65,186
社区成员




#include "iostream"
using namespace std;
void main()
{
int y=20;
for (int i=0;i<2;i++)
{
static int k1=y*20;
k1++;
cout<<"k1 "<<k1<<endl;
}
system("pause");
}
#include "iostream"
using namespace std;
void main()
{
0041C220 push ebp
0041C221 mov ebp,esp
0041C223 sub esp,0D8h
0041C229 push ebx
0041C22A push esi
0041C22B push edi
0041C22C lea edi,[ebp-0D8h]
0041C232 mov ecx,36h
0041C237 mov eax,0CCCCCCCCh
0041C23C rep stos dword ptr [edi]
int y=20;
0041C23E mov dword ptr [y],14h
for (int i=0;i<2;i++)
0041C245 mov dword ptr [i],0
0041C24C jmp main+37h (41C257h)
0041C24E mov eax,dword ptr [i]
0041C251 add eax,1
0041C254 mov dword ptr [i],eax
0041C257 cmp dword ptr [i],2
0041C25B jge main+99h (41C2B9h)
{
static int k1=y*20;
0041C25D mov eax,dword ptr [$S1 (459604h)]
0041C262 and eax,1
0041C265 jne main+5Fh (41C27Fh)
0041C267 mov eax,dword ptr [$S1 (459604h)]
0041C26C or eax,1
0041C26F mov dword ptr [$S1 (459604h)],eax
0041C274 mov eax,dword ptr [y]
0041C277 imul eax,eax,14h
0041C27A mov dword ptr [k1 (459600h)],eax
k1++;
0041C27F mov eax,dword ptr [k1 (459600h)]
0041C284 add eax,1
0041C287 mov dword ptr [k1 (459600h)],eax
cout<<"k1 "<<k1<<endl;
0041C28C push offset std::endl (41A4D3h)
0041C291 mov eax,dword ptr [k1 (459600h)]
0041C296 push eax
0041C297 push offset string "k1 " (4500D0h)
0041C29C push offset std::cout (459690h)
0041C2A1 call std::operator<<<std::char_traits<char> > (41AAB9h)
0041C2A6 add esp,8
0041C2A9 mov ecx,eax
0041C2AB call std::basic_ostream<char,std::char_traits<char> >::operator<< (41A5F5h)
0041C2B0 mov ecx,eax
0041C2B2 call std::basic_ostream<char,std::char_traits<char> >::operator<< (41AAE6h)
}
0041C2B7 jmp main+2Eh (41C24Eh)
system("pause");
0041C2B9 push offset string "pause" (4500C8h)
0041C2BE call @ILT+1780(_system) (41A6F9h)
0041C2C3 add esp,4
}
关键看这三句汇编
0041C262 and eax,1
0041C265 jne main+5Fh (41C27Fh)
0041C267 mov eax,dword ptr [$S1 (459604h)]
第一次执行,ZF=1 即标志位的第七位,所以不跳转
EFL = 00000246
1001000110
ZF=1
第二次执行,ZF=0 直接挑战执行 k1++
EFL = 00000202
1000000010
ZF=0
459600h是K1的地址
0000000000000000 <_Z5func1v>:
0: 55 push %rbp
1: 48 89 e5 mov %rsp,%rbp
4: 53 push %rbx
5: 48 83 ec 18 sub $0x18,%rsp
9: c7 45 ec 14 00 00 00 movl $0x14,-0x14(%rbp)
10: b8 00 00 00 00 mov $0x0,%eax
15: 0f b6 00 movzbl (%rax),%eax
18: 84 c0 test %al,%al
1a: 75 30 jne 4c <_Z5func1v+0x4c>
1c: bf 00 00 00 00 mov $0x0,%edi
21: e8 00 00 00 00 callq 26 <_Z5func1v+0x26>
26: 85 c0 test %eax,%eax
28: 0f 95 c0 setne %al
2b: 84 c0 test %al,%al
2d: 74 1d je 4c <_Z5func1v+0x4c>
2f: 8b 55 ec mov -0x14(%rbp),%edx
32: 89 d0 mov %edx,%eax
34: c1 e0 02 shl $0x2,%eax
37: 01 d0 add %edx,%eax
39: c1 e0 02 shl $0x2,%eax
3c: 89 05 00 00 00 00 mov %eax,0x0(%rip) # 42 <_Z5func1v+0x42>
42: bf 00 00 00 00 mov $0x0,%edi
47: e8 00 00 00 00 callq 4c <_Z5func1v+0x4c>
4c: 8b 1d 00 00 00 00 mov 0x0(%rip),%ebx # 52 <_Z5func1v+0x52>
52: be 00 00 00 00 mov $0x0,%esi
57: bf 00 00 00 00 mov $0x0,%edi
5c: e8 00 00 00 00 callq 61 <_Z5func1v+0x61>
61: 89 de mov %ebx,%esi
63: 48 89 c7 mov %rax,%rdi
66: e8 00 00 00 00 callq 6b <_Z5func1v+0x6b>
6b: be 00 00 00 00 mov $0x0,%esi
70: 48 89 c7 mov %rax,%rdi
73: e8 00 00 00 00 callq 78 <_Z5func1v+0x78>
78: 48 83 c4 18 add $0x18,%rsp
7c: 5b pop %rbx
7d: 5d pop %rbp
7e: c3 retq
注意2b那一行的test和后面的jne, 这是一个条件跳转,
它是通过一个辅助变量, 来指示是不是第一次进入这个函数, 如果是第一次, 就对k1变量进行赋值, 如果不是,就不管.