Stack Backstrace | don7hao's blog

文章目录

1. 基础知识
2. 栈跟踪
1. 2.1. 代码
2. 2.2. gdb跟踪

基础知识

stack frame

Stack frame（栈帧）是一个为函数保留的区域，用来存储关于参数、局部变量和返回地址的信息。

stack_frame

寄存器

EIP

$eip:instruction pointer
EIP寄存器存放下一条要执行的指令地址。

EBP

$ebp:frame pointer
EBP寄存器指向stack frame的基地址。

If $ebp for some stack frame is stored at addr X then $eip for that frame is stored at addr X + 4.

ESP

$esp:Stack Pointer(SP)
ESP寄存器指向栈顶。

汇编指令

CALL操作

把返回地址压入栈中并且跳转到调用函数开始处并且执，具体步骤:
1.Push eip : the return address
2.Push ebp : saves previous frame pointer
3.Copy sp into fp : ebp = esp
4.The new AR’s frame pointer will be the previous value of the stack pointer
5.Advance sp (esp) for allocations on stack (that is, decrement it)

LEAVE操作

1.Load ebp into esp: move %ebp, %esp
2.Restore ebp from the stack: pop %ebp

RET操作

调用RET前，程序员要保证栈指针ESP指向的位置刚好为CALL指令保存的返回地址(EIP)，具体步骤:
1.Move contents of ebp into esp.
2.Increment esp by 4.
3.esp should now point to eip.
4.RET will load the value stored in esp into the eip register then jump to that value.

stack

栈跟踪

代码

gcc -g test.c -o test

　　#include

void funcc(int c)
{
    printf("%d\n", c);
}

void funcb(int b, int c)
{
    printf("%d\n", b);
    funcc(c);
}

void funca(int a, int b, int c)
{
    printf("%d\n", a);
    funcb(b, c);
}

void main()
{
    int a = 4;
    int b = 3;
    int c = 2;
    int d = 1;
    funca(a, b, c);
    printf("%d\n", d);
}