《程序员自我修养》第十章读书笔记

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
cat /proc/5735/maps
00400000-00401000 r-xp 00000000 08:08 1187187
/home/andywang/project/DSO/program1
00600000-00601000 r--p 00000000 08:08 1187187
/home/andywang/project/DSO/program1
00601000-00602000 rw-p 00001000 08:08 1187187
/home/andywang/project/DSO/program1
7facdc69a000-7facdc85a000 r-xp 00000000 08:08 3412306
/lib/x86_64-linux-gnu/libc-2.21.so
7facdc85a000-7facdca5a000 ---p 001c0000 08:08 3412306
/lib/x86_64-linux-gnu/libc-2.21.so
7facdca5a000-7facdca5e000 r--p 001c0000 08:08 3412306
/lib/x86_64-linux-gnu/libc-2.21.so
7facdca5e000-7facdca60000 rw-p 001c4000 08:08 3412306
/lib/x86_64-linux-gnu/libc-2.21.so
7facdca60000-7facdca64000 rw-p 00000000 00:00 0
7facdca64000-7facdca65000 r-xp 00000000 08:08 1187174
/home/andywang/project/DSO/libtest.so
7facdca65000-7facdcc64000 ---p 00001000 08:08 1187174
/home/andywang/project/DSO/libtest.so
7facdcc64000-7facdcc65000 r--p 00000000 08:08 1187174
/home/andywang/project/DSO/libtest.so
7facdcc65000-7facdcc66000 rw-p 00001000 08:08 1187174
/home/andywang/project/DSO/libtest.so
7facdcc66000-7facdcc8a000 r-xp 00000000 08:08 3412278
/lib/x86_64-linux-gnu/ld-2.21.so
7facdce69000-7facdce6c000 rw-p 00000000 00:00 0
7facdce86000-7facdce89000 rw-p 00000000 00:00 0
7facdce89000-7facdce8a000 r--p 00023000 08:08 3412278
/lib/x86_64-linux-gnu/ld-2.21.so
7facdce8a000-7facdce8b000 rw-p 00024000 08:08 3412278
/lib/x86_64-linux-gnu/ld-2.21.so
7facdce8b000-7facdce8c000 rw-p 00000000 00:00 0
7ffdc783c000-7ffdc785d000 rw-p 00000000 00:00 0
[stack]
7ffdc794e000-7ffdc7950000 r--p 00000000 00:00 0
[vvar]
7ffdc7950000-7ffdc7952000 r-xp 00000000 00:00 0
[vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0
[vsyscall]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
#include <stdio.h>
int foo1(int i);
int foo2(int i);
int main()
{
int x = 1;
foo1(x);
return 0;
}
int foo1(int i)
{
int y = i;
foo2(y);
return y;
}
int foo2(int i)
{
int z = i;
return z;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
00000000004004f6 <main>:
4004f6:	55
push
%rbp
4004f7:	48 89 e5
mov
%rsp,%rbp
4004fa:	48 83 ec 10
sub
$0x10,%rsp
4004fe:	c7 45 fc 01 00 00 00
movl
$0x1,-0x4(%rbp)
400505:	8b 45 fc
mov
-0x4(%rbp),%eax
400508:	89 c7
mov
%eax,%edi
40050a:	e8 07 00 00 00
callq
400516 <foo1>
40050f:	b8 00 00 00 00
mov
$0x0,%eax
400514:	c9
leaveq
400515:	c3
retq
0000000000400516 <foo1>:
400516:	55
push
%rbp
400517:	48 89 e5
mov
%rsp,%rbp
40051a:	48 83 ec 20
sub
$0x20,%rsp
40051e:	89 7d ec
mov
%edi,-0x14(%rbp)
400521:	8b 45 ec
mov
-0x14(%rbp),%eax
400524:	89 45 fc
mov
%eax,-0x4(%rbp)
400527:	8b 45 fc
mov
-0x4(%rbp),%eax
40052a:	89 c7
mov
%eax,%edi
40052c:	e8 05 00 00 00
callq
400536 <foo2>
400531:	8b 45 fc
mov
-0x4(%rbp),%eax
400534:	c9
leaveq
400535:	c3
retq
0000000000400536 <foo2>:
400536:	55
push
%rbp
400537:	48 89 e5
mov
%rsp,%rbp
40053a:	89 7d ec
mov
%edi,-0x14(%rbp)
40053d:	8b 45 ec
mov
-0x14(%rbp),%eax
400540:	89 45 fc
mov
%eax,-0x4(%rbp)
400543:	8b 45 fc
mov
-0x4(%rbp),%eax
400546:	5d
pop
%rbp
400547:	c3
retq
400548:	0f 1f 84 00 00 00 00
nopl
0x0(%rax,%rax,1)
40054f:	00

1
2
mov esp，ebp
pop ebp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
typedef struct big_thing
{
char buf[128];
}big_thing;
big_thing return_test()
{
big_thing b;
