gdb运行时结合汇编堆栈分析

一、从源代码文件到可执行文件

        从C文件到可执行文件，一般来说需要两步，先将每个C文件编译成.o文件，再把多个.o文件和链接库一起链接成可执行文件。但具体来说，其实是分为四步，下面以example.c为例进行说明。

#define MYINT int

short addend1 = 1;
static int addend2 = 2;
const static long addend3 = 3;

static MYINT g(MYINT x)
{
    return x + addend1;
}

static const MYINT f(MYINT x)
{
    return g(x + addend2);
}

MYINT main(void)
{
    return f(8) + addend3;
}

        第一步： 预处理，进行宏替换等工作。执行gcc -E -o example.cpp example.c，得到example.cpp如下：

# 1 "example.c"
# 1 "<built-in>"
# 1 "<命令行>"
# 1 "example.c"

short addend1 = 1;
static int addend2 = 2;
const static long addend3 = 3;

static int g(int x)
{
    return x + addend1;
}

static const int f(int x)
{
    return g(x + addend2);
}

int main(void)
{
    return f(8) + addend3;
}

        第二步：将预处理文件编译成汇编文件。执行 gcc -x cpp-output -S -fno-asynchronous-unwind-tables -o example.s example.cpp，加入 -fno-asynchronous-unwind-tables是为了禁止生成.cfi代码。生成的汇编代码如下：

    .file    "example.c"       ; C文件的文件名
    .globl    addend1          ; 全局变量
    .data                      ; 数据段
                               ; short addend1 = 1;开始
    .align 2                   ; 地址对齐，按2的整数倍对齐
    .type    addend1, @object  ; 类型是对象
    .size    addend1, 2        ; 占两个字节
addend1:                       ; 起始地址
    .value    1                ; 初始值
                               ; static int addend2 = 2;开始
    .align 4 
    .type    addend2, @object
    .size    addend2, 4
addend2:
    .long    2
    .section    .rodata        ; 常量存储区开始
    .align 4
    .type    addend3, @object
    .size    addend3, 4
addend3:
    .long    3
    .text                      ; 代码段开始
    .type    g, @function      ; 函数g
g:                             ; g的起始地址
    pushl    %ebp              ; %ebp入栈
    movl    %esp, %ebp         ; 当前函数栈从%esp开始
    movzwl    addend1, %eax    ; 把short放入%eax
    cwtl
    addl    8(%ebp), %eax      ; int + short
    popl    %ebp
    ret
    .size    g, .-g
    .type    f, @function
f:
    pushl    %ebp
    movl    %esp, %ebp
    subl    $4, %esp           ; 为调用g时传递参数准备空间
    movl    addend2, %eax      ; 在%eax中计算实参
    addl    8(%ebp), %eax
    movl    %eax, (%esp)       ; 实参入栈
    call    g
    leave
    ret
    .size    f, .-f
    .globl    main             ; main未加static，是全局可见的
    .type    main, @function
main:
    pushl    %ebp
    movl    %esp, %ebp
    subl    $4, %esp
    movl    $8, (%esp)
    call    f
    movl    addend3, %edx
    addl    %edx, %eax
    leave
    ret
    .size    main, .-main
    .ident    "GCC: (Ubuntu/Linaro 4.6.3-1ubuntu5) 4.6.3"
    .section    .note.GNU-stack,"",@progbits
　　

        由汇编代码可见：1.未加static的全局变量和函数都生成了相应的.globl代码，表示是全局的；2.int和long是4字节的；3.const变量放在常量存储区.rodata处。

        第三步，将汇编代码编译成二进制目标文件，gcc -x assembler -c example.s。生成example.o文件，用objdump -D example.o察看，得到如下信息:

example.o:     file format elf32-i386


Disassembly of section .text:

