Question

我可以知道为什么在objdump显示的汇编代码中看不到15个字节的0x00吗？

printNumber()

Answer 1

您想要objdump's -z option：

-z
  --disassemble-zeroes
   通常反汇编输出   将跳过零块。此选项将反汇编程序定向到   像其他任何数据一样，拆卸这些块。

Answer 2

如果您熟悉radare2

% gcc -masm=intel -g -c test.c -o test
% r2 -AA mc                       
Warning: run r2 with -e io.cache=true to fix relocations in disassembly
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls (aac)
[x] Analyze len bytes of instructions for references (aar)
[x] Check for objc references
[x] Check for vtables
[x] Type matching analysis for all functions (aaft)
[x] Propagate noreturn information
[x] Use -AA or aaaa to perform additional experimental analysis.
[x] Finding function preludes
[x] Enable constraint types analysis for variables
-- How good is your C? 
[0x08000034]> afl
0x08000034    1 23           sym.main
[0x08000034]> pdf @ sym.main
           ;-- section..text:
           ;-- .text:
           ;-- eip:
┌ 23: int sym.main (int argc, char **argv, char **envp);
│           0x08000034      55             push ebp                    ; [01] -r-x section size 21 named .text
│           0x08000035      89e5           mov ebp, esp
│           0x08000037      0000           add byte [eax], al
│           0x08000039      0000           add byte [eax], al
│           0x0800003b      0000           add byte [eax], al
│           0x0800003d      0000           add byte [eax], al
│           0x0800003f      0000           add byte [eax], al
│           0x08000041      0000           add byte [eax], al
│           0x08000043      0000           add byte [eax], al
└           0x08000045  ~   00905dc3ffff   add byte [eax - 0x3ca3], dl
│           ;-- section..data:
│           ;-- section..bss:
│           ;-- section..debug_info:
│           ;-- .data:
│           ;-- .bss:
│           ;-- .debug_info:
..
[0x08000034]>

带有零块的机器代码上的objdump不会显示所有字节吗？

2 个答案: