惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

T
Threatpost
V
Vulnerabilities – Threatpost
TaoSecurity Blog
TaoSecurity Blog
C
Cybersecurity and Infrastructure Security Agency CISA
P
Proofpoint News Feed
G
GRAHAM CLULEY
S
Securelist
P
Palo Alto Networks Blog
MongoDB | Blog
MongoDB | Blog
A
Arctic Wolf
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
WordPress大学
WordPress大学
Project Zero
Project Zero
T
Threat Research - Cisco Blogs
L
Lohrmann on Cybersecurity
C
Cyber Attacks, Cyber Crime and Cyber Security
F
Fortinet All Blogs
博客园 - 叶小钗
B
Blog RSS Feed
C
Cisco Blogs
Google DeepMind News
Google DeepMind News
cs.CL updates on arXiv.org
cs.CL updates on arXiv.org
Apple Machine Learning Research
Apple Machine Learning Research
G
Google Developers Blog
K
Kaspersky official blog
D
Docker
Latest news
Latest news
Cisco Talos Blog
Cisco Talos Blog
T
Tor Project blog
Cyberwarzone
Cyberwarzone
Security Latest
Security Latest
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC
D
Darknet – Hacking Tools, Hacker News & Cyber Security
Spread Privacy
Spread Privacy
Microsoft Azure Blog
Microsoft Azure Blog
C
Check Point Blog
J
Java Code Geeks
Simon Willison's Weblog
Simon Willison's Weblog
T
Tenable Blog
Recent Announcements
Recent Announcements
T
Tailwind CSS Blog
H
Help Net Security
L
LINUX DO - 热门话题
T
The Exploit Database - CXSecurity.com
Jina AI
Jina AI
S
SegmentFault 最新的问题
MyScale Blog
MyScale Blog
NISL@THU
NISL@THU
美团技术团队
腾讯CDC

博客园 - ->

[Under the hood]---Matt Pietrek October 1996 MSJ [under the hood]Reduce EXE and DLL Size with LIBCTINY.LIB TN035: Using Multiple Resource Files and Header Files with Visual C++ The quick brown fox jumps over the lazy dog. [转]IOCP介绍 A simple IOCP Server/Client Class CodeProject站点地图 MFC Macros and Globals (搜集)一些少走弯路的话语+参考信息 [总结]软件工程师笔试题目(C++) [转贴][VC++6.0] 一个很深的模板Bug [转贴]35岁之前成功12条法则 C++/STL/VC资源链接(查找方便) [转贴]The Code Project Visual C++ Forum FAQ 看看你是否需要更新SYMBOL文件了?? 世界上有很多的"绳"模型 [转贴]VC:__declspec(novtable) [转贴]五个寓言故事令你受益匪浅 为什么用户自定义消息通常+0x400
Flash for Linux
-> · 2006-09-24 · via 博客园 - ->

http://f4l.sourceforge.net/

顺便COPY段代码先扔这里:

--- d:\vsprojects\vcpros\consolepros\vckbase1\first.cpp  -------------------
1:    #include <stdio.h>
2:
3:    int main(int argc, char** argv, char** envp)
4:    {
00401010   push        ebp  ;save ebp(cpu->内存)
00401011   mov         ebp,esp  ;set stack frame pointer
00401013   sub         esp,40h  ;allocate space for locals
00401016   push        ebx  ;save registers-------下面内容均如此
00401017   push        esi
00401018   push        edi
00401019   lea         edi,[ebp-40h]
0040101C   mov         ecx,10h
00401021   mov         eax,0CCCCCCCCh
00401026   rep stos    dword ptr [edi]
5:        return 0;
00401028   xor         eax,eax
6:    }
0040102A   pop         edi
0040102B   pop         esi
0040102C   pop         ebx  ;restore registers
0040102D   mov         esp,ebp  ;restore stack pointer
0040102F   pop         ebp  ;restore ebp
00401030   ret    ;return from function
--- No source file  --------------------------------------------------------


argc = 1 ;因为在VC中要读取你的*argv指向的应用程序名字(*.exe)
* argv = D:\VSPROJECTS\VCPROS\CONSOLEPROS\vckbase1\Debug\vckbase1.exe
* envp = ALLUSERSPROFILE=C:\Documents and Settings\All Users

 =============================================================

Considerations when Writing Prolog/Epilog Code

Microsoft Specific —>

Before writing your own prolog and epilog code sequences, it is important to understand how the stack frame is laid out. It is also useful to know how to use the __LOCAL_SIZE predefined constant.

C Stack Frame Layout

This example shows the standard prolog code that might appear in a 32-bit function:

push     ebp                 ; Save ebp
mov      ebp, esp            ; Set stack frame pointer
sub      esp, localbytes     ; Allocate space for locals
push     <registers>         ; Save registers

The localbytes variable represents the number of bytes needed on the stack for local variables, and the registers variable is a placeholder that represents the list of registers to be saved on the stack. After pushing the registers, you can place any other appropriate data on the stack. The following is the corresponding epilog code:

pop      <registers>         ; Restore registers
mov      esp, ebp            ; Restore stack pointer
pop      ebp                 ; Restore ebp
ret                          ; Return from function

The stack always grows down (from high to low memory addresses). The base pointer (ebp) points to the pushed value of ebp. The local variables area begins at ebp-2. To access local variables, calculate an offset from ebp by subtracting the appropriate value from ebp.

The __LOCAL_SIZE Constant

The compiler provides a constant, __LOCAL_SIZE, for use in the inline assembler block of function prolog code. This constant is used to allocate space for local variables on the stack frame in custom prolog code.

The compiler determines the value of __LOCAL_SIZE. The value is the total number of bytes of all user-defined local variables and compiler-generated temporary variables. __LOCAL_SIZE can be used only as an immediate operand; it cannot be used in an expression. You must not change or redefine the value of this constant. For example:

mov      eax, __LOCAL_SIZE           ;Immediate operand--Okay
mov      eax, [ebp - __LOCAL_SIZE]   ;Error

The following example of a naked function containing custom prolog and epilog sequences uses __LOCAL_SIZE in the prolog sequence:

__declspec ( naked ) func()
{
int i;
int j;
__asm      /* prolog */
{
push   ebp
mov      ebp, esp
sub      esp, __LOCAL_SIZE
}
/* Function body */
__asm      /* epilog */
{
mov      esp, ebp
pop      ebp
ret
}
}  

END Microsoft Specific