700 lines
69 KiB
HTML
700 lines
69 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<title>Mu - linux/stack_array.subx</title>
|
|
<meta name="Generator" content="Vim/8.2">
|
|
<meta name="plugin-version" content="vim8.1_v2">
|
|
<meta name="syntax" content="none">
|
|
<meta name="settings" content="number_lines,use_css,pre_wrap,no_foldcolumn,expand_tabs,line_ids,prevent_copy=,use_input_for_pc=fallback">
|
|
<meta name="colorscheme" content="minimal-light">
|
|
<style>
|
|
<!--
|
|
pre { white-space: pre-wrap; font-family: monospace; color: #000000; background-color: #ffffd7; }
|
|
body { font-size:12pt; font-family: monospace; color: #000000; background-color: #ffffd7; }
|
|
a { color:inherit; }
|
|
* { font-size:12pt; font-size: 1em; }
|
|
.subxComment { color: #005faf; }
|
|
.subxS1Comment { color: #0000af; }
|
|
.LineNr { }
|
|
.Normal { color: #000000; background-color: #ffffd7; padding-bottom: 1px; }
|
|
.SpecialChar { color: #d70000; }
|
|
.Constant { color: #008787; }
|
|
.CommentedCode { color: #8a8a8a; }
|
|
.subxFunction { color: #af5f00; text-decoration: underline; }
|
|
-->
|
|
</style>
|
|
|
|
<script>
|
|
<!--
|
|
|
|
/* function to open any folds containing a jumped-to line before jumping to it */
|
|
function JumpToLine()
|
|
{
|
|
var lineNum;
|
|
lineNum = window.location.hash;
|
|
lineNum = lineNum.substr(1); /* strip off '#' */
|
|
|
|
if (lineNum.indexOf('L') == -1) {
|
|
lineNum = 'L'+lineNum;
|
|
}
|
|
var lineElem = document.getElementById(lineNum);
|
|
/* Always jump to new location even if the line was hidden inside a fold, or
|
|
* we corrected the raw number to a line ID.
|
|
*/
|
|
if (lineElem) {
|
|
lineElem.scrollIntoView(true);
|
|
}
|
|
return true;
|
|
}
|
|
if ('onhashchange' in window) {
|
|
window.onhashchange = JumpToLine;
|
|
}
|
|
|
|
-->
|
|
</script>
|
|
</head>
|
|
<body onload='JumpToLine();'>
|
|
<a href='https://github.com/akkartik/mu/blob/main/linux/stack_array.subx'>https://github.com/akkartik/mu/blob/main/linux/stack_array.subx</a>
|
|
<pre id='vimCodeElement'>
|
|
<span id="L1" class="LineNr"> 1 </span>== code
|
|
<span id="L2" class="LineNr"> 2 </span>
|
|
<span id="L3" class="LineNr"> 3 </span><span class="subxComment"># Problem: create a function which pushes n zeros on the stack.</span>
|
|
<span id="L4" class="LineNr"> 4 </span><span class="subxComment"># This is not a regular function, so it won't be idiomatic.</span>
|
|
<span id="L5" class="LineNr"> 5 </span><span class="subxComment"># Registers must be properly restored.</span>
|
|
<span id="L6" class="LineNr"> 6 </span><span class="subxComment"># Registers can be spilled, but that modifies the stack and needs to be</span>
|
|
<span id="L7" class="LineNr"> 7 </span><span class="subxComment"># cleaned up.</span>
|
|
<span id="L8" class="LineNr"> 8 </span>
|
|
<span id="L9" class="LineNr"> 9 </span><span class="subxComment"># This file is kinda like a research notebook, to interactively arrive at the</span>
|
|
<span id="L10" class="LineNr"> 10 </span><span class="subxComment"># solution. Nobody should have to do this without a computer. To run it:</span>
|
|
<span id="L11" class="LineNr"> 11 </span><span class="subxComment"># $ ./translate_subx_debug 000init.linux stack_array.subx && bootstrap/bootstrap --debug --trace --dump run a.elf</span>
|
|
<span id="L12" class="LineNr"> 12 </span><span class="subxComment"># There are multiple versions. You'll need to uncomment exactly one.</span>
|
|
<span id="L13" class="LineNr"> 13 </span>
|
|
<span id="L14" class="LineNr"> 14 </span><span class="subxComment"># The final version has its own Entry, but the others share this one.</span>
|
|
<span id="L15" class="LineNr"> 15 </span><span class="CommentedCode">#? Entry:</span>
|
|
<span id="L16" class="LineNr"> 16 </span><span class="CommentedCode">#? # . prologue</span>
|
|
<span id="L17" class="LineNr"> 17 </span><span class="CommentedCode">#? 89/<- %ebp 4/r32/esp</span>
|
|
<span id="L18" class="LineNr"> 18 </span><span class="CommentedCode">#? #</span>
|
|
<span id="L19" class="LineNr"> 19 </span><span class="CommentedCode">#? 68/push 0xfcfdfeff/imm32</span>
|
|
<span id="L20" class="LineNr"> 20 </span><span class="CommentedCode">#? b8/copy-to-eax 0x34353637/imm32</span>
|
|
<span id="L21" class="LineNr"> 21 </span><span class="CommentedCode">#? $dump-stack:</span>
|
|
<span id="L22" class="LineNr"> 22 </span><span class="CommentedCode">#? (push-n-zero-bytes 0x20)</span>
|
|
<span id="L23" class="LineNr"> 23 </span><span class="CommentedCode">#? $dump-stack2:</span>
|
|
<span id="L24" class="LineNr"> 24 </span><span class="CommentedCode">#? 68/push 0x20202020/imm32</span>
|
|
<span id="L25" class="LineNr"> 25 </span><span class="CommentedCode">#? $dump-stack3:</span>
|
|
<span id="L26" class="LineNr"> 26 </span><span class="CommentedCode">#? b8/copy-to-eax 1/imm32/exit</span>
|
|
<span id="L27" class="LineNr"> 27 </span><span class="CommentedCode">#? cd/syscall 0x80/imm8</span>
|
|
<span id="L28" class="LineNr"> 28 </span>
|
|
<span id="L29" class="LineNr"> 29 </span><span class="subxComment">## 0</span>
|
|
<span id="L30" class="LineNr"> 30 </span>
|
|
<span id="L31" class="LineNr"> 31 </span><span class="CommentedCode">#? push-n-zero-bytes: # n: int</span>
|
|
<span id="L32" class="LineNr"> 32 </span><span class="CommentedCode">#? # . prologue</span>
|
|
<span id="L33" class="LineNr"> 33 </span><span class="CommentedCode">#? 55/push-ebp</span>
|
|
<span id="L34" class="LineNr"> 34 </span><span class="CommentedCode">#? 89/<- %ebp 4/r32/esp</span>
|
|
<span id="L35" class="LineNr"> 35 </span><span class="CommentedCode">#? $push-n-zero-bytes:end:</span>
|
|
<span id="L36" class="LineNr"> 36 </span><span class="CommentedCode">#? # . epilogue</span>
|
|
<span id="L37" class="LineNr"> 37 </span><span class="CommentedCode">#? 89/<- %esp 5/r32/ebp</span>
|
|
<span id="L38" class="LineNr"> 38 </span><span class="CommentedCode">#? 5d/pop-to-ebp</span>
|
|
<span id="L39" class="LineNr"> 39 </span><span class="CommentedCode">#? c3/return</span>
|
|
<span id="L40" class="LineNr"> 40 </span>
|
|
<span id="L41" class="LineNr"> 41 </span><span class="subxComment"># stack at dump-stack:</span>
|
|
<span id="L42" class="LineNr"> 42 </span><span class="subxComment"># 0 a: bdffffd0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L43" class="LineNr"> 43 </span><span class="subxComment"># 0 a: bdffffe0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L44" class="LineNr"> 44 </span><span class="subxComment"># 0 a: bdfffff0: 00000000 fcfdfeff 00000001 bf000000</span>
|
|
<span id="L45" class="LineNr"> 45 </span><span class="subxComment">#</span>
|
|
<span id="L46" class="LineNr"> 46 </span><span class="subxComment"># =></span>
|
|
<span id="L47" class="LineNr"> 47 </span><span class="subxComment">#</span>
|
|
<span id="L48" class="LineNr"> 48 </span><span class="subxComment"># stack at dump-stack3:</span>
|
|
<span id="L49" class="LineNr"> 49 </span><span class="subxComment"># 0 a: stack:</span>
|
|
<span id="L50" class="LineNr"> 50 </span><span class="subxComment"># 0 a: bdffffd0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L51" class="LineNr"> 51 </span><span class="subxComment"># 0 a: bdffffe0: 00000000 00000000 bdfffff8/ebp 090000cc/ra</span>
|
|
<span id="L52" class="LineNr"> 52 </span><span class="subxComment"># 0 a: bdfffff0: 00000004/arg fcfdfeff 00000001 bf000000</span>
|
|
<span id="L53" class="LineNr"> 53 </span>
|
|
<span id="L54" class="LineNr"> 54 </span><span class="subxComment">## 1</span>
|
|
<span id="L55" class="LineNr"> 55 </span>
|
|
<span id="L56" class="LineNr"> 56 </span><span class="CommentedCode">#? push-n-zero-bytes: # n: int</span>
|
|
<span id="L57" class="LineNr"> 57 </span><span class="CommentedCode">#? # . prologue</span>
|
|
<span id="L58" class="LineNr"> 58 </span><span class="CommentedCode">#? 55/push-ebp</span>
|
|
<span id="L59" class="LineNr"> 59 </span><span class="CommentedCode">#? 89/<- %ebp 4/r32/esp</span>
|
|
<span id="L60" class="LineNr"> 60 </span><span class="CommentedCode">#? # . save registers</span>
|
|
<span id="L61" class="LineNr"> 61 </span><span class="CommentedCode">#? 50/push-eax</span>
|
|
<span id="L62" class="LineNr"> 62 </span><span class="CommentedCode">#? $push-n-zero-bytes:end:</span>
|
|
<span id="L63" class="LineNr"> 63 </span><span class="CommentedCode">#? # . restore registers</span>
|
|
<span id="L64" class="LineNr"> 64 </span><span class="CommentedCode">#? 58/pop-to-eax</span>
|
|
<span id="L65" class="LineNr"> 65 </span><span class="CommentedCode">#? # . epilogue</span>
|
|
<span id="L66" class="LineNr"> 66 </span><span class="CommentedCode">#? 5d/pop-to-ebp</span>
