x86 汇编右移运算符 SHR 的副作用？
我正在使用 ASM 调试器 ollydbg 跟踪一个程序，我遇到了这个代码片段，它是一个循环段：
CPU Disasm
Address Hex dump Command Comments
007D05EC |. 33C9 XOR ECX,ECX
007D05EE |. 8BFF MOV EDI,EDI
007D05F0 |> 8B54B4 10 /MOV EDX,DWORD PTR SS:[ESI*4+ESP+10]
007D05F4 |. 8BFA |MOV EDI,EDX
007D05F6 |. 0FAFFE |IMUL EDI,ESI
007D05F9 |. 8BDA |MOV EBX,EDX
007D05FB |. D3EB |SHR EBX,CL
007D05FD |. 03F8 |ADD EDI,EAX
007D05FF |. 83C1 10 |ADD ECX,10
007D0602 |. 83C6 01 |ADD ESI,1
007D0605 |. 03DF |ADD EBX,EDI
007D0607 |. 33DA |XOR EBX,EDX
007D0609 |. 81F9 B0000000 |CMP ECX,0B0
007D060F |. 8BC3 |MOV EAX,EBX
007D0611 |.^ 7C DD \JL SHORT 007D05F0
我可以跟踪并了解其他运算符所做的事情，当我跟踪它时，它是有意义的。但SHR EBX、CL对我来说没有意义。
//Shouldn't in asm
SHR EBX, CL
//be the same as doing this in c/c++?
//that's how it read when I checked the asm reference anyway
ebx >>= CL;
但我在跟踪时看到的是，如果循环迭代是奇数，则丢弃 LSB 并将 MSB 移至其位置。如果为偶数，则 ebx 不变。每次循环迭代，ecx 寄存器都会发生如下变化：
**ecx**
0x0000 -- loop 0
0x0010 -- loop 1
0x0020 -- loop 2
..
0x00A0 -- loop 10
我期望看到的是在第二次或第三次循环之后，ebx 总是被清零，因为 0x20 你已经移位了 32 位。
我有点困惑，有人可以解释一下吗？
谢谢
I'm tracing through a program with an ASM debugger ollydbg and I come across this code snippet, which is a loop segment:
CPU Disasm
Address Hex dump Command Comments
007D05EC |. 33C9 XOR ECX,ECX
007D05EE |. 8BFF MOV EDI,EDI
007D05F0 |> 8B54B4 10 /MOV EDX,DWORD PTR SS:[ESI*4+ESP+10]
007D05F4 |. 8BFA |MOV EDI,EDX
007D05F6 |. 0FAFFE |IMUL EDI,ESI
007D05F9 |. 8BDA |MOV EBX,EDX
007D05FB |. D3EB |SHR EBX,CL
007D05FD |. 03F8 |ADD EDI,EAX
007D05FF |. 83C1 10 |ADD ECX,10
007D0602 |. 83C6 01 |ADD ESI,1
007D0605 |. 03DF |ADD EBX,EDI
007D0607 |. 33DA |XOR EBX,EDX
007D0609 |. 81F9 B0000000 |CMP ECX,0B0
007D060F |. 8BC3 |MOV EAX,EBX
007D0611 |.^ 7C DD \JL SHORT 007D05F0
I can follow and get what the other operators do and it makes sense when I trace through it. But the SHR EBX, CL doesn't make sense to me.
//Shouldn't in asm
SHR EBX, CL
//be the same as doing this in c/c++?
//that's how it read when I checked the asm reference anyway
ebx >>= CL;
But what I am seeing instead when tracing is that if the loop iteration is odd, discard the LSB and shift the MSB into it's place. If it's even then ebx is unchanged. Each loop iteration, the ecx register changes as follows:
**ecx**
0x0000 -- loop 0
0x0010 -- loop 1
0x0020 -- loop 2
..
0x00A0 -- loop 10
What I was expecting to see was after the 2nd or 3rd loop, was that ebx would always be zero'ed out because 0x20 your already shifting 32 bits.
I'm kind of confused, can someone shed some light on this?
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这是我从指令描述中读到的内容：
回答您的问题吗？
Here's what I read from the description of the instruction:
Answer your question?