源码
#include <stdio.h> #include <stdlib.h> #include <string.h>
typedef int (*function) (char *, char *);
int callback_cpy(char *des, char *src) { strcpy(des, src); }
int callback_ncpy(char *des, char *src) { strcpy(src, "modified"); strncpy(des, src, 8); des[8] = '\0'; }
void test_other(function fun) { char a[20]; char b[20] = "xiaozhi";
if (fun){ fun(a, b); }
printf("a = %s\n", a); }
void r_test(function fun) { test_other(fun); }
void test(char *a, char *b, int (*fun)(char *c, char *d)) { strcat(a, b); printf("%s\n", a);
fun(a,b); printf("%s\n", a); }
int main() { char buf[128] = "xiaozhi"; char *p;
test_other(callback_cpy); test_other(callback_ncpy);
test(buf, "wise", callback_cpy);
r_test(callback_cpy); free(p); p = "xiaozhi";
return 0; }
反汇编
callback: file format elf64-littleaarch64
Disassembly of section .init:
00000000004005b0 <_init>: 4005b0: a9bf7bfd stp x29, x30, [sp, #-16]! 4005b4: 910003fd mov x29, sp 4005b8: 94000044 bl 4006c8 <call_weak_fn> 4005bc: a8c17bfd ldp x29, x30, [sp], #16 4005c0: d65f03c0 ret
Disassembly of section .plt:
/* x29 0x7ffffff350 549755810640 x30 0x400898 4196504 sp 0x7ffffff350 0x7ffffff350 pc 0x4005d0 0x4005d0 */ 00000000004005d0 <.plt>: 4005d0: a9bf7bf0 stp x16, x30, [sp, #-16]! // sp = sp-16 = 0x7ffffff340 // 0x7ffffff340: 0x0000000000411010 // 0x7ffffff348: 0x0000000000400898 4005d4: 90000090 adrp x16, 410000 <__FRAME_END__ 0xf5b8> // x16 = 0x410000 4005d8: f947fe11 ldr x17, [x16, #4088] // [x16, #4088] = 0x410ff8: 0x0000007fb7fe4e10 // x17 = 0x7fb7fe4e10 4005dc: 913fe210 add x16, x16, #0xff8 // x16 = 0x410ff8 4005e0: d61f0220 br x17 4005e4: d503201f nop 4005e8: d503201f nop 4005ec: d503201f nop
00000000004005f0 <__libc_start_main@plt>: 4005f0: b0000090 adrp x16, 411000 <__ibc_start_main@GLIBC_2.17> 4005f4: f9400211 ldr x17, [x16] 4005f8: 91000210 add x16, x16, #0x0 4005fc: d61f0220 br x17
/* x29 0x7ffffff350 549755810640 x30 0x400898 4196504 sp 0x7ffffff350 0x7ffffff350 pc 0x400600 0x400600 <strcat@plt>
[21] .got.plt PROGBITS 0000000000410fe8 00000fe8 0000000000000060 0000000000000008 WA 0 0 8 */ 0000000000400600 <strcat@plt>: 400600: b0000090 adrp x16, 411000 <__libc_start_main@GLIBC_2.17> // 0x7ffffff350: 0x0000007ffffff380 // x16 = 411000 // 0x411000 <__libc_start_main@got.plt>: 0x0000007fb7d9e600 400604: f9400611 ldr x17, [x16, #8] // [x16, #8] = 0x411008 <strcat@got.plt>: 0x00000000004005d0 // x17 = 0x4005d0: 0x90000090a9bf7bf0 400608: 91002210 add x16, x16, #0x8 // x16 = 0x411008 40060c: d61f0220 br x17 // goto 00000000004005d0 <.plt>
Disassembly of section .text:
0000000000400680 <_start>: 400680: d280001d mov x29, #0x0 // #0 400684: d280001e mov x30, #0x0 // #0 400688: aa0003e5 mov x5, x0 40068c: f94003e1 ldr x1, [sp] 400690: 910023e2 add x2, sp, #0x8 400694: 910003e6 mov x6, sp 400698: 580000c0 ldr x0, 4006b0 <_start+0x30> 40069c: 580000e3 ldr x3, 4006b8 <_start+0x38> 4006a0: 58000104 ldr x4, 4006c0 <_start+0x40> 4006a4: 97ffffd3 bl 4005f0 <__libc_start_main@plt> 4006a8: 97ffffde bl 400620 <abort@plt> 4006ac: 00000000 .inst 0x00000000 ; undefined 4006b0: 004008c4 .word 0x004008c4 // main 4006b4: 00000000 .word 0x00000000 4006b8: 00400958 .word 0x00400958 4006bc: 00000000 .word 0x00000000 4006c0: 004009d8 .word 0x004009d8 4006c4: 00000000 .word 0x00000000
0000000000400778 <frame_dummy>: 400778: 17ffffe6 b 400710 <register_tm_clones>
/* x29 0x7ffffff330 549755810608 x30 0x40068c 4195980 sp 0x7ffffff330 0x7ffffff330 pc 0x40083c 0x40083c */ 000000000040077c <callback_cpy>: 40077c: a9be7bfd stp x29, x30, [sp, #-32]! // sp = sp-32 = 400780: 910003fd mov x29, sp 400784: f9000fa0 str x0, [x29, #24] 400788: f9000ba1 str x1, [x29, #16] 40078c: f9400ba1 ldr x1, [x29, #16] 400790: f9400fa0 ldr x0, [x29, #24] 400794: 97ffffaf bl 400650 <strcpy@plt> 400798: d503201f nop 40079c: a8c27bfd ldp x29, x30, [sp], #32 4007a0: d65f03c0 ret
/*
*/ 00000000004007a4 <callback_ncpy>: 4007a4: a9be7bfd stp x29, x30, [sp, #-32]! // sp = sp-32 = 4007a8: 910003fd mov x29, sp 4007ac: f9000fa0 str x0, [x29, #24] 4007b0: f9000ba1 str x1, [x29, #16] 4007b4: f9400ba2 ldr x2, [x29, #16] 4007b8: 90000000 adrp x0, 400000 <_init-0x5b0> 4007bc: 91282001 add x1, x0, #0xa08 4007c0: aa0203e0 mov x0, x2 4007c4: f9400022 ldr x2, [x1] 4007c8: f9000002 str x2, [x0] 4007cc: 39402021 ldrb w1, [x1, #8] 4007d0: 39002001 strb w1, [x0, #8] 4007d4: d2800102 mov x2, #0x8 // #8 4007d8: f9400ba1 ldr x1, [x29, #16] 4007dc: f9400fa0 ldr x0, [x29, #24] 4007e0: 97ffffa0 bl 400660 <strncpy@plt> 4007e4: f9400fa0 ldr x0, [x29, #24] 4007e8: 91002000 add x0, x0, #0x8 4007ec: 3900001f strb wzr, [x0] 4007f0: d503201f nop 4007f4: a8c27bfd ldp x29, x30, [sp], #32 4007f8: d65f03c0 ret
/* x29 0x7ffffff380 549755810688 x30 0x400908 4196616 sp 0x7ffffff380 549755810688 pc 0x4007fc 4196348 */ 00000000004007fc <test_other>: 4007fc: a9bb7bfd stp x29, x30, [sp, #-80]! // sp = sp-80 = 0x7FFFFFF330 // 0x7ffffff330: 0x0000007ffffff380 // 0x7ffffff338: 0x0000000000400908 ==> return value 400800: 910003fd mov x29, sp // x29(fp) = sp = 0x7ffffff330 400804: f9000fa0 str x0, [x29, #24] // x0 = 0x40077c = callback_cpy() x29+#24 = 0x7ffffff348 // 0x7ffffff348: 0x000000000040077c 400808: 90000000 adrp x0, 400000 <_init-0x5b0> 40080c: 91288000 add x0, x0, #0xa20 // 0x400a20: 0x0069687a6f616978 400810: f9400000 ldr x0, [x0] // x0 = 0x0069687a6f616978 400814: f90013a0 str x0, [x29, #32] // 0x7ffffff350: 0x0069687a6f616978 400818: f90017bf str xzr, [x29, #40] // 0x7ffffff358: 0x0000000000000000 40081c: b90033bf str wzr, [x29, #48] // 0x7ffffff360: 0x0000000000000000 400820: f9400fa0 ldr x0, [x29, #24] // x0 = 0x40077c 400824: f100001f cmp x0, #0x0 400828: 540000a0 b.eq 40083c <test_other+0x40> // b.none 40082c: 910083a1 add x1, x29, #0x20 // x1 = x29+0x20 = 0x7ffffff350 400830: 9100e3a0 add x0, x29, #0x38 // x0 = x29+0x38 = 0x7ffffff368 400834: f9400fa2 ldr x2, [x29, #24] // x2 = 0x40077c 400838: d63f0040 blr x2 40083c: 9100e3a1 add x1, x29, #0x38 // 0x7ffffff368 400840: 90000000 adrp x0, 400000 <_init-0x5b0> 400844: 91286000 add x0, x0, #0xa18 // 0x400a18: 0x000a7325203d206 400848: 97ffff8a bl 400670 <printf@plt> 40084c: d503201f nop 400850: a8c57bfd ldp x29, x30, [sp], #80 // x29 = 0x7ffffff330: 0x0000007ffffff380 // x30 = 0x7ffffff338: 0x0000000000400908 // sp = sp+80 = 0x7ffffff380: 0x0000007ffffff420 400854: d65f03c0 ret
/* x29 0x7ffffff380 549755810688 x30 0x400938 4196664 sp 0x7ffffff380 0x7ffffff380 pc 0x400858 0x400858 */ 0000000000400858 <r_test>: 400858: a9be7bfd stp x29, x30, [sp, #-32]! // sp = 0x7ffffff380-32 = 0x7ffffff360 // 0x7ffffff360: 0x0000007ffffff380 // 0x7ffffff368: 0x0000000000400938 40085c: 910003fd mov x29, sp // x29 = sp = 0x7ffffff360 400860: f9000fa0 str x0, [x29, #24] // 0x7ffffff378: 0x000000000040077c 400864: f9400fa0 ldr x0, [x29, #24] // x0 = 0x40077c 400868: 97ffffe5 bl 4007fc <test_other> 40086c: d503201f nop 400870: a8c27bfd ldp x29, x30, [sp], #32 // x29 = [sp] = 0x7ffffff380 // x30 = [sp+8] = 0x400938 // sp = sp + 32 = 0x7ffffff380 400874: d65f03c0 ret /* x29 0x7ffffff380 549755810688 x30 0x400914 4196628 sp 0x7ffffff380 0x7ffffff380 pc 0x400928 0x400928 */ 0000000000400878 <test>: 400878: a9bd7bfd stp x29, x30, [sp, #-48]! // sp = sp-48 = 0x7ffffff350 // 0x7ffffff350: 0x0000007ffffff380 (fp=x29) // 0x7ffffff358: 0x000000000040092c (lr=x30) 40087c: 910003fd mov x29, sp // x29 = sp = 0x7ffffff350 400880: f90017a0 str x0, [x29, #40] // 0x7ffffff378: 0x0000007ffffff398 400884: f90013a1 str x1, [x29, #32] // 0x7ffffff370: 0x0000000000400a38 400888: f9000fa2 str x2, [x29, #24] // 0x7ffffff368: 0x000000000040077c 40088c: f94013a1 ldr x1, [x29, #32] // x1 = 0x400a38 400890: f94017a0 ldr x0, [x29, #40] // x0 = 0x7ffffff398 400894: 97ffff5b bl 400600 <strcat@plt> 400898: f94017a0 ldr x0, [x29, #40] // x0 = 0x7ffffff398 = [x29, #40] = [0x7ffffff378] // 0x7ffffff398: 0x7769687a6f616978 = "wihzoaix" // 0x7ffffff3a0: 0x0000000000657369 = "esi" 40089c: 97ffff65 bl 400630 <puts@plt> 4008a0: f9400fa2 ldr x2, [x29, #24] // x2 = 0x40077c 4008a4: f94013a1 ldr x1, [x29, #32] // x1 = 0x400a38 4008a8: f94017a0 ldr x0, [x29, #40] // x0 = 0x7ffffff398 4008ac: d63f0040 blr x2 // blr 0x40077c = callback_cpy 4008b0: f94017a0 ldr x0, [x29, #40] // x0 = 0x7ffffff398 4008b4: 97ffff5f bl 400630 <puts@plt> 4008b8: d503201f nop 4008bc: a8c37bfd ldp x29, x30, [sp], #48 // x29 = [sp] = 0x7ffffff350: 0x0000007ffffff380 // x30 = [sp+8] = 0x7ffffff358: 0x000000000040092c // sp = sp + 48 = 0x7ffffff380 4008c0: d65f03c0 ret
