继《const修改过程》的反汇编分析

看过《神奇的const修改过程》这篇帖子的朋友也应该和我有同样的疑问
我昨天晚上做了下跟踪发现有趣的事儿

 

// const修改 // #include "stdafx.h" #include <iostream> using namespace std; int main(int argc, char* argv[]) { int tmp=4; const int i = tmp; cout<<"i="<<i<<endl; int *p = const_cast<int*>(&i); //让p指向i的首地址 *p = 99; cout<<"i="<<i<<" *p="<<*p<<endl; system("pause"); return 0; } 

还记得上面的代码吧，里面的i的值即被强行修改了

这里看看我的反汇编情况

00401790 push ebp 00401791 mov ebp,esp 00401793 sub esp,4Ch 00401796 push ebx 00401797 push esi 00401798 push edi 00401799 lea edi,[ebp-4Ch] 0040179C mov ecx,13h 004017A1 mov eax,0CCCCCCCCh 004017A6 rep stos dword ptr [edi] 8: int tmp=4; 004017A8 mov dword ptr [ebp-4],4 9: const int i = tmp; 004017AF mov eax,dword ptr [ebp-4] 004017B2 mov dword ptr [ebp-8],eax 10: cout<<"i="<<i<<endl; 004017B5 push offset @ILT+195(std::endl) (004010c8) 004017BA mov ecx,dword ptr [ebp-8] 004017BD push ecx 004017BE push offset string "i=" (0046d02c) 004017C3 push offset std::cout (00478a30) 004017C8 call @ILT+640(std::operator<<) (00401285) 004017CD add esp,8 004017D0 mov ecx,eax 004017D2 call @ILT+250(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004010ff) 004017D7 mov ecx,eax 004017D9 call @ILT+475(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004011e0) 11: int *p = const_cast<int*>(&i); //让p指向i的首地址 004017DE lea edx,[ebp-8] 004017E1 mov dword ptr [ebp-0Ch],edx 12: *p = 99; 004017E4 mov eax,dword ptr [ebp-0Ch] 004017E7 mov dword ptr [eax],63h 13: cout<<"i="<<i<<" *p="<<*p<<endl; 004017ED push offset @ILT+195(std::endl) (004010c8) 004017F2 mov ecx,dword ptr [ebp-0Ch] 004017F5 mov edx,dword ptr [ecx] 004017F7 push edx 004017F8 push offset string " *p=" (0046d024) 004017FD mov eax,dword ptr [ebp-8] 00401800 push eax 00401801 push offset string "i=" (0046d02c) 00401806 push offset std::cout (00478a30) 0040180B call @ILT+640(std::operator<<) (00401285) 00401810 add esp,8 00401813 mov ecx,eax 00401815 call @ILT+250(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004010ff) 0040181A push eax 0040181B call @ILT+640(std::operator<<) (00401285) 00401820 add esp,8 00401823 mov ecx,eax 00401825 call @ILT+250(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004010ff) 0040182A mov ecx,eax 0040182C call @ILT+475(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004011e0) 14: system("pause"); 00401831 push offset string "pause" (0046d01c) 00401836 call system (00406ea0) 0040183B add esp,4 15: return 0; 0040183E xor eax,eax 16: } 00401840 pop edi 00401841 pop esi 00401842 pop ebx 00401843 add esp,4Ch 00401846 cmp ebp,esp 00401848 call __chkesp (00406d40) 0040184D mov esp,ebp 0040184F pop ebp 00401850 ret 

这里是整个main函数的反汇编代码 由于写上了源代码所以很容易看懂
这里就直接步入主题看关键代码

8: int tmp=4; 004017A8 mov dword ptr [ebp-4],4 9: const int i = tmp; 004017AF mov eax,dword ptr [ebp-4] 004017B2 mov dword ptr [ebp-8],eax 

11: int *p = const_cast<int*>(&i); //让p指向i的首地址 004017DE lea edx,[ebp-8] 004017E1 mov dword ptr [ebp-0Ch],edx 12: *p = 99; 004017E4 mov eax,dword ptr [ebp-0Ch] 004017E7 mov dword ptr [eax],63h 

004017DE   把ebp-8的地址传给edx           // LEA  是 有效地址传送指令
004017E1   把edx的值传入ebp-0Ch        //ebp-0Ch就是指针p的装的内存地址
004017E4   把ebp-0Ch的值传入eax      
004017E7   把63h传入eax                    //63h是16进制，转换10进制是99,

 

13: cout<<"i="<<i<<" *p="<<*p<<endl; 004017ED push offset @ILT+195(std::endl) (004010c8) 004017F2 mov ecx,dword ptr [ebp-0Ch] 004017F5 mov edx,dword ptr [ecx] 004017F7 push edx 004017F8 push offset string " *p=" (0046d024) 004017FD mov eax,dword ptr [ebp-8] 00401800 push eax 00401801 push offset string "i=" (0046d02c) 00401806 push offset std::cout (00478a30) 0040180B call @ILT+640(std::operator<<) (00401285) 00401810 add esp,8 00401813 mov ecx,eax 00401815 call @ILT+250(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004010ff) 0040181A push eax 0040181B call @ILT+640(std::operator<<) (00401285) 00401820 add esp,8 00401823 mov ecx,eax 00401825 call @ILT+250(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004010ff) 0040182A mov ecx,eax 0040182C call @ILT+475(std::basic_ostream<char,std::char_traits<char> >::operator<<) (004011e0) 

 

cout 是从后往前载入的。所以第一个载入的是endl

 

//载入endl 004017ED push offset @ILT+195(std::endl) (004010c8)  

 

//载入*p的值 004017F2 mov ecx,dword ptr [ebp-0Ch] 004017F5 mov edx,dword ptr [ecx] 004017F7 push edx 

 

//载入字符串"*p=" 004017F8 push offset string " *p=" (0046d024) 

 

//载入i的值，这里他不在是直接赋值数字而是通过ebp-8 赋值给eax，然后载入eax 004017FD mov eax,dword ptr [ebp-8] 00401800 push eax 

 

最后，这里应是关键，由于最开始给常量i赋值的时候通过变量tmp中转了一下
应该就是导致为什么最后读取常量i的值的时候是读取的eax中的值  ，而不是直接读取的值