内存中栈的具体表现

最新推荐文章于 2025-11-25 11:26:09 发布

原创最新推荐文章于 2025-11-25 11:26:09 发布 · 1.2k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#汇编 #c

缓冲区溢出专栏收录该内容

4 篇文章

订阅专栏

本文通过一个简单的C语言程序，详细展示了栈在内存中的表现形式。从设置断点开始，逐步跟踪程序执行过程中的寄存器变化及内存栈的变化情况，帮助理解栈的工作原理。

栈在内存中到底是如何表现的呢？我们来做一个实例调试一下。

代码如下：

#include <stdio.h>

void main()
{
_asm
{
  push 0x12345678
  push 0x11112222
  pop eax
  pop ebx
}
}

按F9下一个断点，然后按F5进行调试。反汇编窗口如下

5:        _asm
6:        {
7:            push 0x12345678
00401028   push        12345678h
8:            push 0x11112222
0040102D   push        11112222h
9:            pop eax
00401032   pop         eax
10:           pop ebx
00401033   pop         ebx
11:       }

寄存器窗口如下：

EAX = CCCCCCCC EBX = 7FFDF000 ECX = 00000000 EDX = 00191030 ESI = 00000000

EDI = 0012FF48 EIP = 00401028 ESP = 0012FEFC EBP = 0012FF48 EFL = 00000202

EBP的地址是0012FF48，ESP的地址是0012FEFC，通过这两个值就可以找到栈

0012FEE4 00 00 00 00 02 00 00 00 30 2F ........0/

0012FEEE 42 00 83 00 00 00 E0 06 19 00 B.........
0012FEF8 1C FF 12 00 00 00 00 00 00 00 ..........
0012FF02 00 00 00 F0 FD 7F CC CC CC CC ...瘕.烫烫
0012FF0C CC CC CC CC CC CC CC CC CC CC 烫烫烫烫烫
0012FF16 CC CC CC CC CC CC CC CC CC CC 烫烫烫烫烫
0012FF20 CC CC CC CC CC CC CC CC CC CC 烫烫烫烫烫
0012FF2A CC CC CC CC CC CC CC CC CC CC 烫烫烫烫烫
0012FF34 CC CC CC CC CC CC CC CC CC CC 烫烫烫烫烫
0012FF3E CC CC CC CC CC CC CC CC CC CC 烫烫烫烫烫
0012FF48 88 FF 12 00 89 11 40 00 01 00 ......@...
0012FF52 00 00 B8 0F 19 00 30 10 19 00 ......0...

然后按F11单步执行，这时发现

EAX = CCCCCCCC EBX = 7FFDF000 ECX = 00000000 EDX = 00191030 ESI = 00000000 EDI = 0012FF48 EIP = 0040102D ESP = 0012FEF8 EBP = 0012FF48 EFL = 00000202

0012FEE4 00 00 00 00 02 00 00 00 30 2F ........0/
0012FEEE 42 00 83 00 00 00 E0 06 19 00 B.........
0012FEF8 78 56 34 12 00 00 00 00 00 00 xV4.......
0012FF02 00 00 00 F0 FD 7F CC CC CC CC ...瘕.烫烫
0012FF0C CC CC CC CC CC CC CC CC CC CC 烫烫烫烫烫
0012FF16 CC CC CC CC CC CC CC CC CC CC 烫烫烫烫烫
0012FF20 CC CC CC CC CC CC CC CC CC CC 烫烫烫烫烫
0012FF2A CC CC CC CC CC CC CC CC CC CC 烫烫烫烫烫
0012FF34 CC CC CC CC CC CC CC CC CC CC 烫烫烫烫烫
0012FF3E CC CC CC CC CC CC CC CC CC CC 烫烫烫烫烫
0012FF48 88 FF 12 00 89 11 40 00 01 00 ......@...
0012FF52 00 00 B8 0F 19 00 30 10 19 00 ......0...
0012FF5C 00 00 00 00 00 00 00 00 00 F0 ..........

然后再单步

EAX = CCCCCCCC EBX = 7FFDF000 ECX = 00000000 EDX = 00191030 ESI = 00000000 EDI = 0012FF48 EIP = 00401032 ESP = 0012FEF4 EBP = 0012FF48 EFL = 00000202

0012FEE4 00 00 00 00 02 00 00 00 30 2F ........0/
0012FEEE 42 00 83 00 00 00 22 22 11 11 B.....""..
0012FEF8 78 56 34 12 00 00 00 00 00 00 xV4.......
0012FF02 00 00 00 F0 FD 7F CC CC CC CC ...瘕.烫烫
0012FF0C CC CC CC CC CC CC CC CC CC CC 烫烫烫烫烫
0012FF16 CC CC CC CC CC CC CC CC CC CC 烫烫烫烫烫
0012FF20 CC CC CC CC CC CC CC CC CC CC 烫烫烫烫烫
0012FF2A CC CC CC CC CC CC CC CC CC CC 烫烫烫烫烫
0012FF34 CC CC CC CC CC CC CC CC CC CC 烫烫烫烫烫
0012FF3E CC CC CC CC CC CC CC CC CC CC 烫烫烫烫烫
0012FF48 88 FF 12 00 89 11 40 00 01 00 ......@...
0012FF52 00 00 B8 0F 19 00 30 10 19 00 ......0...