|
|
<span id="L67" class="LineNr"> 67 </span><span class="CommentedCode">#? c3/return</span>
|
|
<span id="L68" class="LineNr"> 68 </span>
|
|
<span id="L69" class="LineNr"> 69 </span><span class="subxComment"># stack at dump-stack3:</span>
|
|
<span id="L70" class="LineNr"> 70 </span><span class="subxComment"># 0 a: bdffffd0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L71" class="LineNr"> 71 </span><span class="subxComment"># 0 a: bdffffe0: 00000000 34353637 bdfffff8 090000d1</span>
|
|
<span id="L72" class="LineNr"> 72 </span><span class="subxComment"># 0 a: bdfffff0: 00000004 fcfdfeff 00000001 bf000000</span>
|
|
<span id="L73" class="LineNr"> 73 </span>
|
|
<span id="L74" class="LineNr"> 74 </span><span class="subxComment">## 2</span>
|
|
<span id="L75" class="LineNr"> 75 </span>
|
|
<span id="L76" class="LineNr"> 76 </span><span class="CommentedCode">#? push-n-zero-bytes: # n: int</span>
|
|
<span id="L77" class="LineNr"> 77 </span><span class="CommentedCode">#? # . prologue</span>
|
|
<span id="L78" class="LineNr"> 78 </span><span class="CommentedCode">#? 55/push-ebp</span>
|
|
<span id="L79" class="LineNr"> 79 </span><span class="CommentedCode">#? 89/<- %ebp 4/r32/esp</span>
|
|
<span id="L80" class="LineNr"> 80 </span><span class="CommentedCode">#? # . save registers</span>
|
|
<span id="L81" class="LineNr"> 81 </span><span class="CommentedCode">#? 50/push-eax</span>
|
|
<span id="L82" class="LineNr"> 82 </span><span class="CommentedCode">#? #</span>
|
|
<span id="L83" class="LineNr"> 83 </span><span class="CommentedCode">#? 8b/-> *(esp+8) 0/r32/eax</span>
|
|
<span id="L84" class="LineNr"> 84 </span><span class="CommentedCode">#? 2b/subtract *(ebp+8) 4/r32/esp</span>
|
|
<span id="L85" class="LineNr"> 85 </span><span class="CommentedCode">#? 89/<- *(esp+8) 0/r32/eax</span>
|
|
<span id="L86" class="LineNr"> 86 </span><span class="CommentedCode">#? $push-n-zero-bytes:end:</span>
|
|
<span id="L87" class="LineNr"> 87 </span><span class="CommentedCode">#? # . restore registers</span>
|
|
<span id="L88" class="LineNr"> 88 </span><span class="CommentedCode">#? 58/pop-to-eax</span>
|
|
<span id="L89" class="LineNr"> 89 </span><span class="CommentedCode">#? # . epilogue</span>
|
|
<span id="L90" class="LineNr"> 90 </span><span class="CommentedCode">#? 5d/pop-to-ebp</span>
|
|
<span id="L91" class="LineNr"> 91 </span><span class="CommentedCode">#? c3/return</span>
|
|
<span id="L92" class="LineNr"> 92 </span>
|
|
<span id="L93" class="LineNr"> 93 </span><span class="subxComment"># stack at dump-stack3:</span>
|
|
<span id="L94" class="LineNr"> 94 </span><span class="subxComment"># 0 a: bdffff90: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L95" class="LineNr"> 95 </span><span class="subxComment"># 0 a: bdffffa0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L96" class="LineNr"> 96 </span><span class="subxComment"># 0 a: bdffffb0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L97" class="LineNr"> 97 </span><span class="subxComment"># 0 a: bdffffc0: 00000000 00000000 00000000 090000d1</span>
|
|
<span id="L98" class="LineNr"> 98 </span><span class="subxComment"># 0 a: bdffffd0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L99" class="LineNr"> 99 </span><span class="subxComment"># 0 a: bdffffe0: 00000000 34353637 bdfffff8 090000d1</span>
|
|
<span id="L100" class="LineNr">100 </span><span class="subxComment"># 0 a: bdfffff0: 00000020 fcfdfeff 00000001 bf000000</span>
|
|
<span id="L101" class="LineNr">101 </span>
|
|
<span id="L102" class="LineNr">102 </span><span class="subxComment">## 3</span>
|
|
<span id="L103" class="LineNr">103 </span>
|
|
<span id="L104" class="LineNr">104 </span><span class="CommentedCode">#? push-n-zero-bytes: # n: int</span>
|
|
<span id="L105" class="LineNr">105 </span><span class="CommentedCode">#? # . prologue</span>
|
|
<span id="L106" class="LineNr">106 </span><span class="CommentedCode">#? 55/push-ebp</span>
|
|
<span id="L107" class="LineNr">107 </span><span class="CommentedCode">#? 89/<- %ebp 4/r32/esp</span>
|
|
<span id="L108" class="LineNr">108 </span><span class="CommentedCode">#? # . save registers</span>
|
|
<span id="L109" class="LineNr">109 </span><span class="CommentedCode">#? # -- esp = ebp</span>
|
|
<span id="L110" class="LineNr">110 </span><span class="CommentedCode">#? 50/push-eax</span>
|
|
<span id="L111" class="LineNr">111 </span><span class="CommentedCode">#? # -- esp+8 = ebp+4</span>
|
|
<span id="L112" class="LineNr">112 </span><span class="CommentedCode">#? 8b/-> *(esp+8) 0/r32/eax</span>
|
|
<span id="L113" class="LineNr">113 </span><span class="CommentedCode">#? 2b/subtract *(ebp+8) 4/r32/esp</span>
|
|
<span id="L114" class="LineNr">114 </span><span class="CommentedCode">#? 89/<- *(esp+8) 0/r32/eax</span>
|
|
<span id="L115" class="LineNr">115 </span><span class="CommentedCode">#? c7 0/subop/copy *(ebp+4) 0/imm32</span>
|
|
<span id="L116" class="LineNr">116 </span><span class="CommentedCode">#? $push-n-zero-bytes:end:</span>
|
|
<span id="L117" class="LineNr">117 </span><span class="CommentedCode">#? # . restore registers</span>
|
|
<span id="L118" class="LineNr">118 </span><span class="CommentedCode">#? 58/pop-to-eax</span>
|
|
<span id="L119" class="LineNr">119 </span><span class="CommentedCode">#? # . epilogue</span>
|
|
<span id="L120" class="LineNr">120 </span><span class="CommentedCode">#? 5d/pop-to-ebp</span>
|
|
<span id="L121" class="LineNr">121 </span><span class="CommentedCode">#? c3/return</span>
|
|
<span id="L122" class="LineNr">122 </span>
|
|
<span id="L123" class="LineNr">123 </span><span class="subxComment"># stack at dump-stack3:</span>
|
|
<span id="L124" class="LineNr">124 </span><span class="subxComment"># 0 a: bdffff90: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L125" class="LineNr">125 </span><span class="subxComment"># 0 a: bdffffa0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L126" class="LineNr">126 </span><span class="subxComment"># 0 a: bdffffb0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L127" class="LineNr">127 </span><span class="subxComment"># 0 a: bdffffc0: 00000000 00000000 00000000 090000d1</span>
|
|
<span id="L128" class="LineNr">128 </span><span class="subxComment"># 0 a: bdffffd0: 20202020 00000000 00000000 00000000</span>
|
|
<span id="L129" class="LineNr">129 </span><span class="subxComment"># 0 a: bdffffe0: 00000000 34353637 bdfffff8 00000000</span>
|
|
<span id="L130" class="LineNr">130 </span><span class="subxComment"># 0 a: bdfffff0: 00000020 fcfdfeff 00000001 bf000000</span>
|
|
<span id="L131" class="LineNr">131 </span>
|
|
<span id="L132" class="LineNr">132 </span><span class="subxComment">## 4</span>
|
|
<span id="L133" class="LineNr">133 </span>
|
|
<span id="L134" class="LineNr">134 </span><span class="CommentedCode">#? push-n-zero-bytes: # n: int</span>
|
|
<span id="L135" class="LineNr">135 </span><span class="CommentedCode">#? # . prologue</span>
|
|
<span id="L136" class="LineNr">136 </span><span class="CommentedCode">#? 55/push-ebp</span>
|
|
<span id="L137" class="LineNr">137 </span><span class="CommentedCode">#? 89/<- %ebp 4/r32/esp</span>
|
|
<span id="L138" class="LineNr">138 </span><span class="CommentedCode">#? # . save registers</span>
|
|
<span id="L139" class="LineNr">139 </span><span class="CommentedCode">#? # -- esp = ebp</span>
|
|
<span id="L140" class="LineNr">140 </span><span class="CommentedCode">#? 50/push-eax</span>
|
|
<span id="L141" class="LineNr">141 </span><span class="CommentedCode">#? # copy return address over</span>
|
|
<span id="L142" class="LineNr">142 </span><span class="CommentedCode">#? # -- esp+8 = ebp+4</span>
|
|
<span id="L143" class="LineNr">143 </span><span class="CommentedCode">#? 8b/-> *(esp+8) 0/r32/eax</span>
|
|
<span id="L144" class="LineNr">144 </span><span class="CommentedCode">#? 2b/subtract *(ebp+8) 4/r32/esp</span>
|
|
<span id="L145" class="LineNr">145 </span><span class="CommentedCode">#? 89/<- *(esp+8) 0/r32/eax</span>
|
|
<span id="L146" class="LineNr">146 </span><span class="CommentedCode">#? 58/pop-to-eax</span>
|
|
<span id="L147" class="LineNr">147 </span><span class="CommentedCode">#? c7 0/subop/copy *(ebp+8) 0/imm32</span>
|
|
<span id="L148" class="LineNr">148 </span><span class="CommentedCode">#? c7 0/subop/copy *(ebp+4) 0/imm32</span>
|
|
<span id="L149" class="LineNr">149 </span><span class="CommentedCode">#? c7 0/subop/copy *(ebp+0) 0/imm32</span>
|
|
<span id="L150" class="LineNr">150 </span><span class="CommentedCode">#? c7 0/subop/copy *(ebp-4) 0/imm32</span>
|
|
<span id="L151" class="LineNr">151 </span><span class="CommentedCode">#? # . epilogue</span>
