汇编那些事
1. 源代码：myEx.cpp
#include<iostream>
using namespace std;
struct AAABBBCCC
{
AAABBBCCC():a(0),b(1),c(1.0){}
int a;
int b;
double c;
int d[10];
};
AAABBBCCC changeAAABBBCCC(AAABBBCCC m)
{
m.a = 10;
m.b = 20;
m.c = 2.0;
return m;
};
int main ()
{
AAABBBCCC m;
AAABBBCCC n = changeAAABBBCCC(m);
cout<<n.b<<endl;
return n.a;
}
2.debug编译 g++ -g myEx.cpp -o myEx
2.1 $nm myEx
0000000000600bd8 d _DYNAMIC
0000000000600da0 d _GLOBAL_OFFSET_TABLE_
0000000000400842 t _GLOBAL__I__Z15changeAAABBBCCC9AAABBBCCC
0000000000400a08 R _IO_stdin_used
w _Jv_RegisterClasses
00000000004007a8 T _Z15changeAAABBBCCC9AAABBBCCC
0000000000400804 t _Z41__static_initialization_and_destruction_0ii
00000000004008ea W _ZN9AAABBBCCCC1Ev
U _ZNSolsEPFRSoS_E@@GLIBCXX_3.4
U _ZNSolsEi@@GLIBCXX_3.4
U _ZNSt8ios_base4InitC1Ev@@GLIBCXX_3.4
U _ZNSt8ios_base4InitD1Ev@@GLIBCXX_3.4
0000000000600e00 B _ZSt4cout@@GLIBCXX_3.4
U _ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_@@GLIBCXX_3.4
0000000000600f1c b _ZSt8__ioinit
0000000000600bb8 d __CTOR_END__
0000000000600ba8 d __CTOR_LIST__
0000000000600bc8 D __DTOR_END__
0000000000600bc0 d __DTOR_LIST__
0000000000400ba0 r __FRAME_END__
0000000000600bd0 d __JCR_END__
0000000000600bd0 d __JCR_LIST__
0000000000600dfc A __bss_start
U __cxa_atexit@@GLIBC_2.2.5
0000000000600df8 D __data_start
00000000004009c0 t __do_global_ctors_aux
0000000000400720 t __do_global_dtors_aux
0000000000400a10 R __dso_handle
0000000000600ba4 d __fini_array_end
0000000000600ba4 d __fini_array_start
w __gmon_start__
U __gxx_personality_v0@@CXXABI_1.3
0000000000600ba4 d __init_array_end
0000000000600ba4 d __init_array_start
0000000000400920 T __libc_csu_fini
0000000000400930 T __libc_csu_init
U __libc_start_main@@GLIBC_2.2.5
0000000000600ba4 d __preinit_array_end
0000000000600ba4 d __preinit_array_start
0000000000400858 t __tcf_0
0000000000600dfc A _edata
0000000000600f20 A _end
00000000004009f8 T _fini
0000000000400628 T _init
00000000004006d0 T _start
00000000004006fc t call_gmon_start
0000000000600f18 b completed.6145
0000000000600df8 W data_start
0000000000600f10 b dtor_idx.6147
0000000000400780 t frame_dummy
0000000000400870 T main
0000000000600bd8 d _DYNAMIC
0000000000600da0 d _GLOBAL_OFFSET_TABLE_
0000000000400842 t _GLOBAL__I__Z15changeAAABBBCCC9AAABBBCCC
0000000000400a08 R _IO_stdin_used
w _Jv_RegisterClasses
00000000004007a8 T _Z15changeAAABBBCCC9AAABBBCCC
0000000000400804 t _Z41__static_initialization_and_destruction_0ii
00000000004008ea W _ZN9AAABBBCCCC1Ev
U _ZNSolsEPFRSoS_E@@GLIBCXX_3.4
U _ZNSolsEi@@GLIBCXX_3.4
U _ZNSt8ios_base4InitC1Ev@@GLIBCXX_3.4
U _ZNSt8ios_base4InitD1Ev@@GLIBCXX_3.4
0000000000600e00 B _ZSt4cout@@GLIBCXX_3.4
U _ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_@@GLIBCXX_3.4
0000000000600f1c b _ZSt8__ioinit
0000000000600bb8 d __CTOR_END__
0000000000600ba8 d __CTOR_LIST__
0000000000600bc8 D __DTOR_END__
0000000000600bc0 d __DTOR_LIST__
0000000000400ba0 r __FRAME_END__
0000000000600bd0 d __JCR_END__
0000000000600bd0 d __JCR_LIST__
0000000000600dfc A __bss_start
U __cxa_atexit@@GLIBC_2.2.5
0000000000600df8 D __data_start
00000000004009c0 t __do_global_ctors_aux
0000000000400720 t __do_global_dtors_aux
0000000000400a10 R __dso_handle
0000000000600ba4 d __fini_array_end
0000000000600ba4 d __fini_array_start
w __gmon_start__
U __gxx_personality_v0@@CXXABI_1.3
0000000000600ba4 d __init_array_end
0000000000600ba4 d __init_array_start
0000000000400920 T __libc_csu_fini
0000000000400930 T __libc_csu_init
U __libc_start_main@@GLIBC_2.2.5
0000000000600ba4 d __preinit_array_end
0000000000600ba4 d __preinit_array_start
0000000000400858 t __tcf_0
0000000000600dfc A _edata
0000000000600f20 A _end
00000000004009f8 T _fini
0000000000400628 T _init
00000000004006d0 T _start
00000000004006fc t call_gmon_start
0000000000600f18 b completed.6145
0000000000600df8 W data_start
0000000000600f10 b dtor_idx.6147
0000000000400780 t frame_dummy
0000000000400870 T main
$nm -C myEx
0000000000600bd8 d _DYNAMIC
0000000000600da0 d _GLOBAL_OFFSET_TABLE_
0000000000400842 t global constructors keyed to _Z15changeAAABBBCCC9AAABBBCCC
0000000000400a08 R _IO_stdin_used
w _Jv_RegisterClasses
00000000004007a8 T changeAAABBBCCC(AAABBBCCC)
0000000000400804 t __static_initialization_and_destruction_0(int, int)
00000000004008ea W AAABBBCCC::AAABBBCCC()
U std::ostream::operator<<(std::ostream& (*)(std::ostream&))@@GLIBCXX_3.4
U std::ostream::operator<<(int)@@GLIBCXX_3.4
U std::ios_base::Init::Init()@@GLIBCXX_3.4
U std::ios_base::Init::~Init()@@GLIBCXX_3.4
0000000000600e00 B std::cout@@GLIBCXX_3.4
U std::basic_ostream<char, std::char_traits<char> >& std::endl<char, std::char_traits<char> >(std::basic_ostream<char, std::char_traits<char> >&)@@GLIBCXX_3.4
0000000000600f1c b std::__ioinit
0000000000600bb8 d __CTOR_END__
0000000000600ba8 d __CTOR_LIST__
0000000000600bc8 D __DTOR_END__
0000000000600bc0 d __DTOR_LIST__
0000000000400ba0 r __FRAME_END__
0000000000600bd0 d __JCR_END__
0000000000600bd0 d __JCR_LIST__
0000000000600dfc A __bss_start
U __cxa_atexit@@GLIBC_2.2.5
0000000000600df8 D __data_start
00000000004009c0 t __do_global_ctors_aux
0000000000400720 t __do_global_dtors_aux
0000000000400a10 R __dso_handle
0000000000600ba4 d __fini_array_end
0000000000600ba4 d __fini_array_start
w __gmon_start__
U __gxx_personality_v0@@CXXABI_1.3
0000000000600ba4 d __init_array_end
0000000000600ba4 d __init_array_start
0000000000400920 T __libc_csu_fini
0000000000400930 T __libc_csu_init
U __libc_start_main@@GLIBC_2.2.5
0000000000600ba4 d __preinit_array_end
0000000000600ba4 d __preinit_array_start
0000000000400858 t __tcf_0
0000000000600dfc A _edata
0000000000600f20 A _end
00000000004009f8 T _fini
0000000000400628 T _init
00000000004006d0 T _start
00000000004006fc t call_gmon_start
0000000000600f18 b completed.6145
0000000000600df8 W data_start
0000000000600f10 b dtor_idx.6147
0000000000400780 t frame_dummy
0000000000400870 T main
0000000000600bd8 d _DYNAMIC
0000000000600da0 d _GLOBAL_OFFSET_TABLE_
0000000000400842 t global constructors keyed to _Z15changeAAABBBCCC9AAABBBCCC
0000000000400a08 R _IO_stdin_used
w _Jv_RegisterClasses
00000000004007a8 T changeAAABBBCCC(AAABBBCCC)
0000000000400804 t __static_initialization_and_destruction_0(int, int)
00000000004008ea W AAABBBCCC::AAABBBCCC()
U std::ostream::operator<<(std::ostream& (*)(std::ostream&))@@GLIBCXX_3.4
U std::ostream::operator<<(int)@@GLIBCXX_3.4
U std::ios_base::Init::Init()@@GLIBCXX_3.4
U std::ios_base::Init::~Init()@@GLIBCXX_3.4
0000000000600e00 B std::cout@@GLIBCXX_3.4
U std::basic_ostream<char, std::char_traits<char> >& std::endl<char, std::char_traits<char> >(std::basic_ostream<char, std::char_traits<char> >&)@@GLIBCXX_3.4
0000000000600f1c b std::__ioinit
0000000000600bb8 d __CTOR_END__
0000000000600ba8 d __CTOR_LIST__
0000000000600bc8 D __DTOR_END__
0000000000600bc0 d __DTOR_LIST__
0000000000400ba0 r __FRAME_END__
0000000000600bd0 d __JCR_END__
0000000000600bd0 d __JCR_LIST__
0000000000600dfc A __bss_start
U __cxa_atexit@@GLIBC_2.2.5
0000000000600df8 D __data_start
00000000004009c0 t __do_global_ctors_aux
0000000000400720 t __do_global_dtors_aux
0000000000400a10 R __dso_handle
0000000000600ba4 d __fini_array_end
0000000000600ba4 d __fini_array_start
w __gmon_start__
U __gxx_personality_v0@@CXXABI_1.3
0000000000600ba4 d __init_array_end
0000000000600ba4 d __init_array_start
0000000000400920 T __libc_csu_fini
0000000000400930 T __libc_csu_init
U __libc_start_main@@GLIBC_2.2.5
0000000000600ba4 d __preinit_array_end
0000000000600ba4 d __preinit_array_start
0000000000400858 t __tcf_0
0000000000600dfc A _edata
0000000000600f20 A _end
00000000004009f8 T _fini
0000000000400628 T _init
00000000004006d0 T _start
00000000004006fc t call_gmon_start
0000000000600f18 b completed.6145
0000000000600df8 W data_start
0000000000600f10 b dtor_idx.6147
0000000000400780 t frame_dummy
0000000000400870 T main
3. objdump 结果
$objdump -d myEx
myEx: file format elf64-x86-64
Disassembly of section .init:
0000000000400628 <_init>:
400628: 48 83 ec 08 sub $0x8,%rsp
40062c: e8 cb 00 00 00 callq 4006fc <call_gmon_start>
400631: e8 4a 01 00 00 callq 400780 <frame_dummy>
400636: e8 85 03 00 00 callq 4009c0 <__do_global_ctors_aux>
40063b: 48 83 c4 08 add $0x8,%rsp
40063f: c3 retq
Disassembly of section .plt:
0000000000400640 <_ZNSolsEi@plt-0x10>:
400640: ff 35 62 07 20 00 pushq 2099042(%rip) # 600da8 <_GLOBAL_OFFSET_TABLE_+0x8>
