汇编语言与逆向工程实验报告2

查看编译后的 32bit 代码，比较与 64bit 的不同

信息

hello_32.o： 文件格式 elf32-i386

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
hello_32.o：     文件格式 elf32-i386


Disassembly of section .text:

00000000 <fun>:
   0:	55                   	push   ebp
   1:	89 e5                	mov    ebp,esp
   3:	e8 fc ff ff ff       	call   4 <fun+0x4>
   8:	05 01 00 00 00       	add    eax,0x1
   d:	8b 55 08             	mov    edx,DWORD PTR [ebp+0x8]
  10:	8b 45 0c             	mov    eax,DWORD PTR [ebp+0xc]
  13:	01 d0                	add    eax,edx
  15:	5d                   	pop    ebp
  16:	c3                   	ret    

00000017 <main>:
  17:	8d 4c 24 04          	lea    ecx,[esp+0x4]
  1b:	83 e4 f0             	and    esp,0xfffffff0
  1e:	ff 71 fc             	push   DWORD PTR [ecx-0x4]
  21:	55                   	push   ebp
  22:	89 e5                	mov    ebp,esp
  24:	53                   	push   ebx
  25:	51                   	push   ecx
  26:	83 ec 10             	sub    esp,0x10
  29:	e8 fc ff ff ff       	call   2a <main+0x13>
  2e:	81 c3 02 00 00 00    	add    ebx,0x2
  34:	6a 04                	push   0x4
  36:	6a 03                	push   0x3
  38:	e8 fc ff ff ff       	call   39 <main+0x22>
  3d:	83 c4 08             	add    esp,0x8
  40:	89 45 f4             	mov    DWORD PTR [ebp-0xc],eax
  43:	83 ec 08             	sub    esp,0x8
  46:	ff 75 f4             	push   DWORD PTR [ebp-0xc]
  49:	8d 83 00 00 00 00    	lea    eax,[ebx+0x0]
  4f:	50                   	push   eax
  50:	e8 fc ff ff ff       	call   51 <main+0x3a>
  55:	83 c4 10             	add    esp,0x10
  58:	b8 00 00 00 00       	mov    eax,0x0
  5d:	8d 65 f8             	lea    esp,[ebp-0x8]
  60:	59                   	pop    ecx
  61:	5b                   	pop    ebx
  62:	5d                   	pop    ebp
  63:	8d 61 fc             	lea    esp,[ecx-0x4]
  66:	c3                   	ret    

Disassembly of section .text.__x86.get_pc_thunk.ax:

00000000 <__x86.get_pc_thunk.ax>:
   0:	8b 04 24             	mov    eax,DWORD PTR [esp]
   3:	c3                   	ret    

Disassembly of section .text.__x86.get_pc_thunk.bx:

00000000 <__x86.get_pc_thunk.bx>:
   0:	8b 1c 24             	mov    ebx,DWORD PTR [esp]
   3:	c3                   	ret

hello.o： 文件格式 elf64-x86-64

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
hello.o：     文件格式 elf64-x86-64


Disassembly of section .text:

0000000000000000 <fun>:
   0:	f3 0f 1e fa          	endbr64 
   4:	55                   	push   rbp
   5:	48 89 e5             	mov    rbp,rsp
   8:	89 7d fc             	mov    DWORD PTR [rbp-0x4],edi
   b:	89 75 f8             	mov    DWORD PTR [rbp-0x8],esi
   e:	8b 55 fc             	mov    edx,DWORD PTR [rbp-0x4]
  11:	8b 45 f8             	mov    eax,DWORD PTR [rbp-0x8]
  14:	01 d0                	add    eax,edx
  16:	5d                   	pop    rbp
  17:	c3                   	ret    

0000000000000018 <main>:
  18:	f3 0f 1e fa          	endbr64 
  1c:	55                   	push   rbp
  1d:	48 89 e5             	mov    rbp,rsp
  20:	48 83 ec 10          	sub    rsp,0x10
  24:	be 04 00 00 00       	mov    esi,0x4
  29:	bf 03 00 00 00       	mov    edi,0x3
  2e:	e8 00 00 00 00       	call   33 <main+0x1b>
  33:	89 45 fc             	mov    DWORD PTR [rbp-0x4],eax
  36:	8b 45 fc             	mov    eax,DWORD PTR [rbp-0x4]
  39:	89 c6                	mov    esi,eax
  3b:	48 8d 05 00 00 00 00 	lea    rax,[rip+0x0]        # 42 <main+0x2a>
  42:	48 89 c7             	mov    rdi,rax
  45:	b8 00 00 00 00       	mov    eax,0x0
  4a:	e8 00 00 00 00       	call   4f <main+0x37>
  4f:	b8 00 00 00 00       	mov    eax,0x0
  54:	c9                   	leave  
  55:	c3                   	ret

区别

fun函数偏移地址不同，汇编指令不同

一个是32位一个是64位

  • 32 位 x86 指令集。
  • 64 位 x86-64 指令集。
  • 32 位寄存器（如 eax、ebx、edx）。
  • 64 位寄存器（如 rax、rbx、rdx）。

堆栈操作指令不同

push pop

mov sub