|
|
<span id="L152" class="LineNr">152 </span><span class="CommentedCode">#? 5d/pop-to-ebp</span>
|
|
<span id="L153" class="LineNr">153 </span><span class="CommentedCode">#? c3/return</span>
|
|
<span id="L154" class="LineNr">154 </span>
|
|
<span id="L155" class="LineNr">155 </span><span class="subxComment"># stack at dump-stack3:</span>
|
|
<span id="L156" class="LineNr">156 </span><span class="subxComment"># 0 a: bdffff90: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L157" class="LineNr">157 </span><span class="subxComment"># 0 a: bdffffa0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L158" class="LineNr">158 </span><span class="subxComment"># 0 a: bdffffb0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L159" class="LineNr">159 </span><span class="subxComment"># 0 a: bdffffc0: 00000000 00000000 00000000 090000d1</span>
|
|
<span id="L160" class="LineNr">160 </span><span class="subxComment"># 0 a: bdffffd0: 20202020 00000000 00000000 00000000</span>
|
|
<span id="L161" class="LineNr">161 </span><span class="subxComment"># 0 a: bdffffe0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L162" class="LineNr">162 </span><span class="subxComment"># 0 a: bdfffff0: 00000000 fcfdfeff 00000001 bf000000</span>
|
|
<span id="L163" class="LineNr">163 </span>
|
|
<span id="L164" class="LineNr">164 </span><span class="subxComment"># Stack looks good now (the 20202020 marks where the array length 0x20 will</span>
|
|
<span id="L165" class="LineNr">165 </span><span class="subxComment"># go, and the next 0x20 bytes show the space for the array has been zeroed</span>
|
|
<span id="L166" class="LineNr">166 </span><span class="subxComment"># out).</span>
|
|
<span id="L167" class="LineNr">167 </span><span class="subxComment"># Final issue: ebp has been clobbered on return.</span>
|
|
<span id="L168" class="LineNr">168 </span>
|
|
<span id="L169" class="LineNr">169 </span><span class="subxComment">## 5</span>
|
|
<span id="L170" class="LineNr">170 </span>
|
|
<span id="L171" class="LineNr">171 </span><span class="subxComment"># I'd like to translate ebp to esp so we can stop pushing ebp. But we need to</span>
|
|
<span id="L172" class="LineNr">172 </span><span class="subxComment"># hold 'n' somewhere, which would require a register, which we then need to</span>
|
|
<span id="L173" class="LineNr">173 </span><span class="subxComment"># push.</span>
|
|
<span id="L174" class="LineNr">174 </span>
|
|
<span id="L175" class="LineNr">175 </span><span class="CommentedCode">#? push-n-zero-bytes: # n: int</span>
|
|
<span id="L176" class="LineNr">176 </span><span class="CommentedCode">#? 55/push-ebp</span>
|
|
<span id="L177" class="LineNr">177 </span><span class="CommentedCode">#? 89/<- %ebp 4/r32/esp</span>
|
|
<span id="L178" class="LineNr">178 </span><span class="CommentedCode">#? # -- esp = ebp</span>
|
|
<span id="L179" class="LineNr">179 </span><span class="CommentedCode">#? 50/push-eax</span>
|
|
<span id="L180" class="LineNr">180 </span><span class="CommentedCode">#? $push-n-zero-bytes:bulk-cleaning:</span>
|
|
<span id="L181" class="LineNr">181 </span><span class="CommentedCode">#? $push-n-zero-bytes:copy-ra:</span>
|
|
<span id="L182" class="LineNr">182 </span><span class="CommentedCode">#? # -- esp+8 = ebp+4</span>
|
|
<span id="L183" class="LineNr">183 </span><span class="CommentedCode">#? 8b/-> *(esp+8) 0/r32/eax</span>
|
|
<span id="L184" class="LineNr">184 </span><span class="CommentedCode">#? 2b/subtract *(esp+0xc) 4/r32/esp</span>
|
|
<span id="L185" class="LineNr">185 </span><span class="CommentedCode">#? # -- esp+8+n = ebp+4</span>
|
|
<span id="L186" class="LineNr">186 </span><span class="CommentedCode">#? 89/<- *(esp+8) 0/r32/eax</span>
|
|
<span id="L187" class="LineNr">187 </span><span class="CommentedCode">#? 58/pop-to-eax</span>
|
|
<span id="L188" class="LineNr">188 </span><span class="CommentedCode">#? # -- esp+n = ebp</span>
|
|
<span id="L189" class="LineNr">189 </span><span class="CommentedCode">#? $push-n-zero-bytes:spot-cleaning:</span>
|
|
<span id="L190" class="LineNr">190 </span><span class="CommentedCode">#? c7 0/subop/copy *(ebp+8) 0/imm32</span>
|
|
<span id="L191" class="LineNr">191 </span><span class="CommentedCode">#? c7 0/subop/copy *(ebp+4) 0/imm32</span>
|
|
<span id="L192" class="LineNr">192 </span><span class="CommentedCode">#? c7 0/subop/copy *(ebp+0) 0/imm32</span>
|
|
<span id="L193" class="LineNr">193 </span><span class="CommentedCode">#? c7 0/subop/copy *(ebp-4) 0/imm32</span>
|
|
<span id="L194" class="LineNr">194 </span><span class="CommentedCode">#? 5d/pop-to-ebp</span>
|
|
<span id="L195" class="LineNr">195 </span><span class="CommentedCode">#? c3/return</span>
|
|
<span id="L196" class="LineNr">196 </span>
|
|
<span id="L197" class="LineNr">197 </span><span class="subxComment"># stack at dump-stack3:</span>
|
|
<span id="L198" class="LineNr">198 </span><span class="subxComment"># 0 a: bdffff90: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L199" class="LineNr">199 </span><span class="subxComment"># 0 a: bdffffa0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L200" class="LineNr">200 </span><span class="subxComment"># 0 a: bdffffb0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L201" class="LineNr">201 </span><span class="subxComment"># 0 a: bdffffc0: 00000000 00000000 00000000 090000d1</span>
|
|
<span id="L202" class="LineNr">202 </span><span class="subxComment"># 0 a: bdffffd0: 20202020 00000000 00000000 00000000</span>
|
|
<span id="L203" class="LineNr">203 </span><span class="subxComment"># 0 a: bdffffe0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L204" class="LineNr">204 </span><span class="subxComment"># 0 a: bdfffff0: 00000000 fcfdfeff 00000001 bf000000</span>
|
|
<span id="L205" class="LineNr">205 </span>
|
|
<span id="L206" class="LineNr">206 </span><span class="subxComment"># Bah. May be simpler to just create a new segment of global space for this</span>
|
|
<span id="L207" class="LineNr">207 </span><span class="subxComment"># function.</span>
|
|
<span id="L208" class="LineNr">208 </span>
|
|
<span id="L209" class="LineNr">209 </span><span class="subxComment">## 6</span>
|
|
<span id="L210" class="LineNr">210 </span>
|
|
<span id="L211" class="LineNr">211 </span><span class="CommentedCode">#? push-n-zero-bytes: # n: int</span>
|
|
<span id="L212" class="LineNr">212 </span><span class="CommentedCode">#? 89/<- *Push-n-zero-bytes-ebp 5/r32/ebp # spill ebp without affecting stack</span>
|
|
<span id="L213" class="LineNr">213 </span><span class="CommentedCode">#? 89/<- %ebp 4/r32/esp</span>
|
|
<span id="L214" class="LineNr">214 </span><span class="CommentedCode">#? # -- esp = ebp</span>
|
|
<span id="L215" class="LineNr">215 </span><span class="CommentedCode">#? 50/push-eax</span>
|
|
<span id="L216" class="LineNr">216 </span><span class="CommentedCode">#? $push-n-zero-bytes:bulk-cleaning:</span>
|
|
<span id="L217" class="LineNr">217 </span><span class="CommentedCode">#? $push-n-zero-bytes:copy-ra:</span>
|
|
<span id="L218" class="LineNr">218 </span><span class="CommentedCode">#? # -- esp+8 = ebp+4</span>
|
|
<span id="L219" class="LineNr">219 </span><span class="CommentedCode">#? # -- esp+4 = ebp</span>
|
|
<span id="L220" class="LineNr">220 </span><span class="CommentedCode">#? 8b/-> *(esp+4) 0/r32/eax</span>
|
|
<span id="L221" class="LineNr">221 </span><span class="CommentedCode">#? 2b/subtract *(ebp+4) 4/r32/esp</span>
|
|
<span id="L222" class="LineNr">222 </span><span class="CommentedCode">#? # -- esp+4+n = ebp</span>
|
|
<span id="L223" class="LineNr">223 </span><span class="CommentedCode">#? 89/<- *(esp+4) 0/r32/eax</span>
|
|
<span id="L224" class="LineNr">224 </span><span class="CommentedCode">#? 58/pop-to-eax</span>
|
|
<span id="L225" class="LineNr">225 </span><span class="CommentedCode">#? # -- esp+n = ebp</span>
|
|
<span id="L226" class="LineNr">226 </span><span class="CommentedCode">#? $push-n-zero-bytes:spot-cleaning:</span>
|
|
<span id="L227" class="LineNr">227 </span><span class="CommentedCode">#? c7 0/subop/copy *(ebp+4) 0/imm32</span>
|
|
<span id="L228" class="LineNr">228 </span><span class="CommentedCode">#? c7 0/subop/copy *(ebp+0) 0/imm32</span>
|
|
<span id="L229" class="LineNr">229 </span><span class="CommentedCode">#? c7 0/subop/copy *(ebp-4) 0/imm32</span>
|
|
<span id="L230" class="LineNr">230 </span><span class="CommentedCode">#? c7 0/subop/copy *(ebp-8) 0/imm32</span>
|
|
<span id="L231" class="LineNr">231 </span><span class="CommentedCode">#? 8b/-> *Push-n-zero-bytes-ebp 5/r32/ebp # restore spill</span>
|
|
<span id="L232" class="LineNr">232 </span><span class="CommentedCode">#? c3/return</span>
