How do I interpret the columns of the CPU window's disassembly pane?

放肆的年华 提交于 2021-02-04 16:19:25

问题


There is a tool called the CPU window, which I get pressing Ctrl+Alt+C, that shows the disassembly of my code.

A green arrow to the left of the memory address indicates the location of the current execution point, then there is the memory addresses, but what does the second column mean, and why does the compiler sometimes jump more than one address after an instruction?

For example:

|first column|second column|assembly|
004520F4 55             push ebp      //continuous 
004520F5 8BEC           mov ebp, esp  //jumps to F7
004520F7 6A00           push $00      //jumps to F9
004520F9 53             push ebx      //continuous
004520FA 33D2           xor edx,edx

回答1:


Let's look at the code:

004520F4 55             push ebp      
004520F5 8BEC           mov ebp, esp  
004520F7 6A00           push $00      
004520F9 53             push ebx      
004520FA 33D2           xor edx,edx

Each line here represent a single machine instruction. The information presented is as follows:

  • The first column is the address at which the instruction starts, displayed in hex.
  • The second column is the machine code for the instruction, displayed in hex.
  • The third column is the instruction disassembled to assembler language.

So the second and third columns represent the exact same information. The third column is provided to make the code more understandable.

Note that different instructions have different lengths. The first and fourth instructions are only a single byte long. The others are two bytes long. And that explains why the instruction address increments by more than a single byte following two byte instructions.

There are instructions that can take even more than two bytes and so you can have increments of 3, 4 and so on for such instructions. A good example would be call or jump instructions which encode the target address or offset. So, an absolute jump on a 32 bit machine might be encoded in 5 bytes, one for the opcode and four for the address.

Back in the good old days, long before I was even born, programmers didn't even have assemblers and wrote code directly in machine instructions. That must have been a whole load of fun!




回答2:


The assembly listing (third column) is the human readable form of the actual machine code that is in the second column, which the cpu is actually executing.

If by "jumping some addresses" you mean that the addresses in the first column don't always increment by one, that's because instructions have varying lengths in machine code. For example the first line, push ebp is a single byte with value 0x55 thus next address is just one more. But machine code for the second instruction, mov ebp, esp is two bytes (0x8b 0xec) hence the address increments by two.



来源:https://stackoverflow.com/questions/17108127/how-do-i-interpret-the-columns-of-the-cpu-windows-disassembly-pane

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!