/* x29 0x7ffffff420 549755810848 x30 0x7fb7d9e6e0 548545357536 sp 0x7ffffff420 0x7ffffff420 pc 0x4008c4 0x4008c4 */ 00000000004008c4 <main>: 4008c4: a9b67bfd stp x29, x30, [sp, #-160]! // sp = sp-160(0xA0) = 0x7FFFFFF380 // 0x7ffffff380 : 0x0000007ffffff420 // 0x7ffffff388 : 0x0000007fb7d9e6e0 4008c8: 910003fd mov x29, sp // x29(fp) = 0x7ffffff380 4008cc: 90000000 adrp x0, 400000 <_init-0x5b0> // x0=0x400000 4008d0: 91288000 add x0, x0, #0xa20 // 0x400a20 : 0x0069687a6f616978 4008d4: f9400000 ldr x0, [x0] // 0x0069687a6f616978 = "ihzoaix" 4008d8: f9000fa0 str x0, [x29, #24] // x29+24 = 0x7ffffff380 + 24 = 0x7FFFFFF398 // 0x7ffffff398 : 0x0069687a6f616978 4008dc: a9027fbf stp xzr, xzr, [x29, #32] // x29+32 = 0x7ffffff3a0 // 0x7ffffff3a0 : 0x0000000000000000 // 0x7ffffff3a8 : 0x0000000000000000 4008e0: a9037fbf stp xzr, xzr, [x29, #48] // x29+48 = 0x7ffffff3b0 // 0x7ffffff3b0: 0x0000000000000000 // 0x7ffffff3b8: 0x0000000000000000 4008e4: a9047fbf stp xzr, xzr, [x29, #64] // 0x7ffffff3c0: 0x0000000000000000 // 0x7ffffff3c8: 0x0000000000000000 4008e8: a9057fbf stp xzr, xzr, [x29, #80] // 0x7ffffff3d0: 0x0000000000000000 // 0x7ffffff3d8: 0x0000000000000000 4008ec: a9067fbf stp xzr, xzr, [x29, #96] // 0x7ffffff3e0: 0x0000000000000000 // 0x7ffffff3e8: 0x0000000000000000 4008f0: a9077fbf stp xzr, xzr, [x29, #112] // 0x7ffffff3f0: 0x0000000000000000 // 0x7ffffff3f8: 0x0000000000000000 4008f4: a9087fbf stp xzr, xzr, [x29, #128] // 0x7ffffff400: 0x0000000000000000 // 0x7ffffff408: 0x0000000000000000 4008f8: f9004bbf str xzr, [x29, #144] // 0x7ffffff410: 0x0000000000000000
4008fc: 90000000 adrp x0, 400000 <_init-0x5b0> // x0 = 0x400000 400900: 911df000 add x0, x0, #0x77c // x0 = 0x40077c = callback_cpy 400904: 97ffffbe bl 4007fc <test_other> // sp = fp = 0x7ffffff380 400908: 90000000 adrp x0, 400000 <_init-0x5b0> 40090c: 911e9000 add x0, x0, #0x7a4 // 0x4007a4 = callback_ncpy 400910: 97ffffbb bl 4007fc <test_other> 400914: 90000000 adrp x0, 400000 <_init-0x5b0> // x0 = 0x400000 400918: 911df002 add x2, x0, #0x77c // x2 = 0x40077c 40091c: 90000000 adrp x0, 400000 <_init-0x5b0> // x0 = 0x400000 400920: 9128e001 add x1, x0, #0xa38 // x1 = 0x400a38: 0x0000000065736977 = "esiw" 400924: 910063a0 add x0, x29, #0x18 // x0 = 0x7ffffff398 400928: 97ffffd4 bl 400878 <test> 40092c: 90000000 adrp x0, 400000 <_init-0x5b0> 400930: 911df000 add x0, x0, #0x77c // x0 = 0x40077c 400934: 97ffffc9 bl 400858 <r_test> 400938: f9404fa0 ldr x0, [x29, #152] // x0 = 0x0 ===> 0x7ffffff418: 0x0000000000000000 40093c: 97ffff41 bl 400640 <free@plt> // free(p) 400940: 90000000 adrp x0, 400000 <_init-0x5b0> // x0 = 0x400000 400944: 91290000 add x0, x0, #0xa40 // x0 = 0x400a40 400948: f9004fa0 str x0, [x29, #152] // [x29+152] = 0x400a40: 0x0069687a6f616978 = "ihzoaix" // 0x7ffffff418: 0x0000000000400a40 40094c: 52800000 mov w0, #0x0 // #0 400950: a8ca7bfd ldp x29, x30, [sp], #160 400954: d65f03c0 ret