|
|
<span id="L233" class="LineNr">233 </span><span class="CommentedCode">#? </span>
|
|
<span id="L234" class="LineNr">234 </span><span class="CommentedCode">#? == data</span>
|
|
<span id="L235" class="LineNr">235 </span><span class="CommentedCode">#? Push-n-zero-bytes-ebp: # (addr int)</span>
|
|
<span id="L236" class="LineNr">236 </span><span class="CommentedCode">#? 0/imm32</span>
|
|
<span id="L237" class="LineNr">237 </span><span class="CommentedCode">#? == code</span>
|
|
<span id="L238" class="LineNr">238 </span>
|
|
<span id="L239" class="LineNr">239 </span><span class="subxComment"># stack at dump-stack3:</span>
|
|
<span id="L240" class="LineNr">240 </span><span class="subxComment"># 0 a: bdffff90: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L241" class="LineNr">241 </span><span class="subxComment"># 0 a: bdffffa0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L242" class="LineNr">242 </span><span class="subxComment"># 0 a: bdffffb0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L243" class="LineNr">243 </span><span class="subxComment"># 0 a: bdffffc0: 00000000 00000000 00000000 090000d1</span>
|
|
<span id="L244" class="LineNr">244 </span><span class="subxComment"># 0 a: bdffffd0: 20202020 00000000 00000000 00000000</span>
|
|
<span id="L245" class="LineNr">245 </span><span class="subxComment"># 0 a: bdffffe0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L246" class="LineNr">246 </span><span class="subxComment"># 0 a: bdfffff0: 00000000 fcfdfeff 00000001 bf000000</span>
|
|
<span id="L247" class="LineNr">247 </span>
|
|
<span id="L248" class="LineNr">248 </span><span class="subxComment"># Ok, we're there. Now start using zero-out rather than spot-cleaning.</span>
|
|
<span id="L249" class="LineNr">249 </span>
|
|
<span id="L250" class="LineNr">250 </span><span class="subxComment">## 7: we need to zero out the return address, but we can't do it inside the function.</span>
|
|
<span id="L251" class="LineNr">251 </span><span class="subxComment">## So we'll change the signature slightly.</span>
|
|
<span id="L252" class="LineNr">252 </span><span class="subxComment">## Before: clear N bytes and then push N as the array length.</span>
|
|
<span id="L253" class="LineNr">253 </span><span class="subxComment">## After: clear N bytes, set *esp to N.</span>
|
|
<span id="L254" class="LineNr">254 </span><span class="subxComment">## The helper adds and clears N bytes *before* esp. esp can't be cleared since</span>
|
|
<span id="L255" class="LineNr">255 </span><span class="subxComment">## it contains the return address.</span>
|
|
<span id="L256" class="LineNr">256 </span>
|
|
<span id="L257" class="LineNr">257 </span><span class="CommentedCode">#? Entry:</span>
|
|
<span id="L258" class="LineNr">258 </span><span class="CommentedCode">#? # . prologue</span>
|
|
<span id="L259" class="LineNr">259 </span><span class="CommentedCode">#? 89/<- %ebp 4/r32/esp</span>
|
|
<span id="L260" class="LineNr">260 </span><span class="CommentedCode">#? #</span>
|
|
<span id="L261" class="LineNr">261 </span><span class="CommentedCode">#? 68/push 0xfcfdfeff/imm32</span>
|
|
<span id="L262" class="LineNr">262 </span><span class="CommentedCode">#? b8/copy-to-eax 0x34353637/imm32</span>
|
|
<span id="L263" class="LineNr">263 </span><span class="CommentedCode">#? $dump-stack0:</span>
|
|
<span id="L264" class="LineNr">264 </span><span class="CommentedCode">#? (push-n-zero-bytes 0x20)</span>
|
|
<span id="L265" class="LineNr">265 </span><span class="CommentedCode">#? $dump-stack9:</span>
|
|
<span id="L266" class="LineNr">266 </span><span class="CommentedCode">#? c7 0/subop/copy *esp 0x20/imm32</span>
|
|
<span id="L267" class="LineNr">267 </span><span class="CommentedCode">#? $dump-stacka:</span>
|
|
<span id="L268" class="LineNr">268 </span><span class="CommentedCode">#? b8/copy-to-eax 1/imm32/exit</span>
|
|
<span id="L269" class="LineNr">269 </span><span class="CommentedCode">#? cd/syscall 0x80/imm8</span>
|
|
<span id="L270" class="LineNr">270 </span><span class="CommentedCode">#? </span>
|
|
<span id="L271" class="LineNr">271 </span><span class="CommentedCode">#? push-n-zero-bytes: # n: int</span>
|
|
<span id="L272" class="LineNr">272 </span><span class="CommentedCode">#? $push-n-zero-bytes:prologue:</span>
|
|
<span id="L273" class="LineNr">273 </span><span class="CommentedCode">#? 89/<- *Push-n-zero-bytes-ebp 5/r32/ebp # spill ebp without affecting stack</span>
|
|
<span id="L274" class="LineNr">274 </span><span class="CommentedCode">#? 89/<- %ebp 4/r32/esp</span>
|
|
<span id="L275" class="LineNr">275 </span><span class="CommentedCode">#? $push-n-zero-bytes:copy-ra:</span>
|
|
<span id="L276" class="LineNr">276 </span><span class="CommentedCode">#? $dump-stack1:</span>
|
|
<span id="L277" class="LineNr">277 </span><span class="CommentedCode">#? # -- esp = ebp</span>
|
|
<span id="L278" class="LineNr">278 </span><span class="CommentedCode">#? 50/push-eax</span>
|
|
<span id="L279" class="LineNr">279 </span><span class="CommentedCode">#? $dump-stack2:</span>
|
|
<span id="L280" class="LineNr">280 </span><span class="CommentedCode">#? # -- esp+8 = ebp+4</span>
|
|
<span id="L281" class="LineNr">281 </span><span class="CommentedCode">#? # -- esp+4 = ebp</span>
|
|
<span id="L282" class="LineNr">282 </span><span class="CommentedCode">#? 8b/-> *(esp+4) 0/r32/eax</span>
|
|
<span id="L283" class="LineNr">283 </span><span class="CommentedCode">#? $dump-stack3:</span>
|
|
<span id="L284" class="LineNr">284 </span><span class="CommentedCode">#? 2b/subtract *(ebp+4) 4/r32/esp</span>
|
|
<span id="L285" class="LineNr">285 </span><span class="CommentedCode">#? $dump-stack4:</span>
|
|
<span id="L286" class="LineNr">286 </span><span class="CommentedCode">#? # -- esp+4+n = ebp</span>
|
|
<span id="L287" class="LineNr">287 </span><span class="CommentedCode">#? 89/<- *(esp+4) 0/r32/eax</span>
|
|
<span id="L288" class="LineNr">288 </span><span class="CommentedCode">#? $dump-stack5:</span>
|
|
<span id="L289" class="LineNr">289 </span><span class="CommentedCode">#? 58/pop-to-eax</span>
|
|
<span id="L290" class="LineNr">290 </span><span class="CommentedCode">#? # -- esp+n = ebp</span>
|
|
<span id="L291" class="LineNr">291 </span><span class="CommentedCode">#? $push-n-zero-bytes:bulk-cleaning:</span>
|
|
<span id="L292" class="LineNr">292 </span><span class="CommentedCode">#? $dump-stack6:</span>
|
|
<span id="L293" class="LineNr">293 </span><span class="CommentedCode">#? 89/<- *Push-n-zero-bytes-esp 4/r32/esp</span>
|
|
<span id="L294" class="LineNr">294 </span><span class="CommentedCode">#? 81 0/subop/add *Push-n-zero-bytes-esp 4/imm32</span>
|
|
<span id="L295" class="LineNr">295 </span><span class="CommentedCode">#? $dump-stack7:</span>
|
|
<span id="L296" class="LineNr">296 </span><span class="CommentedCode">#? (zero-out *Push-n-zero-bytes-esp *(ebp+4)) # n</span>
|
|
<span id="L297" class="LineNr">297 </span><span class="CommentedCode">#? $push-n-zero-bytes:epilogue:</span>
|
|
<span id="L298" class="LineNr">298 </span><span class="CommentedCode">#? $dump-stack8:</span>
|
|
<span id="L299" class="LineNr">299 </span><span class="CommentedCode">#? 8b/-> *Push-n-zero-bytes-ebp 5/r32/ebp # restore spill</span>
|
|
<span id="L300" class="LineNr">300 </span><span class="CommentedCode">#? c3/return</span>
|
|
<span id="L301" class="LineNr">301 </span><span class="CommentedCode">#? </span>
|
|
<span id="L302" class="LineNr">302 </span><span class="CommentedCode">#? zero-out: # start: (addr byte), len: int</span>
|
|
<span id="L303" class="LineNr">303 </span><span class="CommentedCode">#? # pseudocode:</span>
|
|
<span id="L304" class="LineNr">304 </span><span class="CommentedCode">#? # curr/esi = start</span>
|
|
<span id="L305" class="LineNr">305 </span><span class="CommentedCode">#? # i/ecx = 0</span>
|
|
<span id="L306" class="LineNr">306 </span><span class="CommentedCode">#? # while true</span>
|
|
<span id="L307" class="LineNr">307 </span><span class="CommentedCode">#? # if (i >= len) break</span>
|
|
<span id="L308" class="LineNr">308 </span><span class="CommentedCode">#? # *curr = 0</span>
|
|
<span id="L309" class="LineNr">309 </span><span class="CommentedCode">#? # ++curr</span>
|
|
<span id="L310" class="LineNr">310 </span><span class="CommentedCode">#? # ++i</span>
|
|
<span id="L311" class="LineNr">311 </span><span class="CommentedCode">#? #</span>
|
|
<span id="L312" class="LineNr">312 </span><span class="CommentedCode">#? # . prologue</span>
|
|
<span id="L313" class="LineNr">313 </span><span class="CommentedCode">#? 55/push-ebp</span>
|
|