b.buf[0] = 0;
return b;
}
int main()
{
big_thing n = return_test();
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
0000000000400566 <return_test>:
400566:	55
push
%rbp
400567:	48 89 e5
mov
%rsp,%rbp //前面这两句还是一般的函数开头
40056a:	48 81 ec a0 00 00 00
sub
$0xa0,%rsp //通过使rsp减0xa0，以开辟空间
400571:	48 89 bd 68 ff ff ff
mov
%rdi,-0x98(%rbp) //此时rbp已经指向old rbp，rdi 为传入的参数，由于本函数没有参数，因此这个传入的参数实际上n的地址
400578:	64 48 8b 04 25 28 00
mov
%fs:0x28,%rax
40057f:	00 00
400581:	48 89 45 f8
mov
%rax,-0x8(%rbp)
400585:	31 c0
xor
%eax,%eax //这三句什么作用没看出来
400587:	c6 85 70 ff ff ff 00
movb
$0x0,-0x90(%rbp) //b.buf[0] = 0，rbp-0x90为b的地址，可以通过gdb对以上数据进行验证
40058e:	48 8b 85 68 ff ff ff
mov
-0x98(%rbp),%rax //此时rbp-0x98中存储的是传入的参数的地址，而这个地址恰好是n的地址，最后这个地址又通过rax传回
400595:	48 8b 95 70 ff ff ff
mov
-0x90(%rbp),%rdx // 先传入rdx中
40059c:	48 89 10
mov
%rdx,(%rax) //再传入rax中保存的地址中
40059f:	48 8b 95 78 ff ff ff
mov
-0x88(%rbp),%rdx //递减8个字节，并反复这一过程
4005a6:	48 89 50 08
mov
%rdx,0x8(%rax)
4005aa:	48 8b 55 80
mov
-0x80(%rbp),%rdx
4005ae:	48 89 50 10
mov
%rdx,0x10(%rax)
4005b2:	48 8b 55 88
mov
-0x78(%rbp),%rdx
4005b6:	48 89 50 18
mov
%rdx,0x18(%rax)
4005ba:	48 8b 55 90
mov
-0x70(%rbp),%rdx
4005be:	48 89 50 20
mov
%rdx,0x20(%rax)
4005c2:	48 8b 55 98
mov
-0x68(%rbp),%rdx
4005c6:	48 89 50 28
mov
%rdx,0x28(%rax)
4005ca:	48 8b 55 a0
mov
-0x60(%rbp),%rdx
4005ce:	48 89 50 30
mov
%rdx,0x30(%rax)
4005d2:	48 8b 55 a8
mov
-0x58(%rbp),%rdx
4005d6:	48 89 50 38
mov
%rdx,0x38(%rax)
4005da:	48 8b 55 b0
mov
-0x50(%rbp),%rdx
4005de:	48 89 50 40
mov
%rdx,0x40(%rax)
4005e2:	48 8b 55 b8
mov
-0x48(%rbp),%rdx
4005e6:	48 89 50 48
mov
%rdx,0x48(%rax)
4005ea:	48 8b 55 c0
mov
-0x40(%rbp),%rdx
4005ee:	48 89 50 50
mov
%rdx,0x50(%rax)
4005f2:	48 8b 55 c8
mov
-0x38(%rbp),%rdx
4005f6:	48 89 50 58
mov
%rdx,0x58(%rax)
4005fa:	48 8b 55 d0
mov
-0x30(%rbp),%rdx
4005fe:	48 89 50 60
mov
%rdx,0x60(%rax)
400602:	48 8b 55 d8
mov
-0x28(%rbp),%rdx
400606:	48 89 50 68
mov
%rdx,0x68(%rax)
40060a:	48 8b 55 e0
mov
-0x20(%rbp),%rdx
40060e:	48 89 50 70
mov
%rdx,0x70(%rax)
400612:	48 8b 55 e8
mov
-0x18(%rbp),%rdx
400616:	48 89 50 78
mov
%rdx,0x78(%rax) //从rbp-0x90到rbp-0x18共0x78个字节，换为十进制就是120个字节，正好是struct的大小。
40061a:	48 8b 85 68 ff ff ff
mov
-0x98(%rbp),%rax //这一句有什么作用不太清楚，之前已经做这一操作了，而且寄存器的值也没有变化
400621:	48 8b 4d f8
mov
-0x8(%rbp),%rcx
400625:	64 48 33 0c 25 28 00
xor
%fs:0x28,%rcx //以上两句什么作用又不知道
40062c:	00 00
40062e:	74 05
je
400635 <return_test+0xcf> //跳过下一句
400630:	e8 0b fe ff ff
callq
400440 <__stack_chk_fail@plt>
400635:	c9
leaveq //清栈操作
400636:	c3
retq
//返回
0000000000400637 <main>:
400637:	55
push
%rbp
400638:	48 89 e5
mov
%rsp,%rbp //还是函数的开头
40063b:	48 81 ec 90 00 00 00
sub
$0x90,%rsp //开辟空间
400642:	64 48 8b 04 25 28 00
mov
%fs:0x28,%rax
400649:	00 00
40064b:	48 89 45 f8
mov
%rax,-0x8(%rbp)
40064f:	31 c0
xor
%eax,%eax //这几句的作用没有搞清楚
400651:	48 8d 85 70 ff ff ff
lea
-0x90(%rbp),%rax //n的地址与rbp-0x90的值相同
400658:	48 89 c7
mov
%rax,%rdi //把这一地址作为参数传入rdi中
40065b:	b8 00 00 00 00
mov
$0x0,%eax //这一句的作用没搞清楚
400660:	e8 01 ff ff ff
callq
400566 <return_test>
400665:	48 8b 55 f8
mov
-0x8(%rbp),%rdx
400669:	64 48 33 14 25 28 00
xor
%fs:0x28,%rdx
400670:	00 00
400672:	74 05
je
400679 <main+0x42>
400674:	e8 c7 fd ff ff
callq
400440 <__stack_chk_fail@plt>
400679:	c9
leaveq
40067a:	c3
retq
40067b:	0f 1f 44 00 00
nopl
0x0(%rax,%rax,1)