400646: ff 25 64 07 20 00 jmpq *2099044(%rip) # 600db0 <_GLOBAL_OFFSET_TABLE_+0x10>
40064c: 0f 1f 40 00 nopl 0x0(%rax)
0000000000400650 <_ZNSolsEi@plt>:
400650: ff 25 62 07 20 00 jmpq *2099042(%rip) # 600db8 <_GLOBAL_OFFSET_TABLE_+0x18>
400656: 68 00 00 00 00 pushq $0x0
40065b: e9 e0 ff ff ff jmpq 400640 <_init+0x18>
0000000000400660 <_ZNSt8ios_base4InitC1Ev@plt>:
400660: ff 25 5a 07 20 00 jmpq *2099034(%rip) # 600dc0 <_GLOBAL_OFFSET_TABLE_+0x20>
400666: 68 01 00 00 00 pushq $0x1
40066b: e9 d0 ff ff ff jmpq 400640 <_init+0x18>
0000000000400670 <__libc_start_main@plt>:
400670: ff 25 52 07 20 00 jmpq *2099026(%rip) # 600dc8 <_GLOBAL_OFFSET_TABLE_+0x28>
400676: 68 02 00 00 00 pushq $0x2
40067b: e9 c0 ff ff ff jmpq 400640 <_init+0x18>
0000000000400680 <__cxa_atexit@plt>:
400680: ff 25 4a 07 20 00 jmpq *2099018(%rip) # 600dd0 <_GLOBAL_OFFSET_TABLE_+0x30>
400686: 68 03 00 00 00 pushq $0x3
40068b: e9 b0 ff ff ff jmpq 400640 <_init+0x18>
0000000000400690 <_ZNSt8ios_base4InitD1Ev@plt>:
400690: ff 25 42 07 20 00 jmpq *2099010(%rip) # 600dd8 <_GLOBAL_OFFSET_TABLE_+0x38>
400696: 68 04 00 00 00 pushq $0x4
40069b: e9 a0 ff ff ff jmpq 400640 <_init+0x18>
00000000004006a0 <_ZNSolsEPFRSoS_E@plt>:
4006a0: ff 25 3a 07 20 00 jmpq *2099002(%rip) # 600de0 <_GLOBAL_OFFSET_TABLE_+0x40>
4006a6: 68 05 00 00 00 pushq $0x5
4006ab: e9 90 ff ff ff jmpq 400640 <_init+0x18>
00000000004006b0 <_ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_@plt>:
4006b0: ff 25 32 07 20 00 jmpq *2098994(%rip) # 600de8 <_GLOBAL_OFFSET_TABLE_+0x48>
4006b6: 68 06 00 00 00 pushq $0x6
4006bb: e9 80 ff ff ff jmpq 400640 <_init+0x18>
00000000004006c0 <__gxx_personality_v0@plt>:
4006c0: ff 25 2a 07 20 00 jmpq *2098986(%rip) # 600df0 <_GLOBAL_OFFSET_TABLE_+0x50>
4006c6: 68 07 00 00 00 pushq $0x7
4006cb: e9 70 ff ff ff jmpq 400640 <_init+0x18>
Disassembly of section .text:
00000000004006d0 <_start>:
4006d0: 31 ed xor %ebp,%ebp
4006d2: 49 89 d1 mov %rdx,%r9
4006d5: 5e pop %rsi
4006d6: 48 89 e2 mov %rsp,%rdx
4006d9: 48 83 e4 f0 and $0xfffffffffffffff0,%rsp
4006dd: 50 push %rax
4006de: 54 push %rsp
4006df: 49 c7 c0 20 09 40 00 mov $0x400920,%r8
4006e6: 48 c7 c1 30 09 40 00 mov $0x400930,%rcx
4006ed: 48 c7 c7 70 08 40 00 mov $0x400870,%rdi
4006f4: e8 77 ff ff ff callq 400670 <__libc_start_main@plt>
4006f9: f4 hlt
4006fa: 90 nop
4006fb: 90 nop
00000000004006fc <call_gmon_start>:
4006fc: 48 83 ec 08 sub $0x8,%rsp
400700: 48 8b 05 91 06 20 00 mov 2098833(%rip),%rax # 600d98 <_DYNAMIC+0x1c0>
400707: 48 85 c0 test %rax,%rax
40070a: 74 02 je 40070e <call_gmon_start+0x12>
40070c: ff d0 callq *%rax
40070e: 48 83 c4 08 add $0x8,%rsp
400712: c3 retq
400713: 90 nop
400714: 90 nop
400715: 90 nop
400716: 90 nop
400717: 90 nop
400718: 90 nop
400719: 90 nop
40071a: 90 nop
40071b: 90 nop
40071c: 90 nop
40071d: 90 nop
40071e: 90 nop
40071f: 90 nop
0000000000400720 <__do_global_dtors_aux>:
400720: 55 push %rbp
400721: 48 89 e5 mov %rsp,%rbp
400724: 53 push %rbx
400725: 48 83 ec 08 sub $0x8,%rsp
400729: 80 3d e8 07 20 00 00 cmpb $0x0,2099176(%rip) # 600f18 <completed.6145>
400730: 75 44 jne 400776 <__do_global_dtors_aux+0x56>
400732: b8 c8 0b 60 00 mov $0x600bc8,%eax
400737: 48 2d c0 0b 60 00 sub $0x600bc0,%rax
40073d: 48 c1 f8 03 sar $0x3,%rax
400741: 48 8d 58 ff lea 0xffffffffffffffff(%rax),%rbx
400745: 48 8b 05 c4 07 20 00 mov 2099140(%rip),%rax # 600f10 <dtor_idx.6147>
40074c: 48 39 c3 cmp %rax,%rbx
40074f: 76 1e jbe 40076f <__do_global_dtors_aux+0x4f>
400751: 48 83 c0 01 add $0x1,%rax
400755: 48 89 05 b4 07 20 00 mov %rax,2099124(%rip) # 600f10 <dtor_idx.6147>
40075c: ff 14 c5 c0 0b 60 00 callq *0x600bc0(,%rax,8)
400763: 48 8b 05 a6 07 20 00 mov 2099110(%rip),%rax # 600f10 <dtor_idx.6147>
40076a: 48 39 c3 cmp %rax,%rbx
40076d: 77 e2 ja 400751 <__do_global_dtors_aux+0x31>
40076f: c6 05 a2 07 20 00 01 movb $0x1,2099106(%rip) # 600f18 <completed.6145>
400776: 48 83 c4 08 add $0x8,%rsp
40077a: 5b pop %rbx
40077b: c9 leaveq
40077c: c3 retq
40077d: 0f 1f 00 nopl (%rax)
0000000000400780 <frame_dummy>:
400780: 55 push %rbp
400781: 48 83 3d 47 04 20 00 cmpq $0x0,2098247(%rip) # 600bd0 <__JCR_END__>
400788: 00
400789: 48 89 e5 mov %rsp,%rbp
40078c: 74 16 je 4007a4 <frame_dummy+0x24>
40078e: b8 00 00 00 00 mov $0x0,%eax
400793: 48 85 c0 test %rax,%rax
400796: 74 0c je 4007a4 <frame_dummy+0x24>
400798: bf d0 0b 60 00 mov $0x600bd0,%edi
40079d: 49 89 c3 mov %rax,%r11
4007a0: c9 leaveq
4007a1: 41 ff e3 jmpq *%r11
4007a4: c9 leaveq
4007a5: c3 retq
4007a6: 90 nop
4007a7: 90 nop
00000000004007a8 <_Z15changeAAABBBCCC9AAABBBCCC>:
4007a8: 55 push %rbp
4007a9: 48 89 e5 mov %rsp,%rbp
4007ac: c7 45 10 0a 00 00 00 movl $0xa,0x10(%rbp)
4007b3: c7 45 14 14 00 00 00 movl $0x14,0x14(%rbp)
4007ba: 48 b8 00 00 00 00 00 mov $0x4000000000000000,%rax
4007c1: 00 00 40
4007c4: 48 89 45 18 mov %rax,0x18(%rbp)
4007c8: 48 8b 45 10 mov 0x10(%rbp),%rax
4007cc: 48 89 07 mov %rax,(%rdi)
4007cf: 48 8b 45 18 mov 0x18(%rbp),%rax
4007d3: 48 89 47 08 mov %rax,0x8(%rdi)
4007d7: 48 8b 45 20 mov 0x20(%rbp),%rax
4007db: 48 89 47 10 mov %rax,0x10(%rdi)
4007df: 48 8b 45 28 mov 0x28(%rbp),%rax
4007e3: 48 89 47 18 mov %rax,0x18(%rdi)
4007e7: 48 8b 45 30 mov 0x30(%rbp),%rax
4007eb: 48 89 47 20 mov %rax,0x20(%rdi)
4007ef: 48 8b 45 38 mov 0x38(%rbp),%rax
4007f3: 48 89 47 28 mov %rax,0x28(%rdi)
4007f7: 48 8b 45 40 mov 0x40(%rbp),%rax
4007fb: 48 89 47 30 mov %rax,0x30(%rdi)
4007ff: 48 89 f8 mov %rdi,%rax
400802: c9 leaveq
400803: c3 retq
0000000000400804 <_Z41__static_initialization_and_destruction_0ii>:
400804: 55 push %rbp
400805: 48 89 e5 mov %rsp,%rbp
400808: 48 83 ec 10 sub $0x10,%rsp
40080c: 89 7d fc mov %edi,0xfffffffffffffffc(%rbp)
40080f: 89 75 f8 mov %esi,0xfffffffffffffff8(%rbp)
400812: 83 7d fc 01 cmpl $0x1,0xfffffffffffffffc(%rbp)
400816: 75 27 jne 40083f <_Z41__static_initialization_and_destruction_0ii+0x3b>
400818: 81 7d f8 ff ff 00 00 cmpl $0xffff,0xfffffffffffffff8(%rbp)
40081f: 75 1e jne 40083f <_Z41__static_initialization_and_destruction_0ii+0x3b>
400821: bf 1c 0f 60 00 mov $0x600f1c,%edi
400826: e8 35 fe ff ff callq 400660 <_ZNSt8ios_base4InitC1Ev@plt>
40082b: ba 10 0a 40 00 mov $0x400a10,%edx
400830: be 00 00 00 00 mov $0x0,%esi
400835: bf 58 08 40 00 mov $0x400858,%edi
40083a: e8 41 fe ff ff callq 400680 <__cxa_atexit@plt>
40083f: c9 leaveq
400840: c3 retq
400841: 90 nop
0000000000400842 <_GLOBAL__I__Z15changeAAABBBCCC9AAABBBCCC>:
400842: 55 push %rbp
400843: 48 89 e5 mov %rsp,%rbp
400846: be ff ff 00 00 mov $0xffff,%esi
40084b: bf 01 00 00 00 mov $0x1,%edi
400850: e8 af ff ff ff callq 400804 <_Z41__static_initialization_and_destruction_0ii>
400855: c9 leaveq
400856: c3 retq
400857: 90 nop
0000000000400858 <__tcf_0>:
400858: 55 push %rbp
400859: 48 89 e5 mov %rsp,%rbp
40085c: 48 83 ec 10 sub $0x10,%rsp
400860: 48 89 7d f8 mov %rdi,0xfffffffffffffff8(%rbp)
400864: bf 1c 0f 60 00 mov $0x600f1c,%edi
400869: e8 22 fe ff ff callq 400690 <_ZNSt8ios_base4InitD1Ev@plt>
40086e: c9 leaveq
40086f: c3 retq
0000000000400870 <main>:
400870: 55 push %rbp
400871: 48 89 e5 mov %rsp,%rbp
400874: 48 81 ec c0 00 00 00 sub $0xc0,%rsp
40087b: 48 8d 7d c0 lea 0xffffffffffffffc0(%rbp),%rdi
40087f: e8 66 00 00 00 callq 4008ea <_ZN9AAABBBCCCC1Ev>
400884: 48 8d 7d 80 lea 0xffffffffffffff80(%rbp),%rdi
400888: 48 8b 45 c0 mov 0xffffffffffffffc0(%rbp),%rax
40088c: 48 89 04 24 mov %rax,(%rsp)
400890: 48 8b 45 c8 mov 0xffffffffffffffc8(%rbp),%rax
400894: 48 89 44 24 08 mov %rax,0x8(%rsp)
400899: 48 8b 45 d0 mov 0xffffffffffffffd0(%rbp),%rax
40089d: 48 89 44 24 10 mov %rax,0x10(%rsp)
4008a2: 48 8b 45 d8 mov 0xffffffffffffffd8(%rbp),%rax
4008a6: 48 89 44 24 18 mov %rax,0x18(%rsp)
4008ab: 48 8b 45 e0 mov 0xffffffffffffffe0(%rbp),%rax
4008af: 48 89 44 24 20 mov %rax,0x20(%rsp)
4008b4: 48 8b 45 e8 mov 0xffffffffffffffe8(%rbp),%rax
4008b8: 48 89 44 24 28 mov %rax,0x28(%rsp)
4008bd: 48 8b 45 f0 mov 0xfffffffffffffff0(%rbp),%rax
4008c1: 48 89 44 24 30 mov %rax,0x30(%rsp)
4008c6: e8 dd fe ff ff callq 4007a8 <_Z15changeAAABBBCCC9AAABBBCCC>
4008cb: 8b 75 84 mov 0xffffffffffffff84(%rbp),%esi
4008ce: bf 00 0e 60 00 mov $0x600e00,%edi
4008d3: e8 78 fd ff ff callq 400650 <_ZNSolsEi@plt>
4008d8: 48 89 c7 mov %rax,%rdi
4008db: be b0 06 40 00 mov $0x4006b0,%esi
4008e0: e8 bb fd ff ff callq 4006a0 <_ZNSolsEPFRSoS_E@plt>
4008e5: 8b 45 80 mov 0xffffffffffffff80(%rbp),%eax
4008e8: c9 leaveq
4008e9: c3 retq
00000000004008ea <_ZN9AAABBBCCCC1Ev>:
4008ea: 55 push %rbp
4008eb: 48 89 e5 mov %rsp,%rbp
4008ee: 48 89 7d f8 mov %rdi,0xfffffffffffffff8(%rbp)
4008f2: 48 8b 45 f8 mov 0xfffffffffffffff8(%rbp),%rax
4008f6: c7 00 00 00 00 00 movl $0x0,(%rax)
4008fc: 48 8b 45 f8 mov 0xfffffffffffffff8(%rbp),%rax
400900: c7 40 04 01 00 00 00 movl $0x1,0x4(%rax)
400907: 48 8b 55 f8 mov 0xfffffffffffffff8(%rbp),%rdx
40090b: 48 b8 00 00 00 00 00 mov $0x3ff0000000000000,%rax
400912: 00 f0 3f
400915: 48 89 42 08 mov %rax,0x8(%rdx)
400919: c9 leaveq
40091a: c3 retq
40091b: 90 nop
40091c: 90 nop
40091d: 90 nop
40091e: 90 nop
40091f: 90 nop
0000000000400920 <__libc_csu_fini>:
400920: f3 c3 repz retq
400922: 0f 1f 80 00 00 00 00 nopl 0x0(%rax)
400929: 0f 1f 80 00 00 00 00 nopl 0x0(%rax)
0000000000400930 <__libc_csu_init>:
400930: 4c 89 64 24 e0 mov %r12,0xffffffffffffffe0(%rsp)
400935: 4c 89 6c 24 e8 mov %r13,0xffffffffffffffe8(%rsp)
40093a: 4c 8d 25 63 02 20 00 lea 2097763(%rip),%r12 # 600ba4 <__fini_array_end>
400941: 4c 89 74 24 f0 mov %r14,0xfffffffffffffff0(%rsp)
400946: 4c 89 7c 24 f8 mov %r15,0xfffffffffffffff8(%rsp)
40094b: 49 89 f6 mov %rsi,%r14
40094e: 48 89 5c 24 d0 mov %rbx,0xffffffffffffffd0(%rsp)
400953: 48 89 6c 24 d8 mov %rbp,0xffffffffffffffd8(%rsp)
400958: 48 83 ec 38 sub $0x38,%rsp
40095c: 41 89 ff mov %edi,%r15d
40095f: 49 89 d5 mov %rdx,%r13
400962: e8 c1 fc ff ff callq 400628 <_init>
400967: 48 8d 05 36 02 20 00 lea 2097718(%rip),%rax # 600ba4 <__fini_array_end>
40096e: 49 29 c4 sub %rax,%r12
400971: 49 c1 fc 03 sar $0x3,%r12
400975: 4d 85 e4 test %r12,%r12
400978: 74 1e je 400998 <__libc_csu_init+0x68>
40097a: 31 ed xor %ebp,%ebp
40097c: 48 89 c3 mov %rax,%rbx
40097f: 90 nop
400980: 48 83 c5 01 add $0x1,%rbp
400984: 4c 89 ea mov %r13,%rdx
400987: 4c 89 f6 mov %r14,%rsi
40098a: 44 89 ff mov %r15d,%edi
40098d: ff 13 callq *(%rbx)
40098f: 48 83 c3 08 add $0x8,%rbx
400993: 49 39 ec cmp %rbp,%r12
400996: 75 e8 jne 400980 <__libc_csu_init+0x50>
400998: 48 8b 5c 24 08 mov 0x8(%rsp),%rbx
40099d: 48 8b 6c 24 10 mov 0x10(%rsp),%rbp
4009a2: 4c 8b 64 24 18 mov 0x18(%rsp),%r12
4009a7: 4c 8b 6c 24 20 mov 0x20(%rsp),%r13
4009ac: 4c 8b 74 24 28 mov 0x28(%rsp),%r14
4009b1: 4c 8b 7c 24 30 mov 0x30(%rsp),%r15
4009b6: 48 83 c4 38 add $0x38,%rsp
4009ba: c3 retq
4009bb: 90 nop
4009bc: 90 nop
4009bd: 90 nop
4009be: 90 nop
4009bf: 90 nop
00000000004009c0 <__do_global_ctors_aux>:
4009c0: 55 push %rbp
4009c1: 48 89 e5 mov %rsp,%rbp
4009c4: 53 push %rbx
4009c5: bb b0 0b 60 00 mov $0x600bb0,%ebx
4009ca: 48 83 ec 08 sub $0x8,%rsp
4009ce: 48 8b 05 db 01 20 00 mov 2097627(%rip),%rax # 600bb0 <__CTOR_LIST__+0x8>
4009d5: 48 83 f8 ff cmp $0xffffffffffffffff,%rax
4009d9: 74 14 je 4009ef <__do_global_ctors_aux+0x2f>
4009db: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
4009e0: 48 83 eb 08 sub $0x8,%rbx
4009e4: ff d0 callq *%rax
4009e6: 48 8b 03 mov (%rbx),%rax
4009e9: 48 83 f8 ff cmp $0xffffffffffffffff,%rax
4009ed: 75 f1 jne 4009e0 <__do_global_ctors_aux+0x20>
4009ef: 48 83 c4 08 add $0x8,%rsp
4009f3: 5b pop %rbx
4009f4: c9 leaveq
4009f5: c3 retq
4009f6: 90 nop
4009f7: 90 nop
Disassembly of section .fini:
00000000004009f8 <_fini>:
4009f8: 48 83 ec 08 sub $0x8,%rsp
4009fc: e8 1f fd ff ff callq 400720 <__do_global_dtors_aux>
400a01: 48 83 c4 08 add $0x8,%rsp
400a05: c3 retq
4. gdb myEx
start
(gdb) disas /m
Dump of assembler code for function main():
23 int main ()
0x0000000000400870 <+0>: push %rbp
0x0000000000400871 <+1>: mov %rsp,%rbp
0x0000000000400874 <+4>: sub $0xc0,%rsp
24 {
25 AAABBBCCC m;
=> 0x000000000040087b <+11>: lea -0x40(%rbp),%rdi
0x000000000040087f <+15>: callq 0x4008ea <AAABBBCCC::AAABBBCCC()>
26 AAABBBCCC n = changeAAABBBCCC(m);
0x0000000000400884 <+20>: lea -0x80(%rbp),%rdi
0x0000000000400888 <+24>: mov -0x40(%rbp),%rax
0x000000000040088c <+28>: mov %rax,(%rsp)
0x0000000000400890 <+32>: mov -0x38(%rbp),%rax
0x0000000000400894 <+36>: mov %rax,0x8(%rsp)
0x0000000000400899 <+41>: mov -0x30(%rbp),%rax
0x000000000040089d <+45>: mov %rax,0x10(%rsp)
0x00000000004008a2 <+50>: mov -0x28(%rbp),%rax
0x00000000004008a6 <+54>: mov %rax,0x18(%rsp)
0x00000000004008ab <+59>: mov -0x20(%rbp),%rax
0x00000000004008af <+63>: mov %rax,0x20(%rsp)
0x00000000004008b4 <+68>: mov -0x18(%rbp),%rax
0x00000000004008b8 <+72>: mov %rax,0x28(%rsp)
0x00000000004008bd <+77>: mov -0x10(%rbp),%rax
0x00000000004008c1 <+81>: mov %rax,0x30(%rsp)
0x00000000004008c6 <+86>: callq 0x4007a8 <changeAAABBBCCC(AAABBBCCC)>
27 cout<<n.b<<endl;
0x00000000004008cb <+91>: mov -0x7c(%rbp),%esi
0x00000000004008ce <+94>: mov $0x600e00,%edi
0x00000000004008d3 <+99>: callq 0x400650 <_ZNSolsEi@plt>
0x00000000004008d8 <+104>: mov %rax,%rdi
0x00000000004008db <+107>: mov $0x4006b0,%esi
0x00000000004008e0 <+112>: callq 0x4006a0 <_ZNSolsEPFRSoS_E@plt>
28 return n.a;
0x00000000004008e5 <+117>: mov -0x80(%rbp),%eax
29 }
0x00000000004008e8 <+120>: leaveq
0x00000000004008e9 <+121>: retq
End of assembler dump.
5. (gdb) i reg
rax 0x3651153a60 233288579680
rbx 0x3650c1bbc0 233283107776
rcx 0x4 4
rdx 0x7fffffffe618 140737488348696
rsi 0x7fffffffe608 140737488348680
rdi 0x1 1
rbp 0x7fffffffe520 0x7fffffffe520
rsp 0x7fffffffe460 0x7fffffffe460
r8 0x3651152370 233288573808
r9 0x3650a0d620 233280951840
r10 0x0 0
r11 0x3650e33560 233285301600
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x40087b 0x40087b <main()+11>
eflags 0x206 [ PF IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
此时箭头指向的是c++代码的第25行，在进入main函数后，执行了三句汇编，也就是第23到24行之间的这三句，
0x0000000000400870 <+0>: push %rbp
0x0000000000400871 <+1>: mov %rsp,%rbp
0x0000000000400874 <+4>: sub $0xc0,%rsp
这三句首先将%rbp寄存器里的值压入栈内，然后把栈指针%rsp所指的地址保存到%rbp寄存器中，最后把堆栈指针往下移
0xC0个字节(请记住，堆栈是由高地址往低地址生长的)，这时候从上面的i reg 可以看出，
rbp 0x7fffffffe520
rsp 0x7fffffffe460 (和rbp之间的距离正好是0xC0)
为什么会要留下这段0xC0的空间呢？这12*16字节的内容主要是main函数的栈帧。
接下来执行x，查看从rsp的位置开始往上走的30个8字节地址的内容，如下所示。
(gdb) x /30xg 0x7fffffffe460
0x7fffffffe460: 0x0000000000400858 0x0000003650e33581
0x7fffffffe470: 0x0000000000600ba8 0x00007fffffffe4a0
0x7fffffffe480: 0x0000000000600ba4 0x000000000040083f
0x7fffffffe490: 0x0000000000000000 0x000000010000ffff
0x7fffffffe4a0: 0x00007fffffffe4b0 0x0000000000400855
0x7fffffffe4b0: 0x00007fffffffe4d0 0x00000000004009e6
0x7fffffffe4c0: 0x0000003650e08150 0x0000003650c1bbc0
0x7fffffffe4d0: 0x0000000000400930 0x000000000040063b
0x7fffffffe4e0: 0x00000036548ef100 0x0000000000400967
0x7fffffffe4f0: 0x00000036548e6100 0x0000003650c1bbc0
0x7fffffffe500: 0x0000000000400930 0x0000000000000000
0x7fffffffe510: 0x00007fffffffe600 0x0000000000000000
0x7fffffffe520: 0x0000000000000000 0x0000003650e1d994
0x7fffffffe530: 0x00000000004006d0 0x00007fffffffe608
0x7fffffffe540: 0x0000000100000000 0x0000000000400870
6. 执行si
(gdb) si
0x000000000040087f 25 AAABBBCCC m;
(gdb) disas /m
Dump of assembler code for function main():
23 int main ()
0x0000000000400870 <+0>: push %rbp
0x0000000000400871 <+1>: mov %rsp,%rbp
0x0000000000400874 <+4>: sub $0xc0,%rsp
24 {
25 AAABBBCCC m;
0x000000000040087b <+11>: lea -0x40(%rbp),%rdi
=> 0x000000000040087f <+15>: callq 0x4008ea <AAABBBCCC::AAABBBCCC()>
26 AAABBBCCC n = changeAAABBBCCC(m);
0x0000000000400884 <+20>: lea -0x80(%rbp),%rdi
0x0000000000400888 <+24>: mov -0x40(%rbp),%rax
0x000000000040088c <+28>: mov %rax,(%rsp)
0x0000000000400890 <+32>: mov -0x38(%rbp),%rax
0x0000000000400894 <+36>: mov %rax,0x8(%rsp)
0x0000000000400899 <+41>: mov -0x30(%rbp),%rax
0x000000000040089d <+45>: mov %rax,0x10(%rsp)
0x00000000004008a2 <+50>: mov -0x28(%rbp),%rax
0x00000000004008a6 <+54>: mov %rax,0x18(%rsp)
0x00000000004008ab <+59>: mov -0x20(%rbp),%rax
0x00000000004008af <+63>: mov %rax,0x20(%rsp)
0x00000000004008b4 <+68>: mov -0x18(%rbp),%rax
0x00000000004008b8 <+72>: mov %rax,0x28(%rsp)
0x00000000004008bd <+77>: mov -0x10(%rbp),%rax
0x00000000004008c1 <+81>: mov %rax,0x30(%rsp)
0x00000000004008c6 <+86>: callq 0x4007a8 <changeAAABBBCCC(AAABBBCCC)>
27 cout<<n.b<<endl;
0x00000000004008cb <+91>: mov -0x7c(%rbp),%esi
0x00000000004008ce <+94>: mov $0x600e00,%edi
0x00000000004008d3 <+99>: callq 0x400650 <_ZNSolsEi@plt>
0x00000000004008d8 <+104>: mov %rax,%rdi
0x00000000004008db <+107>: mov $0x4006b0,%esi
0x00000000004008e0 <+112>: callq 0x4006a0 <_ZNSolsEPFRSoS_E@plt>
28 return n.a;
0x00000000004008e5 <+117>: mov -0x80(%rbp),%eax
29 }
0x00000000004008e8 <+120>: leaveq
0x00000000004008e9 <+121>: retq
---Type <return> to continue, or q <return> to quit---
End of assembler dump.
