最近我开始使用Windbg（x64），为了使用它，我使用
编译了（x64）示例程序 cl.exe ls.c /Zi /Od /GS-
有趣的是，为可执行文件生成的函数包含FPO优化。下面是例程反汇编的片段。
0:000> uf ls!GetDateString
ls!GetDateString:
00007ff7`459a6d00 mov qword ptr [rsp+8],rcx
00007ff7`459a6d05 sub rsp,88h
00007ff7`459a6d0c mov qword ptr [rsp+58h],0
00007ff7`459a6d15 mov qword ptr [rsp+50h],0
00007ff7`459a6d1e mov eax,dword ptr [ls!dateType (00007ff7`45a14494)]
00007ff7`459a6d24 and eax,1
00007ff7`459a6d27 test eax,eax
00007ff7`459a6d29 je ls!GetDateString+0x3e (00007ff7`459a6d3e)
我是否知道如何在x64 VC ++编译器上禁用此FPO优化。看看官方文档，似乎我们无法通过/ Oy- switch禁用它 https://msdn.microsoft.com/en-us/library/2kxx5t2c.aspx
/ Oy启用帧指针省略和/ Oy-禁用省略。 / Oy是 仅在x86编译器中可用。
我想知道这个标志是否仅适用于x86，那么像FileTimeToSystemTime这样的x64 windows例程如何禁用FPO呢？
0:000> uf .
KERNELBASE!FileTimeToSystemTime:
00007ffc`a03ad120 mov qword ptr [rsp+18h],rbx
00007ffc`a03ad125 push rbp
00007ffc`a03ad126 mov rbp,rsp
00007ffc`a03ad129 sub rsp,40h
00007ffc`a03ad12d mov rax,qword ptr [KERNELBASE!_security_cookie (00007ffc`a0515000)]
00007ffc`a03ad134 xor rax,rsp
00007ffc`a03ad137 mov qword ptr [rbp-8],rax
00007ffc`a03ad13b mov eax,dword ptr [rcx]
00007ffc`a03ad13d mov rbx,rdx
00007ffc`a03ad140 mov dword ptr [rbp-20h],eax
00007ffc`a03ad143 mov eax,dword ptr [rcx+4]
00007ffc`a03ad146 mov dword ptr [rbp-1Ch],eax
答案 0 :(得分：0)
如果您使用的是__alloca() (allocate memory in stack)功能，请在x64中
然后ebp用作帧指针，否则ebp是通用寄存器ebp不用作帧指针
如果ebp用作帧指针，那么展开信息可能包含
UWOP_PUSH_NONVOL reg: rbp and UWOP_SET_FPREG
使用cl /Zi /Od /GS- test.cpp编译的样本src
使用Windows sdk环境从32位机器编译
@call "C:\Program Files\Microsoft SDKs\Windows\v7.1\Bin\setenv.cmd" /x64 /RELEASE
src使用
#include <stdio.h>
#include <malloc.h>
__int64 wtfisfpo(__int64 a , __int64 b ) {
char *foo = (char *)_alloca(0x20);
*foo = 'b';
printf("%c\n",foo);
return (b+a);
}
int main(void) {
printf("%I64x\n", wtfisfpo(4,9));
return 1;
}
在32位机器上用windbg反汇编，将exe加载为dump windbg -z test.exe
0:000> uf test!wtfisfpo
test!wtfisfpo [xxxx\test.cpp @ 4]:
4 00000001`40001020 4889542410 mov qword ptr [rsp+10h],rdx
4 00000001`40001025 48894c2408 mov qword ptr [rsp+8],rcx
4 00000001`4000102a 55 push rbp
4 00000001`4000102b 4883ec30 sub rsp,30h
4 00000001`4000102f 488d6c2420 lea rbp,[rsp+20h]
5 00000001`40001034 8b0424 mov eax,dword ptr [rsp]
5 00000001`40001037 b820000000 mov eax,20h
5 00000001`4000103c 482be0 sub rsp,rax
5 00000001`4000103f 488d442420 lea rax,[rsp+20h]
5 00000001`40001044 8b08 mov ecx,dword ptr [rax]
5 00000001`40001046 48894500 mov qword ptr [rbp],rax
6 00000001`4000104a 488b4500 mov rax,qword ptr [rbp]
6 00000001`4000104e c60062 mov byte ptr [rax],62h
7 00000001`40001051 488b5500 mov rdx,qword ptr [rbp]
7 00000001`40001055 488d0d907c0100 lea rcx,[test!__xt_z+0x12c (00000001`40018cec)]
7 00000001`4000105c e8cf000000 call test!printf (00000001`40001130)
8 00000001`40001061 488b4520 mov rax,qword ptr [rbp+20h]
8 00000001`40001065 488b4d28 mov rcx,qword ptr [rbp+28h]
8 00000001`40001069 4803c8 add rcx,rax
8 00000001`4000106c 488bc1 mov rax,rcx
9 00000001`4000106f 488d6510 lea rsp,[rbp+10h]
9 00000001`40001073 5d pop rbp
9 00000001`40001074 c3 ret
此功能的展开信息详情
0:000> .fnent test!wtfisfpo
Debugger function entry 00000000`000d39a0 for:
xxxx\test.cpp(4)
(00000001`40001020) test!wtfisfpo | (00000001`40001080) test!main
Exact matches:
test!wtfisfpo (int64, int64)
BeginAddress = 00000000`00001020
EndAddress = 00000000`00001075
UnwindInfoAddress = 00000000`0001c1b8
Unwind info at 00000001`4001c1b8, a bytes
version 1, flags 0, prolog 14, codes 3
frame reg 5 (rbp), frame offs 20h
00: offs 14, unwind op 3, op info 2 UWOP_SET_FPREG.
01: offs f, unwind op 2, op info 5 UWOP_ALLOC_SMALL.
02: offs b, unwind op 0, op info 5 UWOP_PUSH_NONVOL reg: rbp.
关于为何使用rbp的评论也许该函数被编译为像这样的汇编例程
include ksamd64.inc
.CODE
main PROC
call sample
main ENDP
sample PROC FRAME
push_reg rbp
set_frame rbp, 0h
.endprolog
add rsp, 0
pop rbp
ret
sample ENDP
END
与
组装@call "C:\Program Files\Microsoft SDKs\Windows\v7.1\Bin\setenv.cmd" /x64 /RELEASE
ml64.exe /Zi 64bitasm.asm /link /subsystem:console /defaultlib:kernel32.lib /entry:main /RELEASE
和相关的反汇编
0:000> x 64bitasm!*
00000001`40002058 64bitasm!$xdatasym = 0x01 ''
00000001`40001000 64bitasm!main (void)
00000001`40001005 64bitasm!sample (void)
0:000> uf 64bitasm!sample
64bitasm!sample [\64bitasm.asm @ 7]:
7 00000001`40001005 55 push rbp
9 00000001`40001006 488bec mov rbp,rsp
11 00000001`40001009 4883c400 add rsp,0
12 00000001`4000100d 5d pop rbp
13 00000001`4000100e c3 ret
0:000> uf 64bitasm!main
64bitasm!main [\64bitasm.asm @ 3]:
3 00000001`40001000 e800000000 call 64bitasm!sample (00000001`40001005)
7 00000001`40001005 55 push rbp
9 00000001`40001006 488bec mov rbp,rsp
11 00000001`40001009 4883c400 add rsp,0
12 00000001`4000100d 5d pop rbp
13 00000001`4000100e c3 ret