00000000 <g>:
   0:    55                       push   %ebp
   1:    89 e5                    mov    %esp,%ebp
   3:    0f b7 05 00 00 00 00     movzwl 0x0,%eax
   a:    98                       cwtl   
   b:    03 45 08                 add    0x8(%ebp),%eax
   e:    5d                       pop    %ebp
   f:    c3                       ret    

00000010 <f>:
  10:    55                       push   %ebp
  11:    89 e5                    mov    %esp,%ebp
  13:    83 ec 04                 sub    $0x4,%esp
  16:    a1 04 00 00 00           mov    0x4,%eax
  1b:    03 45 08                 add    0x8(%ebp),%eax
  1e:    89 04 24                 mov    %eax,(%esp)
  21:    e8 da ff ff ff           call   0 <g>
  26:    c9                       leave  
  27:    c3                       ret    

00000028 <main>:
  28:    55                       push   %ebp
  29:    89 e5                    mov    %esp,%ebp
  2b:    83 ec 04                 sub    $0x4,%esp
  2e:    c7 04 24 08 00 00 00     movl   $0x8,(%esp)
  35:    e8 d6 ff ff ff           call   10 <f>
  3a:    8b 15 00 00 00 00        mov    0x0,%edx
  40:    01 d0                    add    %edx,%eax
  42:    c9                       leave  
  43:    c3                       ret    

Disassembly of section .data:

00000000 <addend1>:
   0:    01 00                    add    %eax,(%eax)
    ...

00000004 <addend2>:
   4:    02 00                    add    (%eax),%al
    ...

Disassembly of section .rodata:

00000000 <addend3>:
   0:    03 00                    add    (%eax),%eax
    ...

Disassembly of section .comment:

00000000 <.comment>:
   0:    00 47 43                 add    %al,0x43(%edi)
   3:    43                       inc    %ebx
   4:    3a 20                    cmp    (%eax),%ah
   6:    28 55 62                 sub    %dl,0x62(%ebp)
   9:    75 6e                    jne    79 <main+0x51>
   b:    74 75                    je     82 <main+0x5a>
   d:    2f                       das    
   e:    4c                       dec    %esp
   f:    69 6e 61 72 6f 20 34     imul   $0x34206f72,0x61(%esi),%ebp
  16:    2e 36 2e 33 2d 31 75     cs ss xor %cs:%ss:0x75627531,%ebp
  1d:    62 75 
  1f:    6e                       outsb  %ds:(%esi),(%dx)
  20:    74 75                    je     97 <main+0x6f>
  22:    35 29 20 34 2e           xor    $0x2e342029,%eax
  27:    36 2e 33 00              ss xor %cs:%ss:(%eax),%eax

        第四步，将目标代码编译成可执行文件， gcc -o example example.o。此时可以继续用objdump -D example > example.objdump察看，可见example.objdump文件有728行，已经加入了大量的代码，其中我们自己写的部分是：

080483b4 <g>:
 80483b4:    55                       push   %ebp
 80483b5:    89 e5                    mov    %esp,%ebp
 80483b7:    0f b7 05 10 a0 04 08     movzwl 0x804a010,%eax
 80483be:    98                       cwtl   
 80483bf:    03 45 08                 add    0x8(%ebp),%eax
 80483c2:    5d                       pop    %ebp
 80483c3:    c3                       ret    

080483c4 <f>:
 80483c4:    55                       push   %ebp
 80483c5:    89 e5                    mov    %esp,%ebp
 80483c7:    83 ec 04                 sub    $0x4,%esp
 80483ca:    a1 14 a0 04 08           mov    0x804a014,%eax
 80483cf:    03 45 08                 add    0x8(%ebp),%eax
 80483d2:    89 04 24                 mov    %eax,(%esp)
 80483d5:    e8 da ff ff ff           call   80483b4 <g>
 80483da:    c9                       leave  
 80483db:    c3                       ret    

