三 练习反汇编C语言程序

1） Debug版本算法反汇编，现有如下3×3矩阵相乘的程序：

#define SIZE 3
int MyFunction(int a[SIZE][SIZE],int b[SIZE][SIZE],int c[SIZE][SIZE])
{
	int i,j;
	for ( i = 0 ; i < 3 ; i++ )
	{
		for ( j = 0 ; j < 3 ; j++ )
		{
			c[i][j] = a[i][0]*b[0][j] + a[i][1]*b[1][j] + a[i][2]*b[2][j];
		}
	}
	return 0;
}

Debug版本汇编后为：

#define SIZE 3
int MyFunction(int a[SIZE][SIZE],int b[SIZE][SIZE],int c[SIZE][SIZE])
{
00401020	push		ebp
00401021	mov		ebp,esp
00401023	sub		esp,48h				;48H字节局部变量存储区
00401026	push		ebx
00401027	push		esi
00401028	push		edi
00401029	lea		edi,[ebp-48h]
0040102C	mov		ecx,12h
00401031	mov 		eax,0CCCCCCCCh
00401036	rep stos	dword ptr [edi]
	int i,j;
	for ( i = 0 ; i < 3 ; i++ )
00401038	mov		dword ptr [ebp-4],0		;ebp – 4 为局部变量i
0040103F	jmp		MyFunction+2Ah (0040104a)
00401041	mov		eax,dword ptr [ebp-4]
00401044	add		eax,1
00401047	mov		dword ptr [ebp-4],eax
0040104A	cmp		dword ptr [ebp-4],3
0040104E	jge		MyFunction+0AAh (004010ca)	;标准for循环语句
	{
		for ( j = 0 ; j < 3 ; j++ )
00401050	mov		dword ptr [ebp-8],0		;ebp – 8 为局部变量j
00401057	jmp		MyFunction+42h (00401062)
00401059	mov		ecx,dword ptr [ebp-8]
0040105C	add		ecx,1
0040105F	mov		dword ptr [ebp-8],ecx
00401062	cmp		dword ptr [ebp-8],3
00401066	jge		MyFunction+0A5h (004010c5)	;标准for循环语句
		{
			c[i][j] = a[i][0]*b[0][j] + a[i][1]*b[1][j] + a[i][2]*b[2][j];
00401068	mov		edx,dword ptr [ebp-4]		;取i值
0040106B	imul		edx,edx,0Ch			;一级偏移：第一下标[i]
0040106E	mov		eax,dword ptr [ebp+8]		;ebp+8为第1参数：数组a
00401071	mov		ecx,dword ptr [ebp-8]		;取j值
00401074	mov		esi,dword ptr [ebp+0Ch]		;ebp+C为第2参数：数组b 
00401077	mov		edx,dword ptr [eax+edx]		;a[i][0]
0040107A	imul 		edx,dword ptr [esi+ecx*4]	;a[i][0] * b[0][j] -> edx
0040107E	mov		eax,dword ptr [ebp-4]
00401081	imul		eax,eax,0Ch
00401084	mov		ecx,dword ptr [ebp+8]
00401087	mov		esi,dword ptr [ebp-8]
0040108A	mov		edi,dword ptr [ebp+0Ch]
0040108D	mov		eax,dword ptr [ecx+eax+4]	;a[i][1]
00401091	imul		eax,dword ptr [edi+esi*4+0Ch]	; a[i][1] * b[1][j] ->eax
;这里注意：0CH = b[1]–b[0] = ( 1- 0 ) * SIZE * sizeof( int )
00401096 	add		edx,eax				;edx + eax -> edx
;即edx = a[i][0] * b[0][j] + a[i][1] * b[1][j]
00401098	mov		ecx,dword ptr [ebp-4]
0040109B	imul		ecx,ecx,0Ch
0040109E	mov		eax,dword ptr [ebp+8]
004010A1	mov		esi,dword ptr [ebp-8]
004010A4	mov		edi,dword ptr [ebp+0Ch]
004010A7	mov		ecx,dword ptr [eax+ecx+8]	; a[i][2]
004010AB	imul		ecx,dword ptr [edi+esi*4+18h]	; a[i][2] * b[2][j] ->ecx
													;同上：018H = b[2]–b[0] = ( 2- 0 ) * SIZE * sizeof( int )
004010B0	add		edx,ecx				;edx + eax -> edx
								;即edx = a[i][0] * b[0][j] + a[i][1] * b[1][j] + a[i][2] * b[2][j]
004010B2	mov		eax,dword ptr [ebp-4]
004010B5	imul		eax,eax,0Ch
004010B8	mov		ecx,dword ptr [ebp+10h]		;ebp+10第3参数：数组c
004010BB	add		ecx,eax				;c[i] -> ecx
004010BD	mov		eax,dword ptr [ebp-8]
004010C0	mov		dword ptr [ecx+eax*4],edx	;edx -> c[i][j]
		}
004010C3 	jmp 		MyFunction+39h (00401059)	;内层循环
	}
004010C5	jmp		MyFunction+21h (00401041)	;外层循环
	return 0;
004010CA	xor		eax,eax				;返回0
}
004010CC	…
//省略现场恢复代码

再看看这个函数的调用，使用如下代码：

int main(void)
{
	int a[SIZE][SIZE] = {1,2,3,4,5,6,7,8,9};
	int b[SIZE][SIZE] = {9,8,7,6,5,4,3,2,1};
	int c[SIZE][SIZE];
	MyFunction(a,b,c);
	return 0;
}

对应的汇编代码为：

int main(void)
{
00401100	push		ebp				;将看到标准现场保护
00401101	mov		ebp,esp				;ebp为栈基址指针
00401103	sub		esp,0Ach				;临时取堆栈大小0ACH
00401109	push		ebx
0040110A	push		esi
0040110B	push		edi
0040110C	lea		edi,[ebp-0ACh]			;起点
00401112	mov		ecx,2Bh				;循环次数
004