C++反汇编-)类,结构体,命名空间分析(一)

2014-11-24 11:48:53 · 作者: · 浏览: 7

首先来看类(class)的反汇编代码:

class name
{
public:
	int i;
	int j;
    int add(int in1,int in2)
	{
		return in1+in2;
	}
protected:
private:
};

void main()
{
	name n;
	n.i=10;
	n.j=12;
	std::cout<
  
   

主函数对应反汇编代码:

00401560 > > \55            PUSH EBP
00401561   .  8BEC          MOV EBP,ESP
00401563   .  83EC 48       SUB ESP,48
00401566   .  53            PUSH EBX
00401567   .  56            PUSH ESI
00401568   .  57            PUSH EDI
00401569   .  8D7D B8       LEA EDI,DWORD PTR SS:[EBP-48]
0040156C   .  B9 12000000   MOV ECX,12
00401571   .  B8 CCCCCCCC   MOV EAX,CCCCCCCC
00401576   .  F3:AB         REP STOS DWORD PTR ES:[EDI]
00401578   .  C745 F8 0A000>MOV DWORD PTR SS:[EBP-8],0A
0040157F   .  C745 FC 0C000>MOV DWORD PTR SS:[EBP-4],0C
00401586   .  68 C8104000   PUSH testcals.004010C8
0040158B   .  8B45 FC       MOV EAX,DWORD PTR SS:[EBP-4]
0040158E   .  50            PUSH EAX
0040158F   .  8B4D F8       MOV ECX,DWORD PTR SS:[EBP-8]
00401592   .  51            PUSH ECX
00401593   .  8D4D F8       LEA ECX,DWORD PTR SS:[EBP-8]
00401596   .  E8 59FCFFFF   CALL testcals.004011F4 //执行add函数语句
0040159B   .  50            PUSH EAX
0040159C   .  B9 A0DE4700   MOV ECX,OFFSET testcals.std::cout
004015A1   .  E8 59FBFFFF   CALL testcals.004010FF
004015A6   .  8BC8          MOV ECX,EAX
004015A8   .  E8 33FCFFFF   CALL testcals.004011E0
004015AD   .  68 1C004700   PUSH OFFSET testcals.  _C@_05PBCN@pause >; /pause
004015B2   .  E8 D9EF0100   CALL testcals.system                     ; \system
004015B7   .  83C4 04       ADD ESP,4
004015BA   .  5F            POP EDI
004015BB   .  5E            POP ESI
004015BC   .  5B            POP EBX
004015BD   .  83C4 48       ADD ESP,48
004015C0   .  3BEC          CMP EBP,ESP
004015C2   .  E8 D9F00100   CALL testcals.__chkesp
004015C7   .  8BE5          MOV ESP,EBP
004015C9   .  5D            POP EBP
004015CA   .  C3            RETN
找到对应的语句如下:
004015F0 >/> \55            PUSH EBP                                 ;  add function
004015F1  |.  8BEC          MOV EBP,ESP
004015F3  |.  83EC 44       SUB ESP,44
004015F6  |.  53            PUSH EBX
004015F7  |.  56            PUSH ESI
004015F8  |.  57            PUSH EDI
004015F9  |.  51            PUSH ECX
004015FA  |.  8D7D BC       LEA EDI,DWORD PTR SS:[EBP-44]
004015FD  |.  B9 11000000   MOV ECX,11
00401602  |.  B8 CCCCCCCC   MOV EAX,CCCCCCCC
00401607  |.  F3:AB         REP STOS DWORD PTR ES:[EDI]
00401609  |.  59            POP ECX
0040160A  |.  894D FC       MOV DWORD PTR SS:[EBP-4],ECX
0040160D  |.  8B45 08       MOV EAX,DWORD PTR SS:[EBP+8]
00401610  |.  0345 0C       ADD EAX,DWORD PTR SS:[EBP+C]
00401613  |.  5F            POP EDI
00401614  |.  5E            POP ESI
00401615  |.  5B            POP EBX
00401616  |.  8BE5          MOV ESP,EBP
00401618  |.  5D            POP EBP
00401619  \.  C2 0800       RETN 8

2.namespace 命名:

namespace name
{
	int i;
	int j;
	int add(int in1,int in2)
	{
		return in1+in2;
	}
}
void main()
{
	std::cout<<"tip1"<
    
     对应的反汇编
     源码

00401580 >/> \55            PUSH EBP
00401581  |.  8BEC          MOV EBP,ESP
00401583  |.  83EC 40       SUB ESP,40
00401586  |.  53            PUSH EBX
00401587  |.  56            PUSH ESI
00401588  |.  57            PUSH EDI
00401589  |.  8D7D C0       LEA EDI,DWORD PTR SS:[EBP-40]
0040158C  |.  B9 10000000   MOV ECX,10
00401591  |.  B8 CCCCCCCC   MOV EAX,CCCCCCCC
00401596  |.  F3:AB         REP STOS DWORD PTR ES:[EDI]
00401598  |.  8B45 08       MOV EAX,DWORD PTR SS:[EBP+8]             ;  实现add函数
0040159B  |.  0345 0C       ADD EAX,DWORD PTR SS:[EBP+C]
0040159E  |.  5F            POP EDI
0040159F  |.  5E            POP ESI
004015A0  |.  5B            POP EBX
004015A1  |.  8BE5          MOV ESP,EBP
004015A3  |.  5D            POP EBP
004015A4  \.  C3            RETN
004015A5      CC            INT3
004015A6      CC            INT3
004015A7      CC            INT3
004015A8      CC            INT3
004015A9      CC            INT3
004015AA      CC            INT3
004015AB      CC            INT3
004015AC      CC            INT3
004015AD      CC            INT3
004015AE      CC            INT3
004015AF      CC            INT3
004015B0 > >  55            PUSH EBP
004015B1   .  8BEC          MOV EBP,ESP
004015B3   .  83EC 40       SUB ESP,40
004015B6   .  53            PUSH EBX
004015B7   .  56            PUSH ESI
004015B8   .  57            PUSH EDI
004015B9   .  8D7D C0       LEA EDI,DWORD PTR SS:[EBP-40]
004015BC   .  B9 10000000   MOV ECX,10
004015C1   .  B8 CCCCCCCC   MOV EAX,CCCCCCCC
004015C6   .  F3:AB         REP STOS DWORD PTR ES:[EDI]
004015C8   .  68 C81040