080483dc <main>:
 80483dc:    55                       push   %ebp
 80483dd:    89 e5                    mov    %esp,%ebp
 80483df:    83 ec 04                 sub    $0x4,%esp
 80483e2:    c7 04 24 08 00 00 00     movl   $0x8,(%esp)
 80483e9:    e8 d6 ff ff ff           call   80483c4 <f>
 80483ee:    8b 15 d0 84 04 08        mov    0x80484d0,%edx
 80483f4:    01 d0                    add    %edx,%eax
 80483f6:    c9                       leave  
 80483f7:    c3                       ret    
 80483f8:    90                       nop
 80483f9:    90                       nop
 80483fa:    90                       nop
 80483fb:    90                       nop
 80483fc:    90                       nop
 80483fd:    90                       nop
 80483fe:    90                       nop
 80483ff:    90                       nop

...
...
...

Disassembly of section .data:

0804a008 <__data_start>:
 804a008:    00 00                    add    %al,(%eax)
    ...

0804a00c <__dso_handle>:
 804a00c:    00 00                    add    %al,(%eax)
    ...

0804a010 <addend1>:
 804a010:    01 00                    add    %eax,(%eax)
    ...

0804a014 <addend2>:
 804a014:    02 00                    add    (%eax),%al
    ...

Disassembly of section .bss:

0804a018 <completed.6159>:
 804a018:    00 00                    add    %al,(%eax)
    ...

0804a01c <dtor_idx.6161>:
 804a01c:    00 00                    add    %al,(%eax)
    ...

        可见此时的代码已经有了它运行时的实际地址，并且.rodata段也已经不存在了。

        然后还可以用readelf -a example > example.elf 察看该可执行文件的ELF头部信息，共221行，这里只摘录前57行：

ELF Header:
  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF32
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Intel 80386
  Version:                           0x1
  Entry point address:               0x8048300
  Start of program headers:          52 (bytes into file)
  Start of section headers:          4416 (bytes into file)
  Flags:                             0x0
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         9
  Size of section headers:           40 (bytes)
  Number of section headers:         30
  Section header string table index: 27

Section Headers:
  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
  [ 0]                   NULL            00000000 000000 000000 00      0   0  0
  [ 1] .interp           PROGBITS        08048154 000154 000013 00   A  0   0  1
  [ 2] .note.ABI-tag     NOTE            08048168 000168 000020 00   A  0   0  4
  [ 3] .note.gnu.build-i NOTE            08048188 000188 000024 00   A  0   0  4
  [ 4] .gnu.hash         GNU_HASH        080481ac 0001ac 000020 04   A  5   0  4
  [ 5] .dynsym           DYNSYM          080481cc 0001cc 000040 10   A  6   1  4
  [ 6] .dynstr           STRTAB          0804820c 00020c 000045 00   A  0   0  1
  [ 7] .gnu.version      VERSYM          08048252 000252 000008 02   A  5   0  2
  [ 8] .gnu.version_r    VERNEED         0804825c 00025c 000020 00   A  6   1  4
  [ 9] .rel.dyn          REL             0804827c 00027c 000008 08   A  5   0  4
  [10] .rel.plt          REL             08048284 000284 000010 08   A  5  12  4
  [11] .init             PROGBITS        08048294 000294 00002e 00  AX  0   0  4
  [12] .plt              PROGBITS        080482d0 0002d0 000030 04  AX  0   0 16
  [13] .text             PROGBITS        08048300 000300 0001ac 00  AX  0   0 16
  [14] .fini             PROGBITS        080484ac 0004ac 00001a 00  AX  0   0  4
  [15] .rodata           PROGBITS        080484c8 0004c8 00000c 00   A  0   0  4
  [16] .eh_frame_hdr     PROGBITS        080484d4 0004d4 00002c 00   A  0   0  4
  [17] .eh_frame         PROGBITS        08048500 000500 0000a4 00   A  0   0  4
  [18] .ctors            PROGBITS        08049f14 000f14 000008 00  WA  0   0  4
  [19] .dtors            PROGBITS        08049f1c 000f1c 000008 00  WA  0   0  4
  [20] .jcr              PROGBITS        08049f24 000f24 000004 00  WA  0   0  4
  [21] .dynamic          DYNAMIC         08049f28 000f28 0000c8 08  WA  6   0  4
  [22] .got              PROGBITS        08049ff0 000ff0 000004 04  WA  0   0  4
  [23] .got.plt          PROGBITS        08049ff4 000ff4 000014 04  WA  0   0  4
  [24] .data             PROGBITS        0804a008 001008 000010 00  WA  0   0  4
  [25] .bss              NOBITS          0804a018 001018 000008 00  WA  0   0  4
  [26] .comment          PROGBITS        00000000 001018 00002a 01  MS  0   0  1
  [27] .shstrtab         STRTAB          00000000 001042 0000fc 00      0   0  1
  [28] .symtab           SYMTAB          00000000 0015f0 000450 10     29  49  4
  [29] .strtab           STRTAB          00000000 001a40 000209 00      0   0  1
Key to Flags:
  W (write), A (alloc), X (execute), M (merge), S (strings)
  I (info), L (link order), G (group), T (TLS), E (exclude), x (unknown)
  O (extra OS processing required) o (OS specific), p (processor specific)