<span id="L314" class="LineNr">314 </span><span class="CommentedCode">#? 89/copy 3/mod/direct 5/rm32/ebp . . . 4/r32/esp . . # copy esp to ebp</span>
|
|
<span id="L315" class="LineNr">315 </span><span class="CommentedCode">#? # . save registers</span>
|
|
<span id="L316" class="LineNr">316 </span><span class="CommentedCode">#? 50/push-eax</span>
|
|
<span id="L317" class="LineNr">317 </span><span class="CommentedCode">#? 51/push-ecx</span>
|
|
<span id="L318" class="LineNr">318 </span><span class="CommentedCode">#? 52/push-edx</span>
|
|
<span id="L319" class="LineNr">319 </span><span class="CommentedCode">#? 56/push-esi</span>
|
|
<span id="L320" class="LineNr">320 </span><span class="CommentedCode">#? # curr/esi = start</span>
|
|
<span id="L321" class="LineNr">321 </span><span class="CommentedCode">#? 8b/copy 1/mod/*+disp8 5/rm32/ebp . . . 6/r32/esi 8/disp8 . # copy *(ebp+8) to esi</span>
|
|
<span id="L322" class="LineNr">322 </span><span class="CommentedCode">#? # var i/ecx: int = 0</span>
|
|
<span id="L323" class="LineNr">323 </span><span class="CommentedCode">#? 31/xor 3/mod/direct 1/rm32/ecx . . . 1/r32/ecx . . # clear ecx</span>
|
|
<span id="L324" class="LineNr">324 </span><span class="CommentedCode">#? # edx = len</span>
|
|
<span id="L325" class="LineNr">325 </span><span class="CommentedCode">#? 8b/copy 1/mod/*+disp8 5/rm32/ebp . . . 2/r32/edx 0xc/disp8 . # copy *(ebp+12) to edx</span>
|
|
<span id="L326" class="LineNr">326 </span><span class="CommentedCode">#? $zero-out:loop:</span>
|
|
<span id="L327" class="LineNr">327 </span><span class="CommentedCode">#? # if (i >= len) break</span>
|
|
<span id="L328" class="LineNr">328 </span><span class="CommentedCode">#? 39/compare 3/mod/direct 1/rm32/ecx . . . 2/r32/edx . . # compare ecx with edx</span>
|
|
<span id="L329" class="LineNr">329 </span><span class="CommentedCode">#? 7d/jump-if->= $zero-out:end/disp8</span>
|
|
<span id="L330" class="LineNr">330 </span><span class="CommentedCode">#? # *curr = 0</span>
|
|
<span id="L331" class="LineNr">331 </span><span class="CommentedCode">#? c6 0/subop/copy 0/mod/direct 6/rm32/esi . . . . . 0/imm8 # copy byte to *esi</span>
|
|
<span id="L332" class="LineNr">332 </span><span class="CommentedCode">#? # ++curr</span>
|
|
<span id="L333" class="LineNr">333 </span><span class="CommentedCode">#? 46/increment-esi</span>
|
|
<span id="L334" class="LineNr">334 </span><span class="CommentedCode">#? # ++i</span>
|
|
<span id="L335" class="LineNr">335 </span><span class="CommentedCode">#? 41/increment-ecx</span>
|
|
<span id="L336" class="LineNr">336 </span><span class="CommentedCode">#? eb/jump $zero-out:loop/disp8</span>
|
|
<span id="L337" class="LineNr">337 </span><span class="CommentedCode">#? $zero-out:end:</span>
|
|
<span id="L338" class="LineNr">338 </span><span class="CommentedCode">#? # . restore registers</span>
|
|
<span id="L339" class="LineNr">339 </span><span class="CommentedCode">#? 5e/pop-to-esi</span>
|
|
<span id="L340" class="LineNr">340 </span><span class="CommentedCode">#? 5a/pop-to-edx</span>
|
|
<span id="L341" class="LineNr">341 </span><span class="CommentedCode">#? 59/pop-to-ecx</span>
|
|
<span id="L342" class="LineNr">342 </span><span class="CommentedCode">#? 58/pop-to-eax</span>
|
|
<span id="L343" class="LineNr">343 </span><span class="CommentedCode">#? # . epilogue</span>
|
|
<span id="L344" class="LineNr">344 </span><span class="CommentedCode">#? 89/copy 3/mod/direct 4/rm32/esp . . . 5/r32/ebp . . # copy ebp to esp</span>
|
|
<span id="L345" class="LineNr">345 </span><span class="CommentedCode">#? 5d/pop-to-ebp</span>
|
|
<span id="L346" class="LineNr">346 </span><span class="CommentedCode">#? c3/return</span>
|
|
<span id="L347" class="LineNr">347 </span><span class="CommentedCode">#? </span>
|
|
<span id="L348" class="LineNr">348 </span><span class="CommentedCode">#? == data</span>
|
|
<span id="L349" class="LineNr">349 </span><span class="CommentedCode">#? Push-n-zero-bytes-ebp: # (addr int)</span>
|
|
<span id="L350" class="LineNr">350 </span><span class="CommentedCode">#? 0/imm32</span>
|
|
<span id="L351" class="LineNr">351 </span><span class="CommentedCode">#? Push-n-zero-bytes-esp: # (addr int)</span>
|
|
<span id="L352" class="LineNr">352 </span><span class="CommentedCode">#? 0/imm32</span>
|
|
<span id="L353" class="LineNr">353 </span><span class="CommentedCode">#? == code</span>
|
|
<span id="L354" class="LineNr">354 </span>
|
|
<span id="L355" class="LineNr">355 </span><span class="subxComment"># stack at dump-stack0:</span>
|
|
<span id="L356" class="LineNr">356 </span><span class="subxComment"># 0 a: bdffffb0: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L357" class="LineNr">357 </span><span class="subxComment"># 0 a: bdffffc0: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L358" class="LineNr">358 </span><span class="subxComment"># 0 a: bdffffd0: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L359" class="LineNr">359 </span><span class="subxComment"># 0 a: bdffffe0: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L360" class="LineNr">360 </span><span class="subxComment"># 0 a: bdfffff0: 00000000 [fcfdfeff] 00000001 bf000000 </span>
|
|
<span id="L361" class="LineNr">361 </span>
|
|
<span id="L362" class="LineNr">362 </span><span class="subxComment"># desired state after push-n-zero-bytes:</span>
|
|
<span id="L363" class="LineNr">363 </span><span class="subxComment"># 0 a: bdffff90: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L364" class="LineNr">364 </span><span class="subxComment"># 0 a: bdffffa0: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L365" class="LineNr">365 </span><span class="subxComment"># 0 a: bdffffb0: 00000000 00000000 00000000 bdffffec </span>
|
|
<span id="L366" class="LineNr">366 </span><span class="subxComment"># 0 a: bdffffc0: 0900012a bdffffd0 00000020 090000d1 </span>
|
|
<span id="L367" class="LineNr">367 </span><span class="subxComment"># 0 a: bdffffd0: [rrrrrrrr] 00000000 00000000 00000000 </span>
|
|
<span id="L368" class="LineNr">368 </span><span class="subxComment"># 0 a: bdffffe0: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L369" class="LineNr">369 </span><span class="subxComment"># 0 a: bdfffff0: 00000000 fcfdfeff 00000001 bf000000 </span>
|
|
<span id="L370" class="LineNr">370 </span>
|
|
<span id="L371" class="LineNr">371 </span><span class="subxComment"># Stack pointer contains ra is caller's responsibility to over-write with array length.</span>
|
|
<span id="L372" class="LineNr">372 </span>
|
|
<span id="L373" class="LineNr">373 </span><span class="subxComment"># actual state:</span>
|
|
<span id="L374" class="LineNr">374 </span><span class="subxComment"># 0 a: bdffff90: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L375" class="LineNr">375 </span><span class="subxComment"># 0 a: bdffffa0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L376" class="LineNr">376 </span><span class="subxComment"># 0 a: bdffffb0: 00000000 00000000 00000000 bdffffec</span>
|
|
<span id="L377" class="LineNr">377 </span><span class="subxComment"># 0 a: bdffffc0: 0900012a bdffffd0 00000020 090000d1</span>
|
|
<span id="L378" class="LineNr">378 </span><span class="subxComment"># 0 a: bdffffd0: 00000000 [00000000] 00000000 00000000</span>
|
|
<span id="L379" class="LineNr">379 </span><span class="subxComment"># 0 a: bdffffe0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L380" class="LineNr">380 </span><span class="subxComment"># 0 a: bdfffff0: 00000020 fcfdfeff 00000001 bf000000</span>
|
|
<span id="L381" class="LineNr">381 </span>
|
|
<span id="L382" class="LineNr">382 </span><span class="subxComment"># Couple of issues. But where does the return address disappear to?</span>
|
|
<span id="L383" class="LineNr">383 </span>
|
|
<span id="L384" class="LineNr">384 </span><span class="subxComment">## 8:</span>
|
|
<span id="L385" class="LineNr">385 </span>
|
|
<span id="L386" class="LineNr">386 </span><span class="CommentedCode">#? Entry:</span>
|
|
<span id="L387" class="LineNr">387 </span><span class="CommentedCode">#? # . prologue</span>
|
|
<span id="L388" class="LineNr">388 </span><span class="CommentedCode">#? 89/<- %ebp 4/r32/esp</span>
|
|
<span id="L389" class="LineNr">389 </span><span class="CommentedCode">#? #</span>
|
|
<span id="L390" class="LineNr">390 </span><span class="CommentedCode">#? 68/push 0xfcfdfeff/imm32</span>
|
|
<span id="L391" class="LineNr">391 </span><span class="CommentedCode">#? b8/copy-to-eax 0x34353637/imm32</span>
|
|
<span id="L392" class="LineNr">392 </span><span class="CommentedCode">#? $dump-stack0:</span>
|
|
<span id="L393" class="LineNr">393 </span><span class="CommentedCode">#? (push-n-zero-bytes 0x20)</span>
