c - 我的堆栈帧与旧堆栈帧不同

Question

这是堆栈框架的外观:

(high memory addresses)
    -function arguments
    -return address
    -saved frame pointer
    -local variables
(low memory addresses)

问题是为什么我的堆栈帧看起来像这样:

(high memory addresses)
    -return address
    -saved frame pointer
    -local variables
    -function arguments
(low memory addresses)

我在 gdb 中调试时注意到了这一点。我用 C 语言编写代码，并在 Kali Linux x86_64(intel core i7) 上使用 gcc 5.4.0 进行编译。

C 代码:

void test_function(int a, int b, int c, int d) {
    int flag;
    char buffer[10];
    flag = 31337;
    buffer[0] = 'A';
}

int main() {
    test_function(1, 2, 3, 4);
    return 0;
}

main 中 rbp 的值:

0x7fffffffe260

test_functtion调用地址后的汇编指令:

0x00000000004004e1

在 test_function 框架中时 rsp 上 x 命令的结果:

0x7fffffffe240: 0x00000004  0x00000003  0x00000002  0x00000001
0x7fffffffe250: 0x00400441  0x00000000  0x004003b0  0x00007a69
0x7fffffffe260: 0xffffe270  0x00007fff  0x004004e1  0x00000000
0x7fffffffe270: 0x004004f0  0x00000000  0xf7a575f0  0x00007fff

Answer 1

看起来 x86 和 x86_64 之间堆栈帧的规范发生了显着变化。对于 x86 堆栈帧 ( Intel386 Processor Supplement )，您是正确的。然而，x86_64 规范 ( AMD64 Architecture Support Supplement ) 在寄存器中传递整数参数(第 3.2.3 段)。下面的第 2 项:

1. If the class is MEMORY, pass the argument on the stack.

2. If the class is INTEGER, the next available register of the sequence rdi, %rsi, %rdx, %rcx, %r8 and %r9 is used 13 .

3. If the class is SSE, the next available vector register is used, the registers are taken in the order from %xmm0 to %xmm7.

4. If the class is SSEUP, the eightbyte is passed in the next available eightbyte chunk of the last used vector register.

5. If the class is X87, X87UP or COMPLEX_X87, it is passed in memory.

堆栈框架现在看起来像这样:

如果你查看堆栈帧，main 中的返回地址是 8[%rbp] 或 0x004005be，并且参数位于正确的寄存器中:

(gdb) x/32 $rbp
0x7fffffffe040: 0xffffe050  0x00007fff  0x004005be  0x00000000
0x7fffffffe050: 0x00000000  0x00000000  0xf7a36f45  0x00007fff
0x7fffffffe060: 0x00000000  0x00000000  0xffffe138  0x00007fff
0x7fffffffe070: 0x00000000  0x00000001  0x004005a1  0x00000000
0x7fffffffe080: 0x00000000  0x00000000  0xdf5e7534  0x8acdbc8c
0x7fffffffe090: 0x00400470  0x00000000  0xffffe130  0x00007fff
0x7fffffffe0a0: 0x00000000  0x00000000  0x00000000  0x00000000
0x7fffffffe0b0: 0x1f9e7534  0x75324373  0x02a47534  0x753253ca
(gdb) info registers 
rax            0x4005a1 4195745
rbx            0x0  0
rcx            0x4  4
rdx            0x3  3
rsi            0x2  2
rdi            0x1  1
....