二、运行时堆栈分析

        为了使用gdb进行调试，用gcc - g example.c -o example重新编译代码，然后gdb example进入gdb调试。

        在main函数入口处设置断点，运行程序，然后察看运行到的汇编指令、此时的寄存器数据和堆栈：

(gdb) b 17
Breakpoint 1 at 0x80483e2: file example.c, line 17.
(gdb) r
Starting program: /home/qpx/操作系统/example 

Breakpoint 1, main () at example.c:19
19        return f(8) + addend3;
(gdb) disassemble 
Dump of assembler code for function main:
   0x080483dc <+0>:    push   %ebp
   0x080483dd <+1>:    mov    %esp,%ebp
   0x080483df <+3>:    sub    $0x4,%esp
=> 0x080483e2 <+6>:    movl   $0x8,(%esp)
   0x080483e9 <+13>:    call   0x80483c4 <f>
   0x080483ee <+18>:    mov    0x80484d0,%edx
   0x080483f4 <+24>:    add    %edx,%eax
   0x080483f6 <+26>:    leave  
   0x080483f7 <+27>:    ret    
End of assembler dump.
(gdb) info registers 
eax            0x1    1
ecx            0xbffff394    -1073745004
edx            0xbffff324    -1073745116
ebx            0xb7fc2ff4    -1208209420
esp            0xbffff2f4    0xbffff2f4
ebp            0xbffff2f8    0xbffff2f8
esi            0x0    0
edi            0x0    0
eip            0x80483e2    0x80483e2 <main+6>
eflags         0x200282    [ SF IF ID ]
cs             0x73    115
ss             0x7b    123
ds             0x7b    123
es             0x7b    123
fs             0x0    0
gs             0x33    51

  (gdb) x/2 0xbffff2f4
  0xbffff2f4: 0x000000000 x00000000

可见此时主函数的栈基址为0xbffff2f8，而%esp已经下移4字节准备为函数 f 传递参数8，但目前%esp所指堆栈内容为0，%ebp所指内容也为0。下面展示每一步时%esp、%ebp和堆栈内容的变化：

call指令将下一条指令的地址入栈：

将上一个函数的基址入栈，从当前%esp开始作为新基址：

先为传参做准备：

实参的计算在%eax中进行：

实参入栈：

call指令将下一条指令的地址入栈：

计算short+int：

pop %ebp指令将栈顶弹到%ebp中，同时%esp增加4字节：

ret指令将栈顶弹给%eip

因为函数 f 修改了%esp，所以用leave指令恢复。leave指令先将%esp对其到%ebp，然后把栈顶弹给%ebp：

 程序最终结束。