|
|
<span id="L394" class="LineNr">394 </span><span class="CommentedCode">#? $dump-stack9:</span>
|
|
<span id="L395" class="LineNr">395 </span><span class="CommentedCode">#? 68/push 0x20/imm32</span>
|
|
<span id="L396" class="LineNr">396 </span><span class="CommentedCode">#? #? c7 0/subop/copy *esp 0x20/imm32</span>
|
|
<span id="L397" class="LineNr">397 </span><span class="CommentedCode">#? $dump-stacka:</span>
|
|
<span id="L398" class="LineNr">398 </span><span class="CommentedCode">#? b8/copy-to-eax 1/imm32/exit</span>
|
|
<span id="L399" class="LineNr">399 </span><span class="CommentedCode">#? cd/syscall 0x80/imm8</span>
|
|
<span id="L400" class="LineNr">400 </span><span class="CommentedCode">#? </span>
|
|
<span id="L401" class="LineNr">401 </span><span class="CommentedCode">#? push-n-zero-bytes: # n: int</span>
|
|
<span id="L402" class="LineNr">402 </span><span class="CommentedCode">#? $push-n-zero-bytes:prologue:</span>
|
|
<span id="L403" class="LineNr">403 </span><span class="CommentedCode">#? 89/<- *Push-n-zero-bytes-ebp 5/r32/ebp # spill ebp without affecting stack</span>
|
|
<span id="L404" class="LineNr">404 </span><span class="CommentedCode">#? 89/<- %ebp 4/r32/esp</span>
|
|
<span id="L405" class="LineNr">405 </span><span class="CommentedCode">#? $push-n-zero-bytes:copy-ra:</span>
|
|
<span id="L406" class="LineNr">406 </span><span class="CommentedCode">#? $dump-stack1:</span>
|
|
<span id="L407" class="LineNr">407 </span><span class="CommentedCode">#? # -- esp = ebp</span>
|
|
<span id="L408" class="LineNr">408 </span><span class="CommentedCode">#? 50/push-eax</span>
|
|
<span id="L409" class="LineNr">409 </span><span class="CommentedCode">#? $dump-stack2:</span>
|
|
<span id="L410" class="LineNr">410 </span><span class="CommentedCode">#? # -- esp+8 = ebp+4</span>
|
|
<span id="L411" class="LineNr">411 </span><span class="CommentedCode">#? # -- esp+4 = ebp</span>
|
|
<span id="L412" class="LineNr">412 </span><span class="CommentedCode">#? 8b/-> *(esp+4) 0/r32/eax</span>
|
|
<span id="L413" class="LineNr">413 </span><span class="CommentedCode">#? $dump-stack3:</span>
|
|
<span id="L414" class="LineNr">414 </span><span class="CommentedCode">#? 2b/subtract *(ebp+4) 4/r32/esp</span>
|
|
<span id="L415" class="LineNr">415 </span><span class="CommentedCode">#? $dump-stack4:</span>
|
|
<span id="L416" class="LineNr">416 </span><span class="CommentedCode">#? # -- esp+4+n = ebp</span>
|
|
<span id="L417" class="LineNr">417 </span><span class="CommentedCode">#? 89/<- *(esp+4) 0/r32/eax</span>
|
|
<span id="L418" class="LineNr">418 </span><span class="CommentedCode">#? $dump-stack5:</span>
|
|
<span id="L419" class="LineNr">419 </span><span class="CommentedCode">#? 58/pop-to-eax</span>
|
|
<span id="L420" class="LineNr">420 </span><span class="CommentedCode">#? # -- esp+n = ebp</span>
|
|
<span id="L421" class="LineNr">421 </span><span class="CommentedCode">#? $push-n-zero-bytes:bulk-cleaning:</span>
|
|
<span id="L422" class="LineNr">422 </span><span class="CommentedCode">#? $dump-stack6:</span>
|
|
<span id="L423" class="LineNr">423 </span><span class="CommentedCode">#? 89/<- *Push-n-zero-bytes-esp 4/r32/esp</span>
|
|
<span id="L424" class="LineNr">424 </span><span class="CommentedCode">#? 81 0/subop/add *Push-n-zero-bytes-esp 4/imm32</span>
|
|
<span id="L425" class="LineNr">425 </span><span class="CommentedCode">#? $dump-stack7:</span>
|
|
<span id="L426" class="LineNr">426 </span><span class="CommentedCode">#? (zero-out *Push-n-zero-bytes-esp *(ebp+4)) # n</span>
|
|
<span id="L427" class="LineNr">427 </span><span class="CommentedCode">#? $push-n-zero-bytes:epilogue:</span>
|
|
<span id="L428" class="LineNr">428 </span><span class="CommentedCode">#? $dump-stack8:</span>
|
|
<span id="L429" class="LineNr">429 </span><span class="CommentedCode">#? 8b/-> *Push-n-zero-bytes-ebp 5/r32/ebp # restore spill</span>
|
|
<span id="L430" class="LineNr">430 </span><span class="CommentedCode">#? c3/return</span>
|
|
<span id="L431" class="LineNr">431 </span><span class="CommentedCode">#? </span>
|
|
<span id="L432" class="LineNr">432 </span><span class="CommentedCode">#? zero-out: # start: (addr byte), len: int</span>
|
|
<span id="L433" class="LineNr">433 </span><span class="CommentedCode">#? # pseudocode:</span>
|
|
<span id="L434" class="LineNr">434 </span><span class="CommentedCode">#? # curr/esi = start</span>
|
|
<span id="L435" class="LineNr">435 </span><span class="CommentedCode">#? # i/ecx = 0</span>
|
|
<span id="L436" class="LineNr">436 </span><span class="CommentedCode">#? # while true</span>
|
|
<span id="L437" class="LineNr">437 </span><span class="CommentedCode">#? # if (i >= len) break</span>
|
|
<span id="L438" class="LineNr">438 </span><span class="CommentedCode">#? # *curr = 0</span>
|
|
<span id="L439" class="LineNr">439 </span><span class="CommentedCode">#? # ++curr</span>
|
|
<span id="L440" class="LineNr">440 </span><span class="CommentedCode">#? # ++i</span>
|
|
<span id="L441" class="LineNr">441 </span><span class="CommentedCode">#? #</span>
|
|
<span id="L442" class="LineNr">442 </span><span class="CommentedCode">#? # . prologue</span>
|
|
<span id="L443" class="LineNr">443 </span><span class="CommentedCode">#? 55/push-ebp</span>
|
|
<span id="L444" class="LineNr">444 </span><span class="CommentedCode">#? 89/copy 3/mod/direct 5/rm32/ebp . . . 4/r32/esp . . # copy esp to ebp</span>
|
|
<span id="L445" class="LineNr">445 </span><span class="CommentedCode">#? # . save registers</span>
|
|
<span id="L446" class="LineNr">446 </span><span class="CommentedCode">#? 50/push-eax</span>
|
|
<span id="L447" class="LineNr">447 </span><span class="CommentedCode">#? 51/push-ecx</span>
|
|
<span id="L448" class="LineNr">448 </span><span class="CommentedCode">#? 52/push-edx</span>
|
|
<span id="L449" class="LineNr">449 </span><span class="CommentedCode">#? 56/push-esi</span>
|
|
<span id="L450" class="LineNr">450 </span><span class="CommentedCode">#? # curr/esi = start</span>
|
|
<span id="L451" class="LineNr">451 </span><span class="CommentedCode">#? 8b/copy 1/mod/*+disp8 5/rm32/ebp . . . 6/r32/esi 8/disp8 . # copy *(ebp+8) to esi</span>
|
|
<span id="L452" class="LineNr">452 </span><span class="CommentedCode">#? # var i/ecx: int = 0</span>
|
|
<span id="L453" class="LineNr">453 </span><span class="CommentedCode">#? 31/xor 3/mod/direct 1/rm32/ecx . . . 1/r32/ecx . . # clear ecx</span>
|
|
<span id="L454" class="LineNr">454 </span><span class="CommentedCode">#? # edx = len</span>
|
|
<span id="L455" class="LineNr">455 </span><span class="CommentedCode">#? 8b/copy 1/mod/*+disp8 5/rm32/ebp . . . 2/r32/edx 0xc/disp8 . # copy *(ebp+12) to edx</span>
|
|
<span id="L456" class="LineNr">456 </span><span class="CommentedCode">#? $zero-out:loop:</span>
|
|
<span id="L457" class="LineNr">457 </span><span class="CommentedCode">#? # if (i >= len) break</span>
|
|
<span id="L458" class="LineNr">458 </span><span class="CommentedCode">#? 39/compare 3/mod/direct 1/rm32/ecx . . . 2/r32/edx . . # compare ecx with edx</span>
|
|
<span id="L459" class="LineNr">459 </span><span class="CommentedCode">#? 7d/jump-if->= $zero-out:end/disp8</span>
|
|
<span id="L460" class="LineNr">460 </span><span class="CommentedCode">#? # *curr = 0</span>
|
|
<span id="L461" class="LineNr">461 </span><span class="CommentedCode">#? c6 0/subop/copy 0/mod/direct 6/rm32/esi . . . . . 0/imm8 # copy byte to *esi</span>
|
|
<span id="L462" class="LineNr">462 </span><span class="CommentedCode">#? # ++curr</span>
|
|
<span id="L463" class="LineNr">463 </span><span class="CommentedCode">#? 46/increment-esi</span>
|
|
<span id="L464" class="LineNr">464 </span><span class="CommentedCode">#? # ++i</span>
|
|
<span id="L465" class="LineNr">465 </span><span class="CommentedCode">#? 41/increment-ecx</span>
|
|
<span id="L466" class="LineNr">466 </span><span class="CommentedCode">#? eb/jump $zero-out:loop/disp8</span>
|
|
<span id="L467" class="LineNr">467 </span><span class="CommentedCode">#? $zero-out:end:</span>
|
|
<span id="L468" class="LineNr">468 </span><span class="CommentedCode">#? # . restore registers</span>
|
|
<span id="L469" class="LineNr">469 </span><span class="CommentedCode">#? 5e/pop-to-esi</span>
|
|
<span id="L470" class="LineNr">470 </span><span class="CommentedCode">#? 5a/pop-to-edx</span>
|
|
<span id="L471" class="LineNr">471 </span><span class="CommentedCode">#? 59/pop-to-ecx</span>
|
|
<span id="L472" class="LineNr">472 </span><span class="CommentedCode">#? 58/pop-to-eax</span>
|
|
<span id="L473" class="LineNr">473 </span><span class="CommentedCode">#? # . epilogue</span>
|
|
