无法访问汇编函数的参数

Question

我正在汇编中编写一个函数，它本质上将 args 推入堆栈，然后创建一个堆栈帧（即保存先前的并将堆栈基指针移动到堆栈指针的值）。然后我尝试通过将基指针偏移 4 + 2 来访问我的参数（4 个字节是内存地址的长度，2 是我想要的 arg 的长度）。

这是我的程序（两行之间是内存）：

section .data
    txt dw '25'

section .text
    global _start

_exit:
    mov rax, 60
    mov rdi, 0
    syscall

_print_arg:
    ;; function_initialisation
    push rbp ;; save old stackbase value
    mov rbp, rsp ;; set new stack base from tail of last value added to stack
    
    ;; actual function
    mov rax, 1
    mov rdi, 1
    ;;________________________
    lea rsi, [rbp + 4 + 2] ;; access stackbase, skip return address (4 bytes long) and go to start of our param (which is 2 bytes long / word)
    ;;¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬
    mov rdx, 2
    syscall
    
    ;; function_finalisation
    mov rsp, rbp ;; set stack pointer as this frames stack base (ie set ebp to tail of old function)
    pop rbp ;; set stack base pointer as original base of caller
    ret ;; return to last value stored on stack, which at this point is the implicitly pushed return address

_start:
    push word [txt] ;; push only arg to stack, word
    call _print_arg ;; implicitly push return address, call function
    pop rax ;; just a way to pop old value off the stack
    jmp _exit ;; exit routine, just a goto

我首先尝试直接打印我推送到堆栈的变量，这很有效，所以我知道这不是无法打印的内容问题。我的猜测是我对堆栈和操作指针寄存器的理解存在根本缺陷。

Answer 1

返回地址和 rbp 在 64 位上各有 8 个字节长度
所以代码应该是这样的

    section .data
    txt dw '25'

section .text
    global _start

_exit:
    mov rax, 60
    mov rdi, 0
    syscall

_print_arg:
    push rbp        ;   rbp is 8 bytes, so rsp is decremented by 8
    mov rbp, rsp
    
    mov rax, 1
    mov rdi, 1
    lea rsi, [rbp + 8 + 8]  ;   here is the issue, [rbp + 8 + 8], that is
                            ;   8 for saved rbp, another 8 bytes of return address
                            ;   and you're pointing exactly to the first arg
    mov rdx, 2
    syscall
    
    mov rsp, rbp
    pop rbp
    ret 

_start:
    push word [txt]     ;   push 2 bytes
    call _print_arg     ;   push 8 bytes of return address then jump to _print_arg
    pop rax             ;   no need to pop 8 bytes, since only 2 bytes were pushed
                        ;   so 'add rsp, 2' is appropriate
    jmp _exit

另外，调用后 pop rax 将 RSP 调整为 8，而不是平衡推送词。如果你在一个将要返回的真实函数中这样做，那将是一个问题。 （但 _start 不是一个函数，在堆栈未对齐并弹出额外的 6 个字节后退出仍然有效。）

通常，您一开始只会推送 8 的倍数，例如通过执行 movzx eax, word [txt] / push rax 而不是内存源 word push。或者推送“25”而不是首先从内存中加载这 2 个字节。