问题
I am working with x86 instructions and now I confused about :
Where do x86 Registers (Like :EIP,ESP and etc.) stores ?! For example when I use ollydbg I could see what is the actual EIP register value and how it changes.
If it stores in memory where is the actual location ? (For example in .data .text or .bss)
And can I change the EIP of another process manually ?! How ?!
回答1:
You have a severe misconception about what a register is.
A register is actually a register, ie. a really small piece of memory in the processor that can contain the operands or can be the target of a CPU instruction. It doesn't have an address in memory - it's really adressable as the register it is.
RAM is something totally different – an x86 program can work completely without RAM, but there's no operation that doesn't work on registers. For example, to add two numbers that are somewhere in RAM, you use LOAD instructions to load these two numbers into two register, and then some ADD instruction to add one number to the other, targeting a register, and then there's some STORE instruction that takes the register value and writes it to some address in RAM.
So, there's no "process-specific" registers. Every CPU core has exactly one set of registers (some specialities like virtualization nonwithstanding), and there's mechanisms to store registers in RAM, and restore them from RAM, for example when calling a function or switching contextes.
回答2:
Registers are stored in registers, not in the process's own memory.
Debuggers use a special interface provided by the OS to change registers of a running process, including EIP. In Linux, it's the ptrace(2) API.
Being able to change a process's registers from outside the process is related to how the OS saves a process's architectural state to memory for context switches.
来源：https://stackoverflow.com/questions/37396650/the-location-of-eip-and-other-registers-in-x86-process