<span id="L474" class="LineNr">474 </span><span class="CommentedCode">#? 89/copy 3/mod/direct 4/rm32/esp . . . 5/r32/ebp . . # copy ebp to esp</span>
|
|
<span id="L475" class="LineNr">475 </span><span class="CommentedCode">#? 5d/pop-to-ebp</span>
|
|
<span id="L476" class="LineNr">476 </span><span class="CommentedCode">#? c3/return</span>
|
|
<span id="L477" class="LineNr">477 </span><span class="CommentedCode">#? </span>
|
|
<span id="L478" class="LineNr">478 </span><span class="CommentedCode">#? == data</span>
|
|
<span id="L479" class="LineNr">479 </span><span class="CommentedCode">#? Push-n-zero-bytes-ebp: # (addr int)</span>
|
|
<span id="L480" class="LineNr">480 </span><span class="CommentedCode">#? 0/imm32</span>
|
|
<span id="L481" class="LineNr">481 </span><span class="CommentedCode">#? Push-n-zero-bytes-esp: # (addr int)</span>
|
|
<span id="L482" class="LineNr">482 </span><span class="CommentedCode">#? 0/imm32</span>
|
|
<span id="L483" class="LineNr">483 </span><span class="CommentedCode">#? == code</span>
|
|
<span id="L484" class="LineNr">484 </span>
|
|
<span id="L485" class="LineNr">485 </span><span class="subxComment"># stack at dump-stack0:</span>
|
|
<span id="L486" class="LineNr">486 </span><span class="subxComment"># 0 a: bdffffb0: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L487" class="LineNr">487 </span><span class="subxComment"># 0 a: bdffffc0: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L488" class="LineNr">488 </span><span class="subxComment"># 0 a: bdffffd0: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L489" class="LineNr">489 </span><span class="subxComment"># 0 a: bdffffe0: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L490" class="LineNr">490 </span><span class="subxComment"># 0 a: bdfffff0: 00000000 [fcfdfeff] 00000001 bf000000 </span>
|
|
<span id="L491" class="LineNr">491 </span>
|
|
<span id="L492" class="LineNr">492 </span><span class="subxComment"># desired state after push-n-zero-bytes:</span>
|
|
<span id="L493" class="LineNr">493 </span><span class="subxComment"># 0 a: bdffff90: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L494" class="LineNr">494 </span><span class="subxComment"># 0 a: bdffffa0: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L495" class="LineNr">495 </span><span class="subxComment"># 0 a: bdffffb0: 00000000 00000000 00000000 bdffffec </span>
|
|
<span id="L496" class="LineNr">496 </span><span class="subxComment"># 0 a: bdffffc0: 0900012a bdffffd0 00000020 090000d1 </span>
|
|
<span id="L497" class="LineNr">497 </span><span class="subxComment"># 0 a: bdffffd0: [rrrrrrrr] 00000000 00000000 00000000 </span>
|
|
<span id="L498" class="LineNr">498 </span><span class="subxComment"># 0 a: bdffffe0: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L499" class="LineNr">499 </span><span class="subxComment"># 0 a: bdfffff0: 00000000 fcfdfeff 00000001 bf000000 </span>
|
|
<span id="L500" class="LineNr">500 </span>
|
|
<span id="L501" class="LineNr">501 </span><span class="subxComment"># actual state:</span>
|
|
<span id="L502" class="LineNr">502 </span><span class="subxComment"># 0 a: bdffff90: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L503" class="LineNr">503 </span><span class="subxComment"># 0 a: bdffffa0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L504" class="LineNr">504 </span><span class="subxComment"># 0 a: bdffffb0: 00000000 00000000 00000000 bdffffec</span>
|
|
<span id="L505" class="LineNr">505 </span><span class="subxComment"># 0 a: bdffffc0: 09000124 bdffffd0 00000020 090000d1</span>
|
|
<span id="L506" class="LineNr">506 </span><span class="subxComment"># 0 a: bdffffd0: [00000000] 00000000 00000000 00000000</span>
|
|
<span id="L507" class="LineNr">507 </span><span class="subxComment"># 0 a: bdffffe0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L508" class="LineNr">508 </span><span class="subxComment"># 0 a: bdfffff0: 00000020 fcfdfeff 00000001 bf000000</span>
|
|
<span id="L509" class="LineNr">509 </span>
|
|
<span id="L510" class="LineNr">510 </span><span class="subxComment"># Ok, just one diff, at bdfffff0</span>
|
|
<span id="L511" class="LineNr">511 </span>
|
|
<span id="L512" class="LineNr">512 </span><span class="subxComment">## 9:</span>
|
|
<span id="L513" class="LineNr">513 </span>
|
|
<span id="L514" class="LineNr">514 </span><span class="SpecialChar">Entry</span>:
|
|
<span id="L515" class="LineNr">515 </span> <span class="subxS1Comment"># . prologue</span>
|
|
<span id="L516" class="LineNr">516 </span> 89/<- %ebp 4/r32/esp
|
|
<span id="L517" class="LineNr">517 </span> <span class="subxComment">#</span>
|
|
<span id="L518" class="LineNr">518 </span> 68/push 0xfcfdfeff/imm32
|
|
<span id="L519" class="LineNr">519 </span> b8/copy-to-eax 0x34353637/imm32
|
|
<span id="L520" class="LineNr">520 </span><span class="Constant">$dump-stack0</span>:
|
|
<span id="L521" class="LineNr">521 </span> (push-n-zero-bytes 0x20)
|
|
<span id="L522" class="LineNr">522 </span><span class="Constant">$dump-stack9</span>:
|
|
<span id="L523" class="LineNr">523 </span> 68/push 0x20/imm32
|
|
<span id="L524" class="LineNr">524 </span><span class="Constant">$dump-stacka</span>:
|
|
<span id="L525" class="LineNr">525 </span> b8/copy-to-eax 1/imm32/exit
|
|
<span id="L526" class="LineNr">526 </span> cd/syscall 0x80/imm8
|
|
<span id="L527" class="LineNr">527 </span>
|
|
<span id="L528" class="LineNr">528 </span><span class="subxFunction">push-n-zero-bytes</span>: <span class="subxComment"># n: int</span>
|
|
<span id="L529" class="LineNr">529 </span><span class="Constant">$push-n-zero-bytes:prologue</span>:
|
|
<span id="L530" class="LineNr">530 </span> 89/<- *<span class="SpecialChar">Push-n-zero-bytes-ebp</span> 5/r32/ebp <span class="subxComment"># spill ebp without affecting stack</span>
|
|
<span id="L531" class="LineNr">531 </span> 89/<- %ebp 4/r32/esp
|
|
<span id="L532" class="LineNr">532 </span><span class="Constant">$push-n-zero-bytes:copy-ra</span>:
|
|
<span id="L533" class="LineNr">533 </span><span class="Constant">$dump-stack1</span>:
|
|
<span id="L534" class="LineNr">534 </span> <span class="subxComment"># -- esp = ebp</span>
|
|
<span id="L535" class="LineNr">535 </span> 50/push-eax
|
|
<span id="L536" class="LineNr">536 </span><span class="Constant">$dump-stack2</span>:
|
|
<span id="L537" class="LineNr">537 </span> <span class="subxComment"># -- esp+8 = ebp+4</span>
|
|
<span id="L538" class="LineNr">538 </span> <span class="subxComment"># -- esp+4 = ebp</span>
|
|
<span id="L539" class="LineNr">539 </span> 8b/-> *(esp+4) 0/r32/eax
|
|
<span id="L540" class="LineNr">540 </span><span class="Constant">$dump-stack3</span>:
|
|
<span id="L541" class="LineNr">541 </span> 2b/subtract *(ebp+4) 4/r32/esp
|
|
<span id="L542" class="LineNr">542 </span><span class="Constant">$dump-stack4</span>:
|
|
<span id="L543" class="LineNr">543 </span> <span class="subxComment"># -- esp+4+n = ebp</span>
|
|
<span id="L544" class="LineNr">544 </span> 89/<- *(esp+4) 0/r32/eax
|
|
<span id="L545" class="LineNr">545 </span><span class="Constant">$dump-stack5</span>:
|
|
<span id="L546" class="LineNr">546 </span> 58/pop-to-eax
|
|
<span id="L547" class="LineNr">547 </span> <span class="subxComment"># -- esp+n = ebp</span>
|
|
<span id="L548" class="LineNr">548 </span><span class="Constant">$push-n-zero-bytes:bulk-cleaning</span>:
|
|
<span id="L549" class="LineNr">549 </span><span class="Constant">$dump-stack6</span>:
|
|
<span id="L550" class="LineNr">550 </span> 89/<- *<span class="SpecialChar">Push-n-zero-bytes-esp</span> 4/r32/esp
|
|
<span id="L551" class="LineNr">551 </span> 81 0/subop/add *<span class="SpecialChar">Push-n-zero-bytes-esp</span> 4/imm32
|
|
<span id="L552" class="LineNr">552 </span><span class="Constant">$dump-stack7</span>:
|
|
<span id="L553" class="LineNr">553 </span> 81 0/subop/add *(ebp+4) 4/imm32
|
|
<span id="L554" class="LineNr">554 </span> (zero-out *<span class="SpecialChar">Push-n-zero-bytes-esp</span> *(ebp+4)) <span class="subxComment"># n</span>
|
|
<span id="L555" class="LineNr">555 </span><span class="Constant">$push-n-zero-bytes:epilogue</span>:
|
|
<span id="L556" class="LineNr">556 </span><span class="Constant">$dump-stack8</span>:
|
|
<span id="L557" class="LineNr">557 </span> 8b/-> *<span class="SpecialChar">Push-n-zero-bytes-ebp</span> 5/r32/ebp <span class="subxComment"># restore spill</span>
|
|
<span id="L558" class="LineNr">558 </span> c3/return
|
|
<span id="L559" class="LineNr">559 </span>
|
|
<span id="L560" class="LineNr">560 </span><span class="subxFunction">zero-out</span>: <span class="subxComment"># start: (addr byte), len: int</span>
|
|
