D_IDA调试功能_数组

D.IDA调试功能.数组（逆向）
今天学数组。上次学了变量和函数，我想今天补充一下。上次在main函数中调用abc，函数abc执行完后又回到了main函数中的下一个指令；再调用def，函数def执行完毕又回到了main函数中的下一个指令。它是怎么实现的呢？我们观察栈。在调试中执行call指令前，注意下一个指令的地址和栈顶。用F7键跟踪执行call指令到函数内部，发现栈顶自动上移，并已经把下一个指令的地址压入到栈顶。按F8键继续执行调试，到retn指令前栈顶的数据又恢复到那个指令地址了，执行完retn后栈顶那个指令地址也出栈了。所以call指令是先把指令地址入栈再执行所调用的函数中的指令，而retn指令是根据栈顶的指令地址返回到那里去执行。

(D. Ida debugging function. Array (reverse)
I'm learning array today. I learned variables and functions last time. I want to add them today. Last time we called ABC in the main function, the function ABC returned to the next instruction in the main function. If you call def again, the next instruction in the main function will be returned after the execution of the function def. How is it implemented? We look at the stack. Before executing the call instruction in debugging, pay attention to the address of the next instruction and the top of the stack. Using F7 key to trace the call instruction to the function, it is found that the top of the stack moves up automatically, and the address of the next instruction has been pushed to the top of the stack. Press the F8 key to continue debugging, and the data at the top of the stack before the Retn instruction is restored to the instruction address. After Retn, the instruction address at the top of the stack is also out of the stack. Therefore, the call instruction first puts the instruction address into the stack, and then executes the instruction in the called function, while the Retn instruction returns there to execute according to the instruction address at the top of the stack.)

1622539398009.rar

2021-6-1 17:23 上传

文件大小: 228 KB
下载次数: 0