该寄存器之后将包含什么

发布于 2024-09-10 03:12:59 字数 148 浏览 5 评论 0原文

我似乎无法弄清楚 eax 在这段程序集之后包含什么:

mov     edi, [edi+4]
lea     eax, [edi+88h]

edi 指向一个类

I can't seem to figure out what eax contains after this peice of assembly:

mov     edi, [edi+4]
lea     eax, [edi+88h]

With edi pointing to a class

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(4

筱武穆 2024-09-17 03:12:59

加载有效地址获取引用的实际地址。由于某些神秘的原因,符号汇编的编写方式就好像它引用了 edi+88h 的内容,但该指令实际上所做的是加载 edi 寄存器的加上常量 088h(相当于 <代码>mov eax,edi;添加eax,088h)。我怀疑 edi+4 是一个函数指针:更有可能的是,它是一个 vtbl 指针或数组。

Load Effective Address gets the actual address of the reference. For some arcane reason, the symbolic assembly is written as if it references the content of edi+88h, but what the instruction actually does is loading the value of the edi register plus the constant 088h (equivalent to mov eax, edi; add eax, 088h). I doubt edi+4 is a function pointer: more likely, it's a vtbl pointer or an array.

涙—继续流 2024-09-17 03:12:59

虽然我对你们的班级一无所知,但可能性不大,但无论如何。

你有多重继承吗?也许 edi+4 是第二个虚拟表,而 [edi+4]+88h 是您要调用的函数指针?或者,根据您的编译器,虚拟表可能位于 +4,无论哪种情况,eax 都包含要调用的虚拟函数的地址。

A long shot, since I know nothing about your class, but here goes anyway.

Do you have multiple inheritance? Perhaps edi+4 is the second virtual table, and [edi+4]+88h is a function pointer you wish to call? Or depending on your compiler, it might be that the virtual table is located at +4, in either case eax contains the address of the virtual function to call.

傲鸠 2024-09-17 03:12:59

根据 edi 的使用,它可能最终指向一个内存位置,但 lea 并不总是这样使用:http://en.wikipedia.org/wiki/Addressing_mode#Useful_side_effect

Based on the use of edi, it probably ends up pointing to a memory location, but lea isn't always used like this: http://en.wikipedia.org/wiki/Addressing_mode#Useful_side_effect.

锦爱 2024-09-17 03:12:59
mov     edi, [edi+4]
lea     eax, [edi+88h]

    edi points here after 'mov'
    .
    xxxx....................
    |                      ^
xxxx....                   eax points here after 'lea'
^
edi pointed here before 'mov'

char* edi;
void* eax;

edi = *(char**)(edi+4);
eax = edi+0x88;

看起来有些记录刚刚被访问。

mov     edi, [edi+4]
lea     eax, [edi+88h]

    edi points here after 'mov'
    .
    xxxx....................
    |                      ^
xxxx....                   eax points here after 'lea'
^
edi pointed here before 'mov'

char* edi;
void* eax;

edi = *(char**)(edi+4);
eax = edi+0x88;

It looks like some record is just getting accessed there.

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文