??? 如果程序要調(diào)用某個(gè)函數(shù)，那么計(jì)算機(jī)就會(huì)自動(dòng)將函數(shù)返回后要執(zhí)行的指令地址先壓入棧里，
等待函數(shù)返回以后再從中取出，跳到該處繼續(xù)執(zhí)行。

#include <stdio.h>
void TestFunction()
{
?int i = 10;
?return;
}
void main()
{
?TestFunction();
?return;
}

?

?

?EAX = CCCCCCCC EBX = 7FFD5000 ECX = 00000000 EDX = 00591030 ESI = 00000000 EDI = 0012FF48 EIP = 0040D468 ESP = 0012FEFC EBP = 0012FF48 EFL = 00000202

?

0012FEE4? 00 00 00 00 02 00 00 00 30 2F? ........0/
0012FEEE? 42 00 83 00 00 00 E0 06 59 00? B.......Y.
0012FEF8? 1C FF 12 00 00 00 00 00 00 00? ..........
0012FF02? 00 00 00 50 FD 7F CC CC CC CC? ...P?燙燙
0012FF0C? CC CC CC CC CC CC CC CC CC CC? 燙燙燙燙燙
0012FF16? CC CC CC CC CC CC CC CC CC CC? 燙燙燙燙燙
0012FF20? CC CC CC CC CC CC CC CC CC CC? 燙燙燙燙燙
0012FF2A? CC CC CC CC CC CC CC CC CC CC? 燙燙燙燙燙
0012FF34? CC CC CC CC CC CC CC CC CC CC? 燙燙燙燙燙
0012FF3E? CC CC CC CC CC CC CC CC CC CC? 燙燙燙燙燙
0012FF48? 88 FF 12 00 89 11 40 00 01 00? ......@...
0012FF52? 00 00 B8 0F 59 00 30 10 59 00? ....Y.0.Y.

?

9:??????? TestFunction();
0040D468?? call??????? @ILT+5(TestFunction) (0040100a)
10:?????? return;
11:?? }
0040D46D?? pop???????? edi
0040D46E?? pop???????? esi
0040D46F?? pop???????? ebx

?

我們可以看到TestFunction下一條指令是0040D46D，也就是函數(shù)返回的地址，我們按F11鍵單步執(zhí)行就會(huì)發(fā)現(xiàn)，0040D46D被壓入

了棧中。

?

?EAX = CCCCCCCC EBX = 7FFD5000 ECX = 00000000 EDX = 00591030 ESI = 00000000 EDI = 0012FF48 EIP = 0040100A ESP = 0012FEF8 EBP = 0012FF48 EFL = 00000202

0012FEE4? 00 00 00 00 02 00 00 00 30 2F? ........0/
0012FEEE? 42 00 83 00 00 00 E0 06 59 00? B.......Y.
0012FEF8? 6D D4 40 00 00 00 00 00 00 00? m訞.......
0012FF02? 00 00 00 50 FD 7F CC CC CC CC? ...P?燙燙
0012FF0C? CC CC CC CC CC CC CC CC CC CC? 燙燙燙燙燙
0012FF16? CC CC CC CC CC CC CC CC CC CC? 燙燙燙燙燙
0012FF20? CC CC CC CC CC CC CC CC CC CC? 燙燙燙燙燙
0012FF2A? CC CC CC CC CC CC CC CC CC CC? 燙燙燙燙燙
0012FF34? CC CC CC CC CC CC CC CC CC CC? 燙燙燙燙燙
0012FF3E? CC CC CC CC CC CC CC CC CC CC? 燙燙燙燙燙
0012FF48? 88 FF 12 00 89 11 40 00 01 00? ......@...
0012FF52? 00 00 B8 0F 59 00 30 10 59 00? ....Y.0.Y.

?

然后單步執(zhí)行到TestFunction函數(shù)里，

?

4:??????? int i = 10;
00401028?? mov???????? dword ptr [ebp-4],0Ah
5:??????? return;
6:??? }
0040102F?? pop???????? edi
00401030?? pop???????? esi
00401031?? pop???????? ebx
00401032?? mov???????? esp,ebp
00401034?? pop???????? ebp
00401035?? ret

?

當(dāng)執(zhí)行到ret之后，TestFunction函數(shù)就會(huì)返回，跳轉(zhuǎn)到0040D46D這個(gè)地址。

?

0040D46D?? pop???????? edi
0040D46E?? pop???????? esi
0040D46F?? pop???????? ebx
0040D470?? add???????? esp,40h
0040D473?? cmp???????? ebp,esp
0040D475?? call??????? __chkesp (00401060)
0040D47A?? mov???????? esp,ebp
0040D47C?? pop???????? ebp
0040D47D?? ret

?

??? 正是因?yàn)橄确湃霔＠锏牡刂吩谇?#xff0c;而后進(jìn)入棧的數(shù)據(jù)一旦很長，就會(huì)覆蓋到前面的地址，

這就會(huì)導(dǎo)致程序發(fā)生錯(cuò)誤。這也就是溢出的原因。

總結(jié)

以上是生活随笔為你收集整理的函数在内存中的具体执行的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。