<span id="L561" class="LineNr">561 </span> <span class="subxComment"># pseudocode:</span>
|
|
<span id="L562" class="LineNr">562 </span> <span class="subxComment"># curr/esi = start</span>
|
|
<span id="L563" class="LineNr">563 </span> <span class="subxComment"># i/ecx = 0</span>
|
|
<span id="L564" class="LineNr">564 </span> <span class="subxComment"># while true</span>
|
|
<span id="L565" class="LineNr">565 </span> <span class="subxComment"># if (i >= len) break</span>
|
|
<span id="L566" class="LineNr">566 </span> <span class="subxComment"># *curr = 0</span>
|
|
<span id="L567" class="LineNr">567 </span> <span class="subxComment"># ++curr</span>
|
|
<span id="L568" class="LineNr">568 </span> <span class="subxComment"># ++i</span>
|
|
<span id="L569" class="LineNr">569 </span> <span class="subxComment">#</span>
|
|
<span id="L570" class="LineNr">570 </span> <span class="subxS1Comment"># . prologue</span>
|
|
<span id="L571" class="LineNr">571 </span> 55/push-ebp
|
|
<span id="L572" class="LineNr">572 </span> 89/copy 3/mod/direct 5/rm32/ebp <span class="Normal"> . </span> <span class="Normal"> . </span> <span class="Normal"> . </span> 4/r32/esp <span class="Normal"> . </span> <span class="Normal"> . </span> <span class="subxComment"># copy esp to ebp</span>
|
|
<span id="L573" class="LineNr">573 </span> <span class="subxS1Comment"># . save registers</span>
|
|
<span id="L574" class="LineNr">574 </span> 50/push-eax
|
|
<span id="L575" class="LineNr">575 </span> 51/push-ecx
|
|
<span id="L576" class="LineNr">576 </span> 52/push-edx
|
|
<span id="L577" class="LineNr">577 </span> 56/push-esi
|
|
<span id="L578" class="LineNr">578 </span> <span class="subxComment"># curr/esi = start</span>
|
|
<span id="L579" class="LineNr">579 </span> 8b/copy 1/mod/*+disp8 5/rm32/ebp <span class="Normal"> . </span> <span class="Normal"> . </span> <span class="Normal"> . </span> 6/r32/esi 8/disp8 <span class="Normal"> . </span> <span class="subxComment"># copy *(ebp+8) to esi</span>
|
|
<span id="L580" class="LineNr">580 </span> <span class="subxComment"># var i/ecx: int = 0</span>
|
|
<span id="L581" class="LineNr">581 </span> 31/xor 3/mod/direct 1/rm32/ecx <span class="Normal"> . </span> <span class="Normal"> . </span> <span class="Normal"> . </span> 1/r32/ecx <span class="Normal"> . </span> <span class="Normal"> . </span> <span class="subxComment"># clear ecx</span>
|
|
<span id="L582" class="LineNr">582 </span> <span class="subxComment"># edx = len</span>
|
|
<span id="L583" class="LineNr">583 </span> 8b/copy 1/mod/*+disp8 5/rm32/ebp <span class="Normal"> . </span> <span class="Normal"> . </span> <span class="Normal"> . </span> 2/r32/edx 0xc/disp8 <span class="Normal"> . </span> <span class="subxComment"># copy *(ebp+12) to edx</span>
|
|
<span id="L584" class="LineNr">584 </span><span class="Constant">$zero-out:loop</span>:
|
|
<span id="L585" class="LineNr">585 </span> <span class="subxComment"># if (i >= len) break</span>
|
|
<span id="L586" class="LineNr">586 </span> 39/compare 3/mod/direct 1/rm32/ecx <span class="Normal"> . </span> <span class="Normal"> . </span> <span class="Normal"> . </span> 2/r32/edx <span class="Normal"> . </span> <span class="Normal"> . </span> <span class="subxComment"># compare ecx with edx</span>
|
|
<span id="L587" class="LineNr">587 </span> 7d/jump-if->= $zero-out:end/disp8
|
|
<span id="L588" class="LineNr">588 </span> <span class="subxComment"># *curr = 0</span>
|
|
<span id="L589" class="LineNr">589 </span> c6 0/subop/copy 0/mod/direct 6/rm32/esi <span class="Normal"> . </span> <span class="Normal"> . </span> <span class="Normal"> . </span> <span class="Normal"> . </span> <span class="Normal"> . </span> 0/imm8 <span class="subxComment"># copy byte to *esi</span>
|
|
<span id="L590" class="LineNr">590 </span> <span class="subxComment"># ++curr</span>
|
|
<span id="L591" class="LineNr">591 </span> 46/increment-esi
|
|
<span id="L592" class="LineNr">592 </span> <span class="subxComment"># ++i</span>
|
|
<span id="L593" class="LineNr">593 </span> 41/increment-ecx
|
|
<span id="L594" class="LineNr">594 </span> eb/jump $zero-out:<span class="Constant">loop</span>/disp8
|
|
<span id="L595" class="LineNr">595 </span><span class="Constant">$zero-out:end</span>:
|
|
<span id="L596" class="LineNr">596 </span> <span class="subxS1Comment"># . restore registers</span>
|
|
<span id="L597" class="LineNr">597 </span> 5e/pop-to-esi
|
|
<span id="L598" class="LineNr">598 </span> 5a/pop-to-edx
|
|
<span id="L599" class="LineNr">599 </span> 59/pop-to-ecx
|
|
<span id="L600" class="LineNr">600 </span> 58/pop-to-eax
|
|
<span id="L601" class="LineNr">601 </span> <span class="subxS1Comment"># . epilogue</span>
|
|
<span id="L602" class="LineNr">602 </span> 89/copy 3/mod/direct 4/rm32/esp <span class="Normal"> . </span> <span class="Normal"> . </span> <span class="Normal"> . </span> 5/r32/ebp <span class="Normal"> . </span> <span class="Normal"> . </span> <span class="subxComment"># copy ebp to esp</span>
|
|
<span id="L603" class="LineNr">603 </span> 5d/pop-to-ebp
|
|
<span id="L604" class="LineNr">604 </span> c3/return
|
|
<span id="L605" class="LineNr">605 </span>
|
|
<span id="L606" class="LineNr">606 </span>== data
|
|
<span id="L607" class="LineNr">607 </span><span class="SpecialChar">Push-n-zero-bytes-ebp</span>: <span class="subxComment"># (addr int)</span>
|
|
<span id="L608" class="LineNr">608 </span> 0/imm32
|
|
<span id="L609" class="LineNr">609 </span><span class="SpecialChar">Push-n-zero-bytes-esp</span>: <span class="subxComment"># (addr int)</span>
|
|
<span id="L610" class="LineNr">610 </span> 0/imm32
|
|
<span id="L611" class="LineNr">611 </span>== code
|
|
<span id="L612" class="LineNr">612 </span>
|
|
<span id="L613" class="LineNr">613 </span><span class="subxComment"># stack at dump-stack0:</span>
|
|
<span id="L614" class="LineNr">614 </span><span class="subxComment"># 0 a: bdffffb0: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L615" class="LineNr">615 </span><span class="subxComment"># 0 a: bdffffc0: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L616" class="LineNr">616 </span><span class="subxComment"># 0 a: bdffffd0: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L617" class="LineNr">617 </span><span class="subxComment"># 0 a: bdffffe0: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L618" class="LineNr">618 </span><span class="subxComment"># 0 a: bdfffff0: 00000000 [fcfdfeff] 00000001 bf000000 </span>
|
|
<span id="L619" class="LineNr">619 </span>
|
|
<span id="L620" class="LineNr">620 </span><span class="subxComment"># desired state after push-n-zero-bytes:</span>
|
|
<span id="L621" class="LineNr">621 </span><span class="subxComment"># 0 a: bdffff90: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L622" class="LineNr">622 </span><span class="subxComment"># 0 a: bdffffa0: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L623" class="LineNr">623 </span><span class="subxComment"># 0 a: bdffffb0: 00000000 00000000 00000000 bdffffec </span>
|
|
<span id="L624" class="LineNr">624 </span><span class="subxComment"># 0 a: bdffffc0: 0900012a bdffffd0 00000020 090000d1 </span>
|
|
<span id="L625" class="LineNr">625 </span><span class="subxComment"># 0 a: bdffffd0: [xxxxxxxx] 00000000 00000000 00000000 </span>
|
|
<span id="L626" class="LineNr">626 </span><span class="subxComment"># 0 a: bdffffe0: 00000000 00000000 00000000 00000000 </span>
|
|
<span id="L627" class="LineNr">627 </span><span class="subxComment"># 0 a: bdfffff0: 00000000 fcfdfeff 00000001 bf000000 </span>
|
|
<span id="L628" class="LineNr">628 </span>
|
|
<span id="L629" class="LineNr">629 </span><span class="subxComment"># actual state:</span>
|
|
<span id="L630" class="LineNr">630 </span><span class="subxComment"># 0 a: bdffff90: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L631" class="LineNr">631 </span><span class="subxComment"># 0 a: bdffffa0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L632" class="LineNr">632 </span><span class="subxComment"># 0 a: bdffffb0: 00000000 00000000 00000000 bdffffec</span>
|
|
<span id="L633" class="LineNr">633 </span><span class="subxComment"># 0 a: bdffffc0: 0900012f bdffffd0 00000024 090000d1</span>
|
|
<span id="L634" class="LineNr">634 </span><span class="subxComment"># 0 a: bdffffd0: [00000000] 00000000 00000000 00000000</span>
|
|
<span id="L635" class="LineNr">635 </span><span class="subxComment"># 0 a: bdffffe0: 00000000 00000000 00000000 00000000</span>
|
|
<span id="L636" class="LineNr">636 </span><span class="subxComment"># 0 a: bdfffff0: 00000000 fcfdfeff 00000001 bf000000</span>
|
|
</pre>
|
|
</body>
|
|
</html>
|
|
<!-- vim: set foldmethod=manual : -->
|