(gdb) i reg
rax 0x3651153a60 233288579680
rbx 0x3650c1bbc0 233283107776
rcx 0x4 4
rdx 0x7fffffffe618 140737488348696
rsi 0x7fffffffe608 140737488348680
rdi 0x7fffffffe4e0 140737488348384
rbp 0x7fffffffe520 0x7fffffffe520
rsp 0x7fffffffe460 0x7fffffffe460
r8 0x3651152370 233288573808
r9 0x3650a0d620 233280951840
r10 0x0 0
r11 0x3650e33560 233285301600
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x40087f 0x40087f <main()+15>
eflags 0x206 [ PF IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
可以看到rdi的值被赋为 0x7fffffffe4e0，这是 lea -0x40(%rbp),%rdi执行的结果，将寄存器rbp所指的地址值向下移动0x40字节所得的地址赋给rdi寄存器。
这是为调用AAABBBCCC的构造函数做准备，构造函数真实的第一个参数其实是this指针，也就是这里%rdi的地址值，C++就是在栈上从这个地址开始了对一个AAABBBCCC对象，也就是m的构造，(不信的可以写一个带参数的构造函数，调用的时候，我们代码里的第一个参数，其实是传递给rsi或者esi寄存器的)，
可以看出sizeof(AAABBBCCC) = 56,而栈上预留了64字节的空间，这可能是编译器为了方便内存管理而故意留了8字节的空洞，后面我们可以进一步验证这个猜想。
7. 继续si往下走-------------------------------------------------------------------------------------------------------------------------------------------------------------------
(gdb) si
AAABBBCCC::AAABBBCCC (this=0x3) at myEx.cpp:6
6 AAABBBCCC():a(0),b(1),c(1.0){}
(gdb) disas /m
Dump of assembler code for function AAABBBCCC::AAABBBCCC():
6 AAABBBCCC():a(0),b(1),c(1.0){}
=> 0x00000000004008ea <+0>: push %rbp
0x00000000004008eb <+1>: mov %rsp,%rbp
0x00000000004008ee <+4>: mov %rdi,-0x8(%rbp)
0x00000000004008f2 <+8>: mov -0x8(%rbp),%rax
0x00000000004008f6 <+12>: movl $0x0,(%rax)
0x00000000004008fc <+18>: mov -0x8(%rbp),%rax
0x0000000000400900 <+22>: movl $0x1,0x4(%rax)
0x0000000000400907 <+29>: mov -0x8(%rbp),%rdx
0x000000000040090b <+33>: movabs $0x3ff0000000000000,%rax
0x0000000000400915 <+43>: mov %rax,0x8(%rdx)
0x0000000000400919 <+47>: leaveq
0x000000000040091a <+48>: retq
End of assembler dump.
(gdb) i reg
rax 0x3651153a60 233288579680
rbx 0x3650c1bbc0 233283107776
rcx 0x4 4
rdx 0x7fffffffe618 140737488348696
rsi 0x7fffffffe608 140737488348680
rdi 0x7fffffffe4e0 140737488348384
rbp 0x7fffffffe520 0x7fffffffe520
rsp 0x7fffffffe458 0x7fffffffe458
r8 0x3651152370 233288573808
r9 0x3650a0d620 233280951840
r10 0x0 0
r11 0x3650e33560 233285301600
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x4008ea 0x4008ea <AAABBBCCC::AAABBBCCC()>
eflags 0x206 [ PF IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
(gdb) x /30xg 0x7fffffffe458
0x7fffffffe458: 0x0000000000400884 0x0000000000400858
0x7fffffffe468: 0x0000003650e33581 0x0000000000600ba8
0x7fffffffe478: 0x00007fffffffe4a0 0x0000000000600ba4
0x7fffffffe488: 0x000000000040083f 0x0000000000000000
0x7fffffffe498: 0x000000010000ffff 0x00007fffffffe4b0
0x7fffffffe4a8: 0x0000000000400855 0x00007fffffffe4d0
0x7fffffffe4b8: 0x00000000004009e6 0x0000003650e08150
0x7fffffffe4c8: 0x0000003650c1bbc0 0x0000000000400930
0x7fffffffe4d8: 0x000000000040063b 0x00000036548ef100
0x7fffffffe4e8: 0x0000000000400967 0x00000036548e6100
0x7fffffffe4f8: 0x0000003650c1bbc0 0x0000000000400930
0x7fffffffe508: 0x0000000000000000 0x00007fffffffe600
0x7fffffffe518: 0x0000000000000000 0x0000000000000000
0x7fffffffe528: 0x0000003650e1d994 0x00000000004006d0
0x7fffffffe538: 0x00007fffffffe608 0x0000000100000000
这时候已经正式进入到AAABBBCCC的构造函数里来了，发现rsp已经变为0x7fffffffe458了，没进入之前是0x7fffffffe460，究竟是什么占据了这8字节呢？
猜测可能是个地址，但是是什么地址呢？用x看一下，发现是0x0000000000400884，对照一下objdump的输出，发现是构造函数完成后的下一条指令的地址，
400884: 48 8d 7d 80 lea 0xffffffffffffff80(%rbp),%rdi
-------------------------------------------------------------------------------------------------------------------------------------------------------------------
8. 继续si
(gdb) si
0x00000000004008eb 6 AAABBBCCC():a(0),b(1),c(1.0){}
(gdb) disas /m
Dump of assembler code for function AAABBBCCC::AAABBBCCC():
6 AAABBBCCC():a(0),b(1),c(1.0){}
0x00000000004008ea <+0>: push %rbp
=> 0x00000000004008eb <+1>: mov %rsp,%rbp
0x00000000004008ee <+4>: mov %rdi,-0x8(%rbp)
0x00000000004008f2 <+8>: mov -0x8(%rbp),%rax
0x00000000004008f6 <+12>: movl $0x0,(%rax)
0x00000000004008fc <+18>: mov -0x8(%rbp),%rax
0x0000000000400900 <+22>: movl $0x1,0x4(%rax)
0x0000000000400907 <+29>: mov -0x8(%rbp),%rdx
0x000000000040090b <+33>: movabs $0x3ff0000000000000,%rax
0x0000000000400915 <+43>: mov %rax,0x8(%rdx)
0x0000000000400919 <+47>: leaveq
0x000000000040091a <+48>: retq
End of assembler dump.
(gdb) i reg
rax 0x3651153a60 233288579680
rbx 0x3650c1bbc0 233283107776
rcx 0x4 4
rdx 0x7fffffffe618 140737488348696
rsi 0x7fffffffe608 140737488348680
rdi 0x7fffffffe4e0 140737488348384
rbp 0x7fffffffe520 0x7fffffffe520
rsp 0x7fffffffe450 0x7fffffffe450
r8 0x3651152370 233288573808
r9 0x3650a0d620 233280951840
r10 0x0 0
r11 0x3650e33560 233285301600
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x4008eb 0x4008eb <AAABBBCCC::AAABBBCCC()+1>
eflags 0x206 [ PF IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
rbp入栈了，rsp=0x7fffffffe450了
-------------------------------------------------------------------------------------------------------------------------------------------------------------------
9. 继续si
(gdb) si
0x00000000004008ee 6 AAABBBCCC():a(0),b(1),c(1.0){}
(gdb) disas /m
Dump of assembler code for function AAABBBCCC::AAABBBCCC():
6 AAABBBCCC():a(0),b(1),c(1.0){}
0x00000000004008ea <+0>: push %rbp
0x00000000004008eb <+1>: mov %rsp,%rbp
=> 0x00000000004008ee <+4>: mov %rdi,-0x8(%rbp)
0x00000000004008f2 <+8>: mov -0x8(%rbp),%rax
0x00000000004008f6 <+12>: movl $0x0,(%rax)
0x00000000004008fc <+18>: mov -0x8(%rbp),%rax
0x0000000000400900 <+22>: movl $0x1,0x4(%rax)
0x0000000000400907 <+29>: mov -0x8(%rbp),%rdx
0x000000000040090b <+33>: movabs $0x3ff0000000000000,%rax
0x0000000000400915 <+43>: mov %rax,0x8(%rdx)
0x0000000000400919 <+47>: leaveq
0x000000000040091a <+48>: retq
End of assembler dump.
(gdb) i reg
rax 0x3651153a60 233288579680
rbx 0x3650c1bbc0 233283107776
rcx 0x4 4
rdx 0x7fffffffe618 140737488348696
rsi 0x7fffffffe608 140737488348680
rdi 0x7fffffffe4e0 140737488348384
rbp 0x7fffffffe450 0x7fffffffe450
rsp 0x7fffffffe450 0x7fffffffe450
r8 0x3651152370 233288573808
r9 0x3650a0d620 233280951840
r10 0x0 0
r11 0x3650e33560 233285301600
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x4008ee 0x4008ee <AAABBBCCC::AAABBBCCC()+4>
eflags 0x206 [ PF IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
rbp = rsp = 0x7fffffffe450
-------------------------------------------------------------------------------------------------------------------------------------------------------------------
10. 继续si
(gdb) si
0x00000000004008ee 6 AAABBBCCC():a(0),b(1),c(1.0){}
(gdb) disas /m
Dump of assembler code for function AAABBBCCC::AAABBBCCC():
6 AAABBBCCC():a(0),b(1),c(1.0){}
0x00000000004008ea <+0>: push %rbp
0x00000000004008eb <+1>: mov %rsp,%rbp
=> 0x00000000004008ee <+4>: mov %rdi,-0x8(%rbp)
0x00000000004008f2 <+8>: mov -0x8(%rbp),%rax
0x00000000004008f6 <+12>: movl $0x0,(%rax)
0x00000000004008fc <+18>: mov -0x8(%rbp),%rax
0x0000000000400900 <+22>: movl $0x1,0x4(%rax)
0x0000000000400907 <+29>: mov -0x8(%rbp),%rdx
0x000000000040090b <+33>: movabs $0x3ff0000000000000,%rax
0x0000000000400915 <+43>: mov %rax,0x8(%rdx)
0x0000000000400919 <+47>: leaveq
0x000000000040091a <+48>: retq
End of assembler dump.
(gdb) i reg
rax 0x3651153a60 233288579680
rbx 0x3650c1bbc0 233283107776
rcx 0x4 4
rdx 0x7fffffffe618 140737488348696
rsi 0x7fffffffe608 140737488348680
rdi 0x7fffffffe4e0 140737488348384
rbp 0x7fffffffe450 0x7fffffffe450
rsp 0x7fffffffe450 0x7fffffffe450
r8 0x3651152370 233288573808
r9 0x3650a0d620 233280951840
r10 0x0 0
r11 0x3650e33560 233285301600
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x4008ee 0x4008ee <AAABBBCCC::AAABBBCCC()+4>
eflags 0x206 [ PF IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
(gdb) x /16xg 0x7fffffffe448
0x7fffffffe448: 0x00007fffffffe4e0 0x00007fffffffe520
0x7fffffffe458: 0x0000000000400884 0x0000000000400858
0x7fffffffe468: 0x0000003650e33581 0x0000000000600ba8
0x7fffffffe478: 0x00007fffffffe4a0 0x0000000000600ba4
0x7fffffffe488: 0x000000000040083f 0x0000000000000000
0x7fffffffe498: 0x000000010000ffff 0x00007fffffffe4b0
0x7fffffffe4a8: 0x0000000000400855 0x00007fffffffe4d0
0x7fffffffe4b8: 0x00000000004009e6 0x0000003650e08150
内存448的位置存放了rdi的内容，也就是4e0。
-------------------------------------------------------------------------------------------------------------------------------------------------------------------
11. 继续si
(gdb) si
0x00000000004008f6 6 AAABBBCCC():a(0),b(1),c(1.0){}
(gdb) i reg
rax 0x7fffffffe4e0 140737488348384
rbx 0x3650c1bbc0 233283107776
rcx 0x4 4
rdx 0x7fffffffe618 140737488348696
rsi 0x7fffffffe608 140737488348680
rdi 0x7fffffffe4e0 140737488348384
rbp 0x7fffffffe450 0x7fffffffe450
rsp 0x7fffffffe450 0x7fffffffe450
r8 0x3651152370 233288573808
r9 0x3650a0d620 233280951840
r10 0x0 0
r11 0x3650e33560 233285301600
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x4008f6 0x4008f6 <AAABBBCCC::AAABBBCCC()+12>
eflags 0x206 [ PF IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
(gdb) disas /m
Dump of assembler code for function AAABBBCCC::AAABBBCCC():
6 AAABBBCCC():a(0),b(1),c(1.0){}
0x00000000004008ea <+0>: push %rbp
0x00000000004008eb <+1>: mov %rsp,%rbp
0x00000000004008ee <+4>: mov %rdi,-0x8(%rbp)
0x00000000004008f2 <+8>: mov -0x8(%rbp),%rax
=> 0x00000000004008f6 <+12>: movl $0x0,(%rax)
0x00000000004008fc <+18>: mov -0x8(%rbp),%rax
0x0000000000400900 <+22>: movl $0x1,0x4(%rax)
0x0000000000400907 <+29>: mov -0x8(%rbp),%rdx
0x000000000040090b <+33>: movabs $0x3ff0000000000000,%rax
0x0000000000400915 <+43>: mov %rax,0x8(%rdx)
0x0000000000400919 <+47>: leaveq
0x000000000040091a <+48>: retq
End of assembler dump.
执行完后，%rax的值是448内存中的地址值0x7fffffffe4e0，rax一般是用来做函数返回值的寄存器，这里我们调用的是构造函数，当然也算。
-------------------------------------------------------------------------------------------------------------------------------------------------------------------
12. 继续si
继续si
(gdb) si
0x00000000004008fc 6 AAABBBCCC():a(0),b(1),c(1.0){}
(gdb) i reg
rax 0x7fffffffe4e0 140737488348384
rbx 0x3650c1bbc0 233283107776
rcx 0x4 4
rdx 0x7fffffffe618 140737488348696
rsi 0x7fffffffe608 140737488348680
rdi 0x7fffffffe4e0 140737488348384
rbp 0x7fffffffe450 0x7fffffffe450
rsp 0x7fffffffe450 0x7fffffffe450
r8 0x3651152370 233288573808
r9 0x3650a0d620 233280951840
r10 0x0 0
r11 0x3650e33560 233285301600
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x4008fc 0x4008fc <AAABBBCCC::AAABBBCCC()+18>
eflags 0x206 [ PF IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
(gdb) disas /m
Dump of assembler code for function AAABBBCCC::AAABBBCCC():
6 AAABBBCCC():a(0),b(1),c(1.0){}
0x00000000004008ea <+0>: push %rbp
0x00000000004008eb <+1>: mov %rsp,%rbp
0x00000000004008ee <+4>: mov %rdi,-0x8(%rbp)
0x00000000004008f2 <+8>: mov -0x8(%rbp),%rax
0x00000000004008f6 <+12>: movl $0x0,(%rax)
=> 0x00000000004008fc <+18>: mov -0x8(%rbp),%rax
0x0000000000400900 <+22>: movl $0x1,0x4(%rax)
0x0000000000400907 <+29>: mov -0x8(%rbp),%rdx
0x000000000040090b <+33>: movabs $0x3ff0000000000000,%rax
0x0000000000400915 <+43>: mov %rax,0x8(%rdx)
0x0000000000400919 <+47>: leaveq
0x000000000040091a <+48>: retq
End of assembler dump.
(gdb) x /4xg 0x7fffffffe4e0
0x7fffffffe4e0: 0x0000003600000000 0x0000000000400967
0x7fffffffe4f0: 0x00000036548e6100 0x0000003650c1bbc0
4e0位置的低4字节已经被置为0了，也就是说m.a已经被赋值，接着看看这条指令的上下文，发现是先给m.a赋值，接着给m.b赋值，m.b=1,接着是在地址4e8的位置赋值浮点数2.0，然后返回。
这里leaveq相当于：
movq %rbp, %rsp
popq %rbp
retq相当于：
popq %rip
-------------------------------------------------------------------------------------------------------------------------------------------------------------------
13. 一直si，执行完构造函数，
(gdb) disas /m
Dump of assembler code for function main():
23 int main ()
0x0000000000400870 <+0>: push %rbp
0x0000000000400871 <+1>: mov %rsp,%rbp
0x0000000000400874 <+4>: sub $0xc0,%rsp
24 {
25 AAABBBCCC m;
0x000000000040087b <+11>: lea -0x40(%rbp),%rdi
0x000000000040087f <+15>: callq 0x4008ea <AAABBBCCC::AAABBBCCC()>
26 AAABBBCCC n = changeAAABBBCCC(m);
=> 0x0000000000400884 <+20>: lea -0x80(%rbp),%rdi
0x0000000000400888 <+24>: mov -0x40(%rbp),%rax
0x000000000040088c <+28>: mov %rax,(%rsp)
0x0000000000400890 <+32>: mov -0x38(%rbp),%rax
0x0000000000400894 <+36>: mov %rax,0x8(%rsp)
0x0000000000400899 <+41>: mov -0x30(%rbp),%rax
0x000000000040089d <+45>: mov %rax,0x10(%rsp)
0x00000000004008a2 <+50>: mov -0x28(%rbp),%rax
0x00000000004008a6 <+54>: mov %rax,0x18(%rsp)
0x00000000004008ab <+59>: mov -0x20(%rbp),%rax
0x00000000004008af <+63>: mov %rax,0x20(%rsp)
0x00000000004008b4 <+68>: mov -0x18(%rbp),%rax
0x00000000004008b8 <+72>: mov %rax,0x28(%rsp)
0x00000000004008bd <+77>: mov -0x10(%rbp),%rax
0x00000000004008c1 <+81>: mov %rax,0x30(%rsp)
0x00000000004008c6 <+86>: callq 0x4007a8 <changeAAABBBCCC(AAABBBCCC)>
27 cout<<n.b<<endl;
0x00000000004008cb <+91>: mov -0x7c(%rbp),%esi
0x00000000004008ce <+94>: mov $0x600e00,%edi
0x00000000004008d3 <+99>: callq 0x400650 <_ZNSolsEi@plt>
0x00000000004008d8 <+104>: mov %rax,%rdi
0x00000000004008db <+107>: mov $0x4006b0,%esi
0x00000000004008e0 <+112>: callq 0x4006a0 <_ZNSolsEPFRSoS_E@plt>
28 return n.a;
0x00000000004008e5 <+117>: mov -0x80(%rbp),%eax
29 }
0x00000000004008e8 <+120>: leaveq
0x00000000004008e9 <+121>: retq
---Type <return> to continue, or q <return> to quit---
End of assembler dump.
(gdb) i reg
rax 0x3ff0000000000000 4607182418800017408
rbx 0x3650c1bbc0 233283107776
rcx 0x4 4
rdx 0x7fffffffe4e0 140737488348384
rsi 0x7fffffffe608 140737488348680
rdi 0x7fffffffe4e0 140737488348384
rbp 0x7fffffffe520 0x7fffffffe520
rsp 0x7fffffffe460 0x7fffffffe460
r8 0x3651152370 233288573808
r9 0x3650a0d620 233280951840
r10 0x0 0
r11 0x3650e33560 233285301600
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x400884 0x400884 <main()+20>
eflags 0x206 [ PF IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
Dump of assembler code for function main():
23 int main ()
0x0000000000400870 <+0>: push %rbp
0x0000000000400871 <+1>: mov %rsp,%rbp
0x0000000000400874 <+4>: sub $0xc0,%rsp
24 {
25 AAABBBCCC m;
0x000000000040087b <+11>: lea -0x40(%rbp),%rdi
0x000000000040087f <+15>: callq 0x4008ea <AAABBBCCC::AAABBBCCC()>
26 AAABBBCCC n = changeAAABBBCCC(m);
=> 0x0000000000400884 <+20>: lea -0x80(%rbp),%rdi
0x0000000000400888 <+24>: mov -0x40(%rbp),%rax
0x000000000040088c <+28>: mov %rax,(%rsp)
0x0000000000400890 <+32>: mov -0x38(%rbp),%rax
0x0000000000400894 <+36>: mov %rax,0x8(%rsp)
0x0000000000400899 <+41>: mov -0x30(%rbp),%rax
0x000000000040089d <+45>: mov %rax,0x10(%rsp)
0x00000000004008a2 <+50>: mov -0x28(%rbp),%rax
0x00000000004008a6 <+54>: mov %rax,0x18(%rsp)
0x00000000004008ab <+59>: mov -0x20(%rbp),%rax
0x00000000004008af <+63>: mov %rax,0x20(%rsp)
0x00000000004008b4 <+68>: mov -0x18(%rbp),%rax
0x00000000004008b8 <+72>: mov %rax,0x28(%rsp)
0x00000000004008bd <+77>: mov -0x10(%rbp),%rax
0x00000000004008c1 <+81>: mov %rax,0x30(%rsp)
0x00000000004008c6 <+86>: callq 0x4007a8 <changeAAABBBCCC(AAABBBCCC)>
27 cout<<n.b<<endl;
0x00000000004008cb <+91>: mov -0x7c(%rbp),%esi
0x00000000004008ce <+94>: mov $0x600e00,%edi
0x00000000004008d3 <+99>: callq 0x400650 <_ZNSolsEi@plt>
0x00000000004008d8 <+104>: mov %rax,%rdi
0x00000000004008db <+107>: mov $0x4006b0,%esi
0x00000000004008e0 <+112>: callq 0x4006a0 <_ZNSolsEPFRSoS_E@plt>
28 return n.a;
0x00000000004008e5 <+117>: mov -0x80(%rbp),%eax
29 }
0x00000000004008e8 <+120>: leaveq
0x00000000004008e9 <+121>: retq
---Type <return> to continue, or q <return> to quit---
End of assembler dump.
(gdb) i reg
rax 0x3ff0000000000000 4607182418800017408
rbx 0x3650c1bbc0 233283107776
rcx 0x4 4
rdx 0x7fffffffe4e0 140737488348384
rsi 0x7fffffffe608 140737488348680
rdi 0x7fffffffe4e0 140737488348384
rbp 0x7fffffffe520 0x7fffffffe520
rsp 0x7fffffffe460 0x7fffffffe460
r8 0x3651152370 233288573808
r9 0x3650a0d620 233280951840
r10 0x0 0
r11 0x3650e33560 233285301600
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x400884 0x400884 <main()+20>
eflags 0x206 [ PF IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
(gdb) x /10xg 0x7fffffffe4e0
0x7fffffffe4e0: 0x0000000100000000 0x3ff0000000000000
0x7fffffffe4f0: 0x00000036548e6100 0x0000003650c1bbc0
0x7fffffffe500: 0x0000000000400930 0x0000000000000000
0x7fffffffe510: 0x00007fffffffe600 0x0000000000000000
0x7fffffffe520: 0x0000000000000000 0x0000003650e1d994
0x7fffffffe4e0: 0x0000000100000000 0x3ff0000000000000
0x7fffffffe4f0: 0x00000036548e6100 0x0000003650c1bbc0
0x7fffffffe500: 0x0000000000400930 0x0000000000000000
0x7fffffffe510: 0x00007fffffffe600 0x0000000000000000
0x7fffffffe520: 0x0000000000000000 0x0000003650e1d994
发现，栈的sp和bp值回归到了步骤6的模样，就像什么事情也没有发生过一样，期间，我们发现，m中的数组d并没有进行任何的赋值，里面的值是乱值，所以这也进一步确定了类里的成员变量的初始值是不确定的，这一点符合C++的语法，但是编译器其实是可以聪明一点的，取决于有没有必要，如果要的话，可能会额外调用一下memset。
-------------------------------------------------------------------------------------------------------------------------------------------------------------------
14. 继续si，接下来对后续的执行情况进行step by step的分析
26 AAABBBCCC n = changeAAABBBCCC(m);
0x0000000000400884 <+20>: lea -0x80(%rbp),%rdi 将rbp地址值(0x7fffffffe520)-0x80,然后赋值给%rdi（存的是0x7fffffffe4a0）
0x0000000000400884 <+20>: lea -0x80(%rbp),%rdi 将rbp地址值(0x7fffffffe520)-0x80,然后赋值给%rdi（存的是0x7fffffffe4a0）
0x0000000000400888 <+24>: mov -0x40(%rbp),%rax 将地址值(0x7fffffffe4e0)处的内容赋值给%rax，%rax=0x100000000
0x000000000040088c <+28>: mov %rax,(%rsp) 将%rax里的值赋值给%rsp所指的地址（0x7fffffffe460）， 这个地址现在里面存的是0x100000000
=> 0x0000000000400890 <+32>: mov -0x38(%rbp),%rax 将地址值(0x7fffffffe4e8)处的内容赋值给%rax，%rax=0x3ff0000000000000 (浮点数2.0)
0x0000000000400894 <+36>: mov %rax,0x8(%rsp) 将%rax里的值赋值给%rsp所指的地址（0x7fffffffe468）， 这个地址现在里面存的是0x3ff0000000000000
0x0000000000400899 <+41>: mov -0x30(%rbp),%rax 接下来的这10个语句是把5*8个字节，也就是数组m.d,的拷贝，由于没有初始化，所以还是乱值。
0x000000000040089d <+45>: mov %rax,0x10(%rsp)
0x00000000004008a2 <+50>: mov -0x28(%rbp),%rax
0x00000000004008a6 <+54>: mov %rax,0x18(%rsp)
0x00000000004008ab <+59>: mov -0x20(%rbp),%rax
0x00000000004008af <+63>: mov %rax,0x20(%rsp)
0x00000000004008b4 <+68>: mov -0x18(%rbp),%rax
0x00000000004008b8 <+72>: mov %rax,0x28(%rsp)
0x00000000004008bd <+77>: mov -0x10(%rbp),%rax
0x00000000004008c1 <+81>: mov %rax,0x30(%rsp)
0x00000000004008c6 <+86>: callq 0x4007a8 <changeAAABBBCCC(AAABBBCCC)> 调用changeAAABBBCCC函数，
0x000000000040088c <+28>: mov %rax,(%rsp) 将%rax里的值赋值给%rsp所指的地址（0x7fffffffe460）， 这个地址现在里面存的是0x100000000
=> 0x0000000000400890 <+32>: mov -0x38(%rbp),%rax 将地址值(0x7fffffffe4e8)处的内容赋值给%rax，%rax=0x3ff0000000000000 (浮点数2.0)
0x0000000000400894 <+36>: mov %rax,0x8(%rsp) 将%rax里的值赋值给%rsp所指的地址（0x7fffffffe468）， 这个地址现在里面存的是0x3ff0000000000000
0x0000000000400899 <+41>: mov -0x30(%rbp),%rax 接下来的这10个语句是把5*8个字节，也就是数组m.d,的拷贝，由于没有初始化，所以还是乱值。
0x000000000040089d <+45>: mov %rax,0x10(%rsp)
0x00000000004008a2 <+50>: mov -0x28(%rbp),%rax
0x00000000004008a6 <+54>: mov %rax,0x18(%rsp)
0x00000000004008ab <+59>: mov -0x20(%rbp),%rax
0x00000000004008af <+63>: mov %rax,0x20(%rsp)
0x00000000004008b4 <+68>: mov -0x18(%rbp),%rax
0x00000000004008b8 <+72>: mov %rax,0x28(%rsp)
0x00000000004008bd <+77>: mov -0x10(%rbp),%rax
0x00000000004008c1 <+81>: mov %rax,0x30(%rsp)
0x00000000004008c6 <+86>: callq 0x4007a8 <changeAAABBBCCC(AAABBBCCC)> 调用changeAAABBBCCC函数，
到达这一步，内存分布如下所示：
15. 继续si，调用changeAAABBBCCC之前的现场如下：
(gdb) i reg
rax 0x7fffffffe600 140737488348672
rbx 0x3650c1bbc0 233283107776
rcx 0x4 4
rdx 0x7fffffffe4e0 140737488348384
rsi 0x7fffffffe608 140737488348680
rdi 0x7fffffffe4a0 140737488348320
rbp 0x7fffffffe520 0x7fffffffe520
rsp 0x7fffffffe460 0x7fffffffe460
r8 0x3651152370 233288573808
r9 0x3650a0d620 233280951840
r10 0x0 0
r11 0x3650e33560 233285301600
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x4008c6 0x4008c6 <main()+86>
eflags 0x206 [ PF IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
(gdb) disas /m
Dump of assembler code for function main():
23 int main ()
0x0000000000400870 <+0>: push %rbp
0x0000000000400871 <+1>: mov %rsp,%rbp
0x0000000000400874 <+4>: sub $0xc0,%rsp
24 {
25 AAABBBCCC m;
0x000000000040087b <+11>: lea -0x40(%rbp),%rdi
0x000000000040087f <+15>: callq 0x4008ea <AAABBBCCC::AAABBBCCC()>
26 AAABBBCCC n = changeAAABBBCCC(m);
0x0000000000400884 <+20>: lea -0x80(%rbp),%rdi
0x0000000000400888 <+24>: mov -0x40(%rbp),%rax
0x000000000040088c <+28>: mov %rax,(%rsp)
0x0000000000400890 <+32>: mov -0x38(%rbp),%rax
0x0000000000400894 <+36>: mov %rax,0x8(%rsp)
0x0000000000400899 <+41>: mov -0x30(%rbp),%rax
0x000000000040089d <+45>: mov %rax,0x10(%rsp)
0x00000000004008a2 <+50>: mov -0x28(%rbp),%rax
0x00000000004008a6 <+54>: mov %rax,0x18(%rsp)
0x00000000004008ab <+59>: mov -0x20(%rbp),%rax
0x00000000004008af <+63>: mov %rax,0x20(%rsp)
0x00000000004008b4 <+68>: mov -0x18(%rbp),%rax
0x00000000004008b8 <+72>: mov %rax,0x28(%rsp)
0x00000000004008bd <+77>: mov -0x10(%rbp),%rax
0x00000000004008c1 <+81>: mov %rax,0x30(%rsp)
=> 0x00000000004008c6 <+86>: callq 0x4007a8 <changeAAABBBCCC(AAABBBCCC)>
27 cout<<n.b<<endl;
0x00000000004008cb <+91>: mov -0x7c(%rbp),%esi
0x00000000004008ce <+94>: mov $0x600e00,%edi
0x00000000004008d3 <+99>: callq 0x400650 <_ZNSolsEi@plt>
0x00000000004008d8 <+104>: mov %rax,%rdi
0x00000000004008db <+107>: mov $0x4006b0,%esi
0x00000000004008e0 <+112>: callq 0x4006a0 <_ZNSolsEPFRSoS_E@plt>
28 return n.a;
0x00000000004008e5 <+117>: mov -0x80(%rbp),%eax
29 }
0x00000000004008e8 <+120>: leaveq
0x00000000004008e9 <+121>: retq
End of assembler dump.
rax 0x7fffffffe600 140737488348672
rbx 0x3650c1bbc0 233283107776
rcx 0x4 4
rdx 0x7fffffffe4e0 140737488348384
rsi 0x7fffffffe608 140737488348680
rdi 0x7fffffffe4a0 140737488348320
rbp 0x7fffffffe520 0x7fffffffe520
rsp 0x7fffffffe460 0x7fffffffe460
r8 0x3651152370 233288573808
r9 0x3650a0d620 233280951840
r10 0x0 0
r11 0x3650e33560 233285301600
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x4008c6 0x4008c6 <main()+86>
eflags 0x206 [ PF IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
(gdb) disas /m
Dump of assembler code for function main():
23 int main ()
0x0000000000400870 <+0>: push %rbp
0x0000000000400871 <+1>: mov %rsp,%rbp
0x0000000000400874 <+4>: sub $0xc0,%rsp
24 {
25 AAABBBCCC m;
0x000000000040087b <+11>: lea -0x40(%rbp),%rdi
0x000000000040087f <+15>: callq 0x4008ea <AAABBBCCC::AAABBBCCC()>
26 AAABBBCCC n = changeAAABBBCCC(m);
0x0000000000400884 <+20>: lea -0x80(%rbp),%rdi
0x0000000000400888 <+24>: mov -0x40(%rbp),%rax
0x000000000040088c <+28>: mov %rax,(%rsp)
0x0000000000400890 <+32>: mov -0x38(%rbp),%rax
0x0000000000400894 <+36>: mov %rax,0x8(%rsp)
0x0000000000400899 <+41>: mov -0x30(%rbp),%rax
0x000000000040089d <+45>: mov %rax,0x10(%rsp)
0x00000000004008a2 <+50>: mov -0x28(%rbp),%rax
0x00000000004008a6 <+54>: mov %rax,0x18(%rsp)
0x00000000004008ab <+59>: mov -0x20(%rbp),%rax
0x00000000004008af <+63>: mov %rax,0x20(%rsp)
0x00000000004008b4 <+68>: mov -0x18(%rbp),%rax
0x00000000004008b8 <+72>: mov %rax,0x28(%rsp)
0x00000000004008bd <+77>: mov -0x10(%rbp),%rax
0x00000000004008c1 <+81>: mov %rax,0x30(%rsp)
=> 0x00000000004008c6 <+86>: callq 0x4007a8 <changeAAABBBCCC(AAABBBCCC)>
27 cout<<n.b<<endl;
0x00000000004008cb <+91>: mov -0x7c(%rbp),%esi
0x00000000004008ce <+94>: mov $0x600e00,%edi
0x00000000004008d3 <+99>: callq 0x400650 <_ZNSolsEi@plt>
0x00000000004008d8 <+104>: mov %rax,%rdi
0x00000000004008db <+107>: mov $0x4006b0,%esi
0x00000000004008e0 <+112>: callq 0x4006a0 <_ZNSolsEPFRSoS_E@plt>
28 return n.a;
0x00000000004008e5 <+117>: mov -0x80(%rbp),%eax
29 }
0x00000000004008e8 <+120>: leaveq
0x00000000004008e9 <+121>: retq
End of assembler dump.
16. 继续 si，进入函数
changeAAABBBCCC (m=...) at myEx.cpp:1414 AAABBBCCC changeAAABBBCCC(AAABBBCCC m)
(gdb) disas /m
Dump of assembler code for function changeAAABBBCCC(AAABBBCCC):
14 AAABBBCCC changeA
AABBBCCC(AAABBBCCC m)
=> 0x00000000004007a8 <+0>: push %rbp 在这之前会先将函数返回后的下一条指令进行入栈操作，然后再保护rbp，rsp
0x00000000004007a9 <+1>: mov %rsp,%rbp
15 {
16 m.a = 10;
0x00000000004007ac <+4>: movl $0xa,0x10(%rbp) 这是将10赋值给地址0x7fffffffe460，此时%rbp + 0x10，由于这个函数使用的是传值调用，
=> 0x00000000004007a8 <+0>: push %rbp 在这之前会先将函数返回后的下一条指令进行入栈操作，然后再保护rbp，rsp
0x00000000004007a9 <+1>: mov %rsp,%rbp
15 {
16 m.a = 10;
0x00000000004007ac <+4>: movl $0xa,0x10(%rbp) 这是将10赋值给地址0x7fffffffe460，此时%rbp + 0x10，由于这个函数使用的是传值调用，
前面在函数调用的时候，没有像常规那样把第一个参数传递给%rdi，因为这是个结构体，大于8字节，所以用堆栈来实现参数的传递，对于传引用的话，以后有机会再给个小例子。
17 m.b = 20;
0x00000000004007b3 <+11>: movl $0x14,0x14(%rbp)
18 m.c = 2.0;
0x00000000004007ba <+18>: movabs $0x4000000000000000,%rax
0x00000000004007c4 <+28>: mov %rax,0x18(%rbp)
19 return m;
0x00000000004007c8 <+32>: mov 0x10(%rbp),%rax
0x00000000004007cc <+36>: mov %rax,(%rdi)
0x00000000004007cf <+39>: mov 0x18(%rbp),%rax
0x00000000004007d3 <+43>: mov %rax,0x8(%rdi)
0x00000000004007d7 <+47>: mov 0x20(%rbp),%rax
0x00000000004007db <+51>: mov %rax,0x10(%rdi)
0x00000000004007df <+55>: mov 0x28(%rbp),%rax
0x00000000004007e3 <+59>: mov %rax,0x18(%rdi)
0x00000000004007e7 <+63>: mov 0x30(%rbp),%rax
0x00000000004007eb <+67>: mov %rax,0x20(%rdi)
0x00000000004007ef <+71>: mov 0x38(%rbp),%rax
0x00000000004007f3 <+75>: mov %rax,0x28(%rdi)
0x00000000004007f7 <+79>: mov 0x40(%rbp),%rax
0x00000000004007fb <+83>: mov %rax,0x30(%rdi)
20 };
0x00000000004007ff <+87>: mov %rdi,%rax
0x0000000000400802 <+90>: leaveq
0x0000000000400803 <+91>: retq
End of assembler dump.
(gdb) i reg
rax 0x7fffffffe600 140737488348672
rbx 0x3650c1bbc0 233283107776
rcx 0x4 4
rdx 0x7fffffffe4e0 140737488348384
rsi 0x7fffffffe608 140737488348680
rdi 0x7fffffffe4a0 140737488348320
rbp 0x7fffffffe520 0x7fffffffe520
rsp 0x7fffffffe458 0x7fffffffe458
r8 0x3651152370 233288573808
r9 0x3650a0d620 233280951840
r10 0x0 0
r11 0x3650e33560 233285301600
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x4007a8 0x4007a8 <changeAAABBBCCC(AAABBBCCC)>
eflags 0x206 [ PF IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
17 m.b = 20;
0x00000000004007b3 <+11>: movl $0x14,0x14(%rbp)
18 m.c = 2.0;
0x00000000004007ba <+18>: movabs $0x4000000000000000,%rax
0x00000000004007c4 <+28>: mov %rax,0x18(%rbp)
19 return m;
0x00000000004007c8 <+32>: mov 0x10(%rbp),%rax
0x00000000004007cc <+36>: mov %rax,(%rdi)
0x00000000004007cf <+39>: mov 0x18(%rbp),%rax
0x00000000004007d3 <+43>: mov %rax,0x8(%rdi)
0x00000000004007d7 <+47>: mov 0x20(%rbp),%rax
0x00000000004007db <+51>: mov %rax,0x10(%rdi)
0x00000000004007df <+55>: mov 0x28(%rbp),%rax
0x00000000004007e3 <+59>: mov %rax,0x18(%rdi)
0x00000000004007e7 <+63>: mov 0x30(%rbp),%rax
0x00000000004007eb <+67>: mov %rax,0x20(%rdi)
0x00000000004007ef <+71>: mov 0x38(%rbp),%rax
0x00000000004007f3 <+75>: mov %rax,0x28(%rdi)
0x00000000004007f7 <+79>: mov 0x40(%rbp),%rax
0x00000000004007fb <+83>: mov %rax,0x30(%rdi)
20 };
0x00000000004007ff <+87>: mov %rdi,%rax
0x0000000000400802 <+90>: leaveq
0x0000000000400803 <+91>: retq
End of assembler dump.
(gdb) i reg
rax 0x7fffffffe600 140737488348672
rbx 0x3650c1bbc0 233283107776
rcx 0x4 4
rdx 0x7fffffffe4e0 140737488348384
rsi 0x7fffffffe608 140737488348680
rdi 0x7fffffffe4a0 140737488348320
rbp 0x7fffffffe520 0x7fffffffe520
rsp 0x7fffffffe458 0x7fffffffe458
r8 0x3651152370 233288573808
r9 0x3650a0d620 233280951840
r10 0x0 0
r11 0x3650e33560 233285301600
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x4007a8 0x4007a8 <changeAAABBBCCC(AAABBBCCC)>
eflags 0x206 [ PF IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
17. 继续si
(gdb) disas /m
Dump of assembler code for function changeAAABBBCCC(AAABBBCCC):
14 AAABBBCCC changeAAABBBCCC(AAABBBCCC m)
0x00000000004007a8 <+0>: push %rbp
=> 0x00000000004007a9 <+1>: mov %rsp,%rbp 把0x7fffffffe450，赋值给rbp
15 {
16 m.a = 10;
0x00000000004007ac <+4>: movl $0xa,0x10(%rbp) 将10赋值给0x7fffffffe450 + 0x10的这4字节，其实就是把传递给函数的这个对象的a成员赋值了。
17 m.b = 20;
0x00000000004007b3 <+11>: movl $0x14,0x14(%rbp) 将20赋值给0x7fffffffe450 + 0x14的这4字节，其实就是把传递给函数的这个对象的b成员赋值了。
18 m.c = 2.0;
0x00000000004007ba <+18>: movabs $0x4000000000000000,%rax 将2.0赋值给%rax的这8字节，为什么要从%rax里绕一下呢？这是由于movabs能直接操作64位立即数，但是有一个问题是movabs只能以%rax为目的位置。
0x00000000004007c4 <+28>: mov %rax,0x18(%rbp) 将2.0赋值给0x7fffffffe450 + 0x18的这8字节，其实就是把传递给函数的这个对象的c成员赋值了。
Dump of assembler code for function changeAAABBBCCC(AAABBBCCC):
14 AAABBBCCC changeAAABBBCCC(AAABBBCCC m)
0x00000000004007a8 <+0>: push %rbp
=> 0x00000000004007a9 <+1>: mov %rsp,%rbp 把0x7fffffffe450，赋值给rbp
15 {
16 m.a = 10;
0x00000000004007ac <+4>: movl $0xa,0x10(%rbp) 将10赋值给0x7fffffffe450 + 0x10的这4字节，其实就是把传递给函数的这个对象的a成员赋值了。
17 m.b = 20;
0x00000000004007b3 <+11>: movl $0x14,0x14(%rbp) 将20赋值给0x7fffffffe450 + 0x14的这4字节，其实就是把传递给函数的这个对象的b成员赋值了。
18 m.c = 2.0;
0x00000000004007ba <+18>: movabs $0x4000000000000000,%rax 将2.0赋值给%rax的这8字节，为什么要从%rax里绕一下呢？这是由于movabs能直接操作64位立即数，但是有一个问题是movabs只能以%rax为目的位置。
0x00000000004007c4 <+28>: mov %rax,0x18(%rbp) 将2.0赋值给0x7fffffffe450 + 0x18的这8字节，其实就是把传递给函数的这个对象的c成员赋值了。
19 return m;
0x00000000004007c8 <+32>: mov 0x10(%rbp),%rax
0x00000000004007cc <+36>: mov %rax,(%rdi) 这两句就是把函数里的m.a以及m.b(这不是真正的m，而是传递给函数的m的拷贝)赋值给n.a和n.b
0x00000000004007cf <+39>: mov 0x18(%rbp),%rax
0x00000000004007d3 <+43>: mov %rax,0x8(%rdi) 把函数里的m.c赋值给n.c
0x00000000004007d7 <+47>: mov 0x20(%rbp),%rax 剩下的就是把数组m.d拷贝到n.d中。
0x00000000004007db <+51>: mov %rax,0x10(%rdi)
0x00000000004007df <+55>: mov 0x28(%rbp),%rax
0x00000000004007e3 <+59>: mov %rax,0x18(%rdi)
0x00000000004007e7 <+63>: mov 0x30(%rbp),%rax
0x00000000004007eb <+67>: mov %rax,0x20(%rdi)
0x00000000004007ef <+71>: mov 0x38(%rbp),%rax
0x00000000004007f3 <+75>: mov %rax,0x28(%rdi)
0x00000000004007f7 <+79>: mov 0x40(%rbp),%rax
0x00000000004007fb <+83>: mov %rax,0x30(%rdi)
20 };
0x00000000004007ff <+87>: mov %rdi,%rax
0x0000000000400802 <+90>: leaveq
0x0000000000400803 <+91>: retq
End of assembler dump.
(gdb) i reg
rax 0x7fffffffe600 140737488348672
rbx 0x3650c1bbc0 233283107776
rcx 0x4 4
rdx 0x7fffffffe4e0 140737488348384
rsi 0x7fffffffe608 140737488348680
rdi 0x7fffffffe4a0 140737488348320
rbp 0x7fffffffe520 0x7fffffffe520
rsp 0x7fffffffe450 0x7fffffffe450
r8 0x3651152370 233288573808
r9 0x3650a0d620 233280951840
r10 0x0 0
r11 0x3650e33560 233285301600
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x4007a9 0x4007a9 <changeAAABBBCCC(AAABBBCCC)+1>
eflags 0x206 [ PF IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
18. 继续si
(gdb) disas /m
Dump of assembler code for function main():
23 int main ()
0x0000000000400870 <+0>: push %rbp
0x0000000000400871 <+1>: mov %rsp,%rbp
0x0000000000400874 <+4>: sub $0xc0,%rsp
24 {
25 AAABBBCCC m;
0x000000000040087b <+11>: lea -0x40(%rbp),%rdi
0x000000000040087f <+15>: callq 0x4008ea <AAABBBCCC::AAABBBCCC()>
26 AAABBBCCC n = changeAAABBBCCC(m);
0x0000000000400884 <+20>: lea -0x80(%rbp),%rdi
0x0000000000400888 <+24>: mov -0x40(%rbp),%rax
0x000000000040088c <+28>: mov %rax,(%rsp)
0x0000000000400890 <+32>: mov -0x38(%rbp),%rax
0x0000000000400894 <+36>: mov %rax,0x8(%rsp)
0x0000000000400899 <+41>: mov -0x30(%rbp),%rax
0x000000000040089d <+45>: mov %rax,0x10(%rsp)
0x00000000004008a2 <+50>: mov -0x28(%rbp),%rax
0x00000000004008a6 <+54>: mov %rax,0x18(%rsp)
0x00000000004008ab <+59>: mov -0x20(%rbp),%rax
0x00000000004008af <+63>: mov %rax,0x20(%rsp)
0x00000000004008b4 <+68>: mov -0x18(%rbp),%rax
0x00000000004008b8 <+72>: mov %rax,0x28(%rsp)
0x00000000004008bd <+77>: mov -0x10(%rbp),%rax
0x00000000004008c1 <+81>: mov %rax,0x30(%rsp)
0x00000000004008c6 <+86>: callq 0x4007a8 <changeAAABBBCCC(AAABBBCCC)>
27 cout<<n.b<<endl;
=> 0x00000000004008cb <+91>: mov -0x7c(%rbp),%esi 参数传递先传第二个，将0x7fffffffe4a4后的4字节也就是n.b赋值给%esi，这时候(gdb) p /x $rsi $7 = 0x14 结果就是20，高4字节清0了。
0x00000000004008ce <+94>: mov $0x600e00,%edi 准备第一个参数，cout ??
0x00000000004008d3 <+99>: callq 0x400650 <_ZNSolsEi@plt> "_ZNSolsEi" is "std::ostream::operator<<(int)" 通过步骤2中的nm 和nm -C可以对照找到这两个函数的名字
0x00000000004008d8 <+104>: mov %rax,%rdi
0x00000000004008db <+107>: mov $0x4006b0,%esi
0x00000000004008e0 <+112>: callq 0x4006a0 <_ZNSolsEPFRSoS_E@plt> 调用std::ostream::operator<<(std::ostream& (*)(std::ostream&))
28 return n.a;
0x00000000004008e5 <+117>: mov -0x80(%rbp),%eax 将0x7fffffffe4a0后的4字节也就是n.a赋值给%eax,这时候(gdb) p $rax $1 = 10
Dump of assembler code for function main():
23 int main ()
0x0000000000400870 <+0>: push %rbp
0x0000000000400871 <+1>: mov %rsp,%rbp
0x0000000000400874 <+4>: sub $0xc0,%rsp
24 {
25 AAABBBCCC m;
0x000000000040087b <+11>: lea -0x40(%rbp),%rdi
0x000000000040087f <+15>: callq 0x4008ea <AAABBBCCC::AAABBBCCC()>
26 AAABBBCCC n = changeAAABBBCCC(m);
0x0000000000400884 <+20>: lea -0x80(%rbp),%rdi
0x0000000000400888 <+24>: mov -0x40(%rbp),%rax
0x000000000040088c <+28>: mov %rax,(%rsp)
0x0000000000400890 <+32>: mov -0x38(%rbp),%rax
0x0000000000400894 <+36>: mov %rax,0x8(%rsp)
0x0000000000400899 <+41>: mov -0x30(%rbp),%rax
0x000000000040089d <+45>: mov %rax,0x10(%rsp)
0x00000000004008a2 <+50>: mov -0x28(%rbp),%rax
0x00000000004008a6 <+54>: mov %rax,0x18(%rsp)
0x00000000004008ab <+59>: mov -0x20(%rbp),%rax
0x00000000004008af <+63>: mov %rax,0x20(%rsp)
0x00000000004008b4 <+68>: mov -0x18(%rbp),%rax
0x00000000004008b8 <+72>: mov %rax,0x28(%rsp)
0x00000000004008bd <+77>: mov -0x10(%rbp),%rax
0x00000000004008c1 <+81>: mov %rax,0x30(%rsp)
0x00000000004008c6 <+86>: callq 0x4007a8 <changeAAABBBCCC(AAABBBCCC)>
27 cout<<n.b<<endl;
=> 0x00000000004008cb <+91>: mov -0x7c(%rbp),%esi 参数传递先传第二个，将0x7fffffffe4a4后的4字节也就是n.b赋值给%esi，这时候(gdb) p /x $rsi $7 = 0x14 结果就是20，高4字节清0了。
0x00000000004008ce <+94>: mov $0x600e00,%edi 准备第一个参数，cout ??
0x00000000004008d3 <+99>: callq 0x400650 <_ZNSolsEi@plt> "_ZNSolsEi" is "std::ostream::operator<<(int)" 通过步骤2中的nm 和nm -C可以对照找到这两个函数的名字
0x00000000004008d8 <+104>: mov %rax,%rdi
0x00000000004008db <+107>: mov $0x4006b0,%esi
0x00000000004008e0 <+112>: callq 0x4006a0 <_ZNSolsEPFRSoS_E@plt> 调用std::ostream::operator<<(std::ostream& (*)(std::ostream&))
28 return n.a;
0x00000000004008e5 <+117>: mov -0x80(%rbp),%eax 将0x7fffffffe4a0后的4字节也就是n.a赋值给%eax,这时候(gdb) p $rax $1 = 10
29 }
0x00000000004008e8 <+120>: leaveq
0x00000000004008e9 <+121>: retq
---Type <return> to continue, or q <return> to quit---
End of assembler dump.
(gdb) i reg
rax 0x7fffffffe4a0 140737488348320
rbx 0x3650c1bbc0 233283107776
rcx 0x4 4
rdx 0x7fffffffe4e0 140737488348384
rsi 0x7fffffffe608 140737488348680
rdi 0x7fffffffe4a0 140737488348320
rbp 0x7fffffffe520 0x7fffffffe520
rsp 0x7fffffffe460 0x7fffffffe460
r8 0x3651152370 233288573808
r9 0x3650a0d620 233280951840
r10 0x0 0
r11 0x3650e33560 233285301600
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x4008cb 0x4008cb <main()+91>
eflags 0x206 [ PF IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
19. 退出main之前的现场
(gdb) disas /m
Dump of assembler code for function main():
23 int main ()
0x0000000000400870 <+0>: push %rbp
0x0000000000400871 <+1>: mov %rsp,%rbp
0x0000000000400874 <+4>: sub $0xc0,%rsp
24 {
25 AAABBBCCC m;
0x000000000040087b <+11>: lea -0x40(%rbp),%rdi
0x000000000040087f <+15>: callq 0x4008ea <AAABBBCCC::AAABBBCCC()>
26 AAABBBCCC n = changeAAABBBCCC(m);
0x0000000000400884 <+20>: lea -0x80(%rbp),%rdi
0x0000000000400888 <+24>: mov -0x40(%rbp),%rax
0x000000000040088c <+28>: mov %rax,(%rsp)
0x0000000000400890 <+32>: mov -0x38(%rbp),%rax
0x0000000000400894 <+36>: mov %rax,0x8(%rsp)
0x0000000000400899 <+41>: mov -0x30(%rbp),%rax
0x000000000040089d <+45>: mov %rax,0x10(%rsp)
0x00000000004008a2 <+50>: mov -0x28(%rbp),%rax
0x00000000004008a6 <+54>: mov %rax,0x18(%rsp)
0x00000000004008ab <+59>: mov -0x20(%rbp),%rax
0x00000000004008af <+63>: mov %rax,0x20(%rsp)
0x00000000004008b4 <+68>: mov -0x18(%rbp),%rax
0x00000000004008b8 <+72>: mov %rax,0x28(%rsp)
0x00000000004008bd <+77>: mov -0x10(%rbp),%rax
0x00000000004008c1 <+81>: mov %rax,0x30(%rsp)
0x00000000004008c6 <+86>: callq 0x4007a8 <changeAAABBBCCC(AAABBBCCC)>
27 cout<<n.b<<endl;
0x00000000004008cb <+91>: mov -0x7c(%rbp),%esi
0x00000000004008ce <+94>: mov $0x600e00,%edi
0x00000000004008d3 <+99>: callq 0x400650 <_ZNSolsEi@plt>
0x00000000004008d8 <+104>: mov %rax,%rdi
0x00000000004008db <+107>: mov $0x4006b0,%esi
0x00000000004008e0 <+112>: callq 0x4006a0 <_ZNSolsEPFRSoS_E@plt>
28 return n.a;
0x00000000004008e5 <+117>: mov -0x80(%rbp),%eax
29 }
0x00000000004008e8 <+120>: leaveq
=> 0x00000000004008e9 <+121>: retq
---Type <return> to continue, or q <return> to quit---
End of assembler dump.
(gdb)
(gdb) i reg
rax 0xa 10
rbx 0x3650c1bbc0 233283107776
rcx 0x3650ec5f80 233285902208
rdx 0x3651152980 233288575360
rsi 0x0 0
rdi 0x3651151780 233288570752
rbp 0x0 0x0
rsp 0x7fffffffe528 0x7fffffffe528
r8 0x7ffff7de36f0 140737351923440
r9 0x7ffff7de36f0 140737351923440
r10 0x0 0
r11 0x3650e61180 233285489024
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x4008e9 0x4008e9 <main()+121>
eflags 0x202 [ IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
Dump of assembler code for function main():
23 int main ()
0x0000000000400870 <+0>: push %rbp
0x0000000000400871 <+1>: mov %rsp,%rbp
0x0000000000400874 <+4>: sub $0xc0,%rsp
24 {
25 AAABBBCCC m;
0x000000000040087b <+11>: lea -0x40(%rbp),%rdi
0x000000000040087f <+15>: callq 0x4008ea <AAABBBCCC::AAABBBCCC()>
26 AAABBBCCC n = changeAAABBBCCC(m);
0x0000000000400884 <+20>: lea -0x80(%rbp),%rdi
0x0000000000400888 <+24>: mov -0x40(%rbp),%rax
0x000000000040088c <+28>: mov %rax,(%rsp)
0x0000000000400890 <+32>: mov -0x38(%rbp),%rax
0x0000000000400894 <+36>: mov %rax,0x8(%rsp)
0x0000000000400899 <+41>: mov -0x30(%rbp),%rax
0x000000000040089d <+45>: mov %rax,0x10(%rsp)
0x00000000004008a2 <+50>: mov -0x28(%rbp),%rax
0x00000000004008a6 <+54>: mov %rax,0x18(%rsp)
0x00000000004008ab <+59>: mov -0x20(%rbp),%rax
0x00000000004008af <+63>: mov %rax,0x20(%rsp)
0x00000000004008b4 <+68>: mov -0x18(%rbp),%rax
0x00000000004008b8 <+72>: mov %rax,0x28(%rsp)
0x00000000004008bd <+77>: mov -0x10(%rbp),%rax
0x00000000004008c1 <+81>: mov %rax,0x30(%rsp)
0x00000000004008c6 <+86>: callq 0x4007a8 <changeAAABBBCCC(AAABBBCCC)>
27 cout<<n.b<<endl;
0x00000000004008cb <+91>: mov -0x7c(%rbp),%esi
0x00000000004008ce <+94>: mov $0x600e00,%edi
0x00000000004008d3 <+99>: callq 0x400650 <_ZNSolsEi@plt>
0x00000000004008d8 <+104>: mov %rax,%rdi
0x00000000004008db <+107>: mov $0x4006b0,%esi
0x00000000004008e0 <+112>: callq 0x4006a0 <_ZNSolsEPFRSoS_E@plt>
28 return n.a;
0x00000000004008e5 <+117>: mov -0x80(%rbp),%eax
29 }
0x00000000004008e8 <+120>: leaveq
=> 0x00000000004008e9 <+121>: retq
---Type <return> to continue, or q <return> to quit---
End of assembler dump.
(gdb)
(gdb) i reg
rax 0xa 10
rbx 0x3650c1bbc0 233283107776
rcx 0x3650ec5f80 233285902208
rdx 0x3651152980 233288575360
rsi 0x0 0
rdi 0x3651151780 233288570752
rbp 0x0 0x0
rsp 0x7fffffffe528 0x7fffffffe528
r8 0x7ffff7de36f0 140737351923440
r9 0x7ffff7de36f0 140737351923440
r10 0x0 0
r11 0x3650e61180 233285489024
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x4008e9 0x4008e9 <main()+121>
eflags 0x202 [ IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
20. 继续si，就是main函数返回后
(gdb) si
0x0000003650e1d994 in __libc_start_main () from /lib64/libc.so.6 这是调用main函数的那个函数名字，在objdump里，我们已经看到
(gdb) disas /m
Dump of assembler code for function __libc_start_main:
0x0000003650e1d8a0 <+0>: mov %rbp,-0x20(%rsp)
0x0000003650e1d8a5 <+5>: mov %rbx,-0x28(%rsp)
0x0000003650e1d8aa <+10>: mov %rcx,%rbp
0x0000003650e1d8ad <+13>: mov %r12,-0x18(%rsp)
0x0000003650e1d8b2 <+18>: mov %r13,-0x10(%rsp)
0x0000003650e1d8b7 <+23>: mov %r14,-0x8(%rsp)
0x0000003650e1d8bc <+28>: sub $0xb8,%rsp
0x0000003650e1d8c3 <+35>: mov 0x33355e(%rip),%rax # 0x3651150e28 <free+3356352>
0x0000003650e1d8ca <+42>: mov %rdx,0x8(%rsp)
0x0000003650e1d8cf <+47>: xor %edx,%edx
0x0000003650e1d8d1 <+49>: mov %rdi,0x18(%rsp)
0x0000003650e1d8d6 <+54>: mov %esi,0x14(%rsp)
0x0000003650e1d8da <+58>: mov %r9,%rdi
0x0000003650e1d8dd <+61>: test %rax,%rax
0x0000003650e1d8e0 <+64>: jne 0x3650e1d99b <__libc_start_main+251>
0x0000003650e1d8e6 <+70>: mov 0x333693(%rip),%rax # 0x3651150f80 <free+3356696>
0x0000003650e1d8ed <+77>: test %rdi,%rdi
0x0000003650e1d8f0 <+80>: mov %edx,(%rax)
0x0000003650e1d8f2 <+82>: je 0x3650e1d8fd <__libc_start_main+93>
0x0000003650e1d8f4 <+84>: xor %edx,%edx
0x0000003650e1d8f6 <+86>: xor %esi,%esi
0x0000003650e1d8f8 <+88>: callq 0x3650e33560 <__cxa_atexit_internal>
0x0000003650e1d8fd <+93>: mov 0x333594(%rip),%rbx # 0x3651150e98 <free+3356464>
0x0000003650e1d904 <+100>: movslq (%rbx),%rax
0x0000003650e1d907 <+103>: mov %rax,%r12
0x0000003650e1d90a <+106>: and $0x2,%r12d
0x0000003650e1d90e <+110>: jne 0x3650e1da29 <__libc_start_main+393>
0x0000003650e1d914 <+116>: test %rbp,%rbp
0x0000003650e1d917 <+119>: je 0x3650e1d92e <__libc_start_main+142>
0x0000003650e1d919 <+121>: mov 0x333628(%rip),%rax # 0x3651150f48 <free+3356640>
0x0000003650e1d920 <+128>: mov 0x8(%rsp),%rsi
0x0000003650e1d925 <+133>: mov 0x14(%rsp),%edi
0x0000003650e1d929 <+137>: mov (%rax),%rdx
0x0000003650e1d92c <+140>: callq *%rbp
0x0000003650e1d92e <+142>: mov 0x100(%rbx),%ebp
0x0000003650e1d934 <+148>: test %ebp,%ebp
0x0000003650e1d936 <+150>: jne 0x3650e1d9e9 <__libc_start_main+329>
0x0000003650e1d93c <+156>: test %r12,%r12
0x0000003650e1d93f <+159>: jne 0x3650e1d9c6 <__libc_start_main+294>
0x0000003650e1d945 <+165>: lea 0x20(%rsp),%rdi
0x0000003650e1d94a <+170>: callq 0x3650e30080 <_setjmp>
0x0000003650e1d94f <+175>: test %eax,%eax
0x0000003650e1d951 <+177>: jne 0x3650e1d9a8 <__libc_start_main+264>
0x0000003650e1d953 <+179>: mov %fs:0xc0,%rax
0x0000003650e1d95c <+188>: mov %rax,0x68(%rsp)
0x0000003650e1d961 <+193>: mov %fs:0xb8,%rax
0x0000003650e1d96a <+202>: mov %rax,0x70(%rsp)
0x0000003650e1d96f <+207>: lea 0x20(%rsp),%rax
0x0000003650e1d974 <+212>: mov %rax,%fs:0xc0
0x0000003650e1d97d <+221>: mov 0x3335c4(%rip),%rax # 0x3651150f48 <free+3356640>
0x0000003650e1d984 <+228>: mov 0x14(%rsp),%edi
0x0000003650e1d988 <+232>: mov 0x8(%rsp),%rsi
0x0000003650e1d98d <+237>: mov (%rax),%rdx
0x0000003650e1d990 <+240>: callq *0x18(%rsp) 这就是对main函数的调用的地方
=> 0x0000003650e1d994 <+244>: mov %eax,%edi 把main的返回值10作为参数传递给下一个函数调用，
0x0000003650e1d996 <+246>: callq 0x3650e332c0 <exit> 这个函数其实就是exit
0x0000003650e1d99b <+251>: xor %edx,%edx 感兴趣的可以继续step by step
0x0000003650e1d99d <+253>: cmpl $0x0,(%rax)
0x0000003650e1d9a0 <+256>: sete %dl
0x0000003650e1d9a3 <+259>: jmpq 0x3650e1d8e6 <__libc_start_main+70>
0x0000003650e1d9a8 <+264>: callq *0x338562(%rip) # 0x3651155f10 <__libc_pthread_functions+400>
0x0000003650e1d9ae <+270>: mov 0x33854b(%rip),%rax # 0x3651155f00 <__libc_pthread_functions+384>
0x0000003650e1d9b5 <+277>: lock decl (%rax)
0x0000003650e1d9b8 <+280>: sete %dl
0x0000003650e1d9bb <+283>: xor %edi,%edi
0x0000003650e1d9bd <+285>: test %dl,%dl
0x0000003650e1d9bf <+287>: jne 0x3650e1d996 <__libc_start_main+246>
0x0000003650e1d9c1 <+289>: callq 0x3650ec4e90 <__exit_thread>
0x0000003650e1d9c6 <+294>: mov 0x8(%rsp),%rax
0x0000003650e1d9cb <+299>: mov 0x3334c6(%rip),%rdx # 0x3651150e98 <free+3356464>
0x0000003650e1d9d2 <+306>: lea 0x101a25(%rip),%rdi # 0x3650f1f3fe
0x0000003650e1d9d9 <+313>: mov (%rax),%rsi
0x0000003650e1d9dc <+316>: xor %eax,%eax
0x0000003650e1d9de <+318>: callq *0xb8(%rdx)
0x0000003650e1d9e4 <+324>: jmpq 0x3650e1d945 <__libc_start_main+165>
0x0000003650e1d9e9 <+329>: mov 0x3335a8(%rip),%rax # 0x3651150f98 <free+3356720>
0x0000003650e1d9f0 <+336>: mov 0xf8(%rbx),%rbx
0x0000003650e1d9f7 <+343>: xor %r13d,%r13d
0x0000003650e1d9fa <+346>: mov (%rax),%r14
0x0000003650e1d9fd <+349>: mov 0x18(%rbx),%rax
0x0000003650e1da01 <+353>: test %rax,%rax
0x0000003650e1da04 <+356>: je 0x3650e1da17 <__libc_start_main+375>
0x0000003650e1da06 <+358>: mov %r13d,%edi
0x0000003650e1da09 <+361>: shl $0x4,%rdi
0x0000003650e1da0d <+365>: lea 0x468(%rdi,%r14,1),%rdi
0x0000003650e1da15 <+373>: callq *%rax
0x0000003650e1da17 <+375>: add $0x1,%r13d
0x0000003650e1da1b <+379>: mov 0x40(%rbx),%rbx
0x0000003650e1da1f <+383>: cmp %ebp,%r13d
0x0000003650e1da22 <+386>: jne 0x3650e1d9fd <__libc_start_main+349>
0x0000003650e1da24 <+388>: jmpq 0x3650e1d93c <__libc_start_main+156>
0x0000003650e1da29 <+393>: mov 0x8(%rsp),%rax
0x0000003650e1da2e <+398>: lea 0x1019af(%rip),%rdi # 0x3650f1f3e4
0x0000003650e1da35 <+405>: mov (%rax),%rsi
0x0000003650e1da38 <+408>: xor %eax,%eax
0x0000003650e1da3a <+410>: callq *0xb8(%rbx)
0x0000003650e1da40 <+416>: jmpq 0x3650e1d914 <__libc_start_main+116>
End of assembler dump.
(gdb)
(gdb)
(gdb) i reg
rax 0xa 10
rbx 0x3650c1bbc0 233283107776
rcx 0x3650ec5f80 233285902208
rdx 0x3651152980 233288575360
rsi 0x0 0
rdi 0x3651151780 233288570752
rbp 0x0 0x0
rsp 0x7fffffffe530 0x7fffffffe530 刚才的main函数的栈整个都被撤销了，世界终于平静了，
r8 0x7ffff7de36f0 140737351923440
r9 0x7ffff7de36f0 140737351923440
r10 0x0 0
r11 0x3650e61180 233285489024
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x3650e1d994 0x3650e1d994 <__libc_start_main+244>
eflags 0x202 [ IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
0x0000003650e1d994 in __libc_start_main () from /lib64/libc.so.6 这是调用main函数的那个函数名字，在objdump里，我们已经看到
(gdb) disas /m
Dump of assembler code for function __libc_start_main