Question

我知道rmmovl可以通过以下方式使用：

rmmovl %ecx, 4(%edx)

但是如何动态设置向下移动堆栈的位数（在本例中为4）？我已经尝试使用我想要转移到的值设置变量，例如rmmovl %ecx, %edi(%edx)，但这不起作用。

Answer 1

您必须手动设置％edx以包含偏移量。我们可以将％edx的值保存在堆栈中并在之后恢复它，因此它的原始值不会受到影响。

pushl %edx             # save current value of %edx
addl %edi, %edx        # add %edi to %edx
rmmovl %ecx, (%edx)    # store value of %ecx into %edx with offset %edi
popl %edx              # restore old %edx

Answer 2

我不确定我完全理解这个问题。 Analytica的答案是非常正确的，如果你只是想找到一种方法来执行一个变量偏移（顺便说一下，原则上你可以不推荐，随时修改Y86代码，随着你的进展建立偏移量，因为Y86没有覆盖保护并且不区分数据和程序。）

但是，你写“...设置向下移动堆栈的位数（在这种情况下为4）？”除非这只是一个错字，否则你会问一个更广泛的问题（顺便说一下，不推荐手动操作堆栈。）为了完整起见，我提供两个程序来解决你的问题。

第一个程序，程序1，演示了可变偏移。第二个程序，程序2，通过变量偏移演示堆栈操作。它应该是不言自明的。

.pos 0x0100
stack:

.pos 0x00a0
rangestart: .long 0xAAAAAAAA
            .long 0xBBBBBBBB
            .long 0xCCCCCCCC   # Target for substitution in Program 1
            .long 0xDDDDDDDD
rangeend:   

.pos 0x0000
#
# Program 1
#
# Simple program showing how we can "improvise" variable offset in rmmovl
# Our goal is to replace 0xCCCCCCCC with 0xFFFFFFFF in the range from 
# .. rangestart to rangeend and preserving whatever temporary register 
# .... we use for the offset
#
Program1: irmovl stack, %esp # Set stack pointer
irmovl 0xFFFFFFFF, %ecx      # Stuff we can easily recognize
irmovl rangeend, %edx        # Target area that we will negatively offset from

irmovl $-8, %edi             # Set offset value -8

pushl %edx                   # Save current value of %edx
addl %edi, %edx              # Add offset to %edx
rmmovl %ecx, (%edx)          # Store value of %ecx into %edx with offset 
popl %edx                    # Restore old %edx
jmp Program2

#
# Program 2
#
# Simple program showing how we can manipulate the stack using offsets
# Manipulating the stack is NOT recommended.
# Our goal is to push some easily recognizable stuff on the stack
# ... and change it afterwards 
#
Program2:
pushl %edx                # Save current value of %edx
pushl %edx                # .. and %eax
irmovl 0xFFFFFFFF, %edx   # Stuff we can easily recognize
pushl %edx                # Push it
irmovl 0xEEEEEEEE, %edx   # Stuff we can easily recognize
pushl %edx                # Push it
irmovl 0xDDDDDDDD, %edx   # Stuff we can easily recognize
pushl %edx                # Push it

irmovl 0xAAAAAAAA, %eax   # Stuff we can easily recognize
irmovl $4, %edi           # Set offset value 4 (replace 0xEEEEEEEE)

rrmovl %esp, %edx         # Get stack 
addl %edi,%edx            # .. and offset

rmmovl %eax, (%edx) # Store stuff we recognize into offset to stack 

popl  %edx                # Bypass 
popl  %edx                # .. junk
popl  %edx                # .... on stack
popl  %edx                # ....... and restore old %edx
popl  %edx                # ......... and %eax 

halt                      # Finito!

rmmovl动态位数

2 个答案: