001B5 7274 jc 0x22b 000001B7 61 popa 000001B8 6200 bound eax,[eax] 000001BA 2E7379 cs jnc 0x236 000001BD 6D insd 000001BE 7461 jz 0x221 000001C0 6200 bound eax,[eax] 000001C2 2E7374 cs jnc 0x239 000001C5 7274 jc 0x23b 000001C7 61 popa 000001C8 6200 bound eax,[eax] 000001CA 0000 add [eax],al 000001CC 0000 add [eax],al 000001CE 0000 add [eax],al 000001D0 0000 add [eax],al 000001D2 0000 add [eax],al 000001D4 0000 add [eax],al 000001D6 0000 add [eax],al 000001D8 0000 add [eax],al 000001DA 0000 add [eax],al 000001DC 0000 add [eax],al 000001DE 0000 add [eax],al 000001E0 0100 add [eax],eax 000001E2 0000 add [eax],al 000001E4 0000 add [eax],al 000001E6 0000 add [eax],al 000001E8 0000 add [eax],al 000001EA 0000 add [eax],al 000001EC 0400 add al,0x0 000001EE F1 int1 000001EF FF00 inc dword [eax] 000001F1 0000 add [eax],al 000001F3 0000 add [eax],al 000001F5 0000 add [eax],al 000001F7 0000 add [eax],al 000001F9 0000 add [eax],al 000001FB 0003 add [ebx],al 000001FD 00F1 add cl,dh 000001FF FF00 inc dword [eax] 00000201 0000 add [eax],al 00000203 0000 add [eax],al 00000205 0000 add [eax],al 00000207 0000 add [eax],al 00000209 0000 add [eax],al 0000020B 0003 add [ebx],al 0000020D 0001 add [ecx],al 0000020F 0011 add [ecx],dl 00000211 0000 add [eax],al 00000213 0003 add [ebx],al 00000215 0000 add [eax],al 00000217 0000 add [eax],al 00000219 0000 add [eax],al 0000021B 0000 add [eax],al 0000021D 0001 add [ecx],al 0000021F 0017 add [edi],dl 00000221 0000 add [eax],al 00000223 000F add [edi],cl 00000225 0000 add [eax],al 00000227 0000 add [eax],al 00000229 0000 add [eax],al 0000022B 0000 add [eax],al 0000022D 0001 add [ecx],al 0000022F 0009 add [ecx],cl 00000231 0000 add [eax],al 00000233 0000 add [eax],al 00000235 0000 add [eax],al 00000237 0000 add [eax],al 00000239 0000 add [eax],al 0000023B 0010 add [eax],dl 0000023D 0001 add [ecx],al 0000023F 0000 add [eax],al 00000241 362D312E6173 ss sub eax,0x73612e31 00000247 6D insd 00000248 006D79 add [ebp+0x79],ch 0000024B 7374 jnc 0x2c1 0000024D 61 popa 0000024E 7274 jc 0x2c4 00000250 007374 add [ebx+0x74],dh 00000253 61 popa 00000254 7274 jc 0x2ca 00000256 006E65 add [esi+0x65],ch 00000259 7874 js 0x2cf 0000025B 0000 add [eax],al 0000025D 0000 add [eax],al 0000025F 00 db 0x00
后来明白了，因为写的时候没有把代码段数据段堆栈分开来，所以在反汇编的时候机器没有按相应的规则去反编译出来。