c - 栈帧和gdb

Question

我是逆向工程的新手。我编写了以下 C 代码来帮助我更多地了解堆栈帧。

#include <stdio.h>

int sum(int a, int b,int c)
{
        return(a+b+c);
}

int media(int a, int b,int c)
{
        int total;
        total = a + b + c;
        return (total/3);

}

int main ()
{
        int num1,num2,num3;
        char keypress[1];

        num1 = 5;
        num2 = 10;
        num3 = 15;

        printf ("\nCalling sum function\n");
        sum(num1,num2,num3);
        printf ("\nWaiting a keypress to call media function\n");
        scanf ("%c",keypress);
        media(num1,num2,num3);
        printf ("\nWaiting a keypress to end\n");
        scanf ("%c",keypress);
        return(0);
}

据我所知每次你调用一个函数创建堆栈框架(参见:ftp.gnu.org/old-gnu/Manuals/gdb/html_node/gdb_41.html)。因此，我对上述 C 代码的目标是至少看到三个堆栈帧。

1) 主函数——栈帧

2) 求和函数——栈帧

3) 媒体函数——栈帧

顺便说一句:那些 printfs 只是为了帮助我“跟随”gdb 中的程序。 =)

所以我想如果我比较程序启动后 info frame 的输出与调用 sum 函数后 info frame 的输出，我会得到不同的输出？如您所见，我没有得到它:

Temporary breakpoint 1, main () at parastack.c:27
warning: Source file is more recent than executable.
27              num1 = 5;
(gdb) nexti
28              num2 = 10;
(gdb) info frame
Stack level 0, frame at 0x7fffffffdf00:
 rip = 0x400605 in main (parastack.c:28); saved rip = 0x7ffff7a3c790
 source language c.
 Arglist at 0x7fffffffdef0, args:
 Locals at 0x7fffffffdef0, Previous frame's sp is 0x7fffffffdf00
 Saved registers:
  rbp at 0x7fffffffdef0, rip at 0x7fffffffdef8
(gdb) nexti
29              num3 = 15;
(gdb) nexti
31              printf ("\nCalling sum function\n");
(gdb) nexti
0x0000000000400618      31              printf ("\nCalling sum function\n");
(gdb) nexti

Calling sum function
32              sum(num1,num2,num3);
(gdb) info frame
Stack level 0, frame at 0x7fffffffdf00:
 rip = 0x40061d in main (parastack.c:32); saved rip = 0x7ffff7a3c790
 source language c.
 Arglist at 0x7fffffffdef0, args:
 Locals at 0x7fffffffdef0, Previous frame's sp is 0x7fffffffdf00
 Saved registers:
  rbp at 0x7fffffffdef0, rip at 0x7fffffffdef8
(gdb) nexti
0x0000000000400620      32              sum(num1,num2,num3);
(gdb) info frame
Stack level 0, frame at 0x7fffffffdf00:
 rip = 0x400620 in main (parastack.c:32); saved rip = 0x7ffff7a3c790
 source language c.
 Arglist at 0x7fffffffdef0, args:
 Locals at 0x7fffffffdef0, Previous frame's sp is 0x7fffffffdf00
 Saved registers:
  rbp at 0x7fffffffdef0, rip at 0x7fffffffdef8

Answer 1

just after sum function is called

您的问题是您实际上从未在sum 函数的内部 停止。在您打印您将要调用它之后您停止了，然后您执行了一些指令，但您从未真正登陆内部(需要一些指令来准备参数，还有一个实际调用，还有一些在函数内部设置框架)。

您应该首先在 sum 和 media 中设置断点，并在遇到这些断点时执行 info frame。您会注意到断点设置在函数开始之后的几条指令(即函数序言之后)。跳过的指令正是设置新框架的指令。

了解其工作原理后，您应该继续使用 step 和 next 命令。

然后你就可以逐步使用 disas、stepi 和 nexti 命令。