dwarf是如何处理栈帧的？
DW_AT_frame_base 表明函数栈帧的起始点
95 < 1><0x000000ca> DW_TAG_subprogram
96 DW_AT_external yes(1)
97 DW_AT_name "funcb"
98 DW_AT_decl_file 0x00000001 /home/hon/codebox/gcc/sleep.c
99 DW_AT_decl_line 0x0000000d
100 DW_AT_prototyped yes(1)
101 DW_AT_type <0x00000049>
102 DW_AT_low_pc 0x004009f4
103 DW_AT_high_pc <offset-from-lowpc>25
104 DW_AT_ _base ， len 0x0001: 9c: DW_OP_call_frame_cfa
105 DW_AT_GNU_all_tail_call_sitesyes(1)
106 DW_AT_sibling <0x000000f8>
栈帧的起始点，这个起始点，
对于调试器可以定位到的每一个地址，都会制定当前栈帧到变量间的偏移。疑问是DW_OP_call_frame_cfa是啥意思
最关键的是eh_frame段，怎么样读取eh_frame的内容？readelf -Wwf xx
使用gdb调试程序
(gdb) i f ---－－－－－－－－－－---> 函数funca处的断点
Stack level 0, frame at 0x7fffffffdb40:
rip = 0x400a0d in funca (sleep.c:16); saved rip = 0x400a4b
called by frame at 0x7fffffffdb70 <----------这个就是栈的基地址了
source language c.
Arglist at 0x7fffffffdb30, args: a=0
Locals at 0x7fffffffdb30, Previous frame's sp is 0x7fffffffdb40
Saved registers:
rip at 0x7fffffffdb38
(gdb) c
Continuing.
Breakpoint 2, funcb (b=124) at sleep.c:13
13 int funcb(int b) {
(gdb) i f －－－－－－－－－－－－－》函数funcb处的断点
Stack level 0, frame at 0x7fffffffdb20:
rip = 0x4009f4 in funcb (sleep.c:13); saved rip = 0x400a20
called by frame at 0x7fffffffdb40
source language c.
Arglist at 0x7fffffffdb10, args: b=124
Locals at 0x7fffffffdb10, Previous frame's sp is 0x7fffffffdb20
Saved registers:
rip at 0x7fffffffdb18
(gdb) c
Continuing.
Breakpoint 1, funcc (a=53) at sleep.c:5
5 int funcc(int a) {
(gdb) i f －－－－－－－－－－－－》函数funcc处的断点
Stack level 0, frame at 0x7fffffffdb00:
rip = 0x4009ae in funcc (sleep.c:5); saved rip = 0x400a07
called by frame at 0x7fffffffdb20
source language c.
Arglist at 0x7fffffffdaf0, args: a=53
Locals at 0x7fffffffdaf0, Previous frame's sp is 0x7fffffffdb00
Saved registers:
rip at 0x7fffffffdaf8
然后把整个函数调用栈打印出来
看一下此时的栈帧结果是啥子吧，此时rsp是在0x7ffffffffdaf8处，
0x0000000000400a07 处是funcb的返回地址；funb函数中有三个8字节是作为自己的参数的，其中只有一个形参放在了地址：mov %edi,0xc(%rsp) 中，从这里我们知道funcb的栈底应该是0x7fffffffdb20
(gdb) x/60x $sp 0x7fffffffdaf8: 0x00400a07
0x00000000
0x00000000
0x00000000 0x7fffffffdb08: 0x00000077
0x00171717
0x006c9fb0
0x00000000 0x7fffffffdb18: 0x00400a20
0x00000000
0x006cf6b0
0x00000000 0x7fffffffdb28: 0x00000001 0x00171717 0x00000020 0x00000000 0x7fffffffdb38: 0x00400a4b 0x00000000 0x00000140 0x00000000 0x7fffffffdb48: 0x00123456 0x00171717 0x006cf668 0x00000000 0x7fffffffdb58: 0x00294b6d 0x00000000 0x00000000 0x00000000 0x7fffffffdb68: 0x00400add 0x00000000 0x00000000 0x00000000 0x7fffffffdb78: 0x0000000a 0x00000002 0xffffdbf0 0x00171717 0x7fffffffdb88: 0x00123456 0x00000000 0x00000000 0x00000000 0x7fffffffdb98: 0x00000003 0x00000000 0xffffdda8 0x00007fff 0x7fffffffdba8: 0x00000004 0x00000000 0x00000002 0x00000000 0x7fffffffdbb8: 0x00000006 0x00000000 0x7ffffa00 0x00000003 0x7fffffffdbc8: 0x000027ab 0x00000000 0xf7ffd2f4 0x00007fff 0x7fffffffdbd8: 0x00000001 0x00000000 0x00000001 0x00000000
按照之前的说法，栈的基址是指ebp指向的地方，ebp指向的地方是old ebp，然后是返回地址，在gdb中输出的栈信息中call by frame中
当使用-fomit-stack-pointer去编译程序的时候，程序在整个执行过程中esp的值是不会变的，所以只要是抓到了一个函数，那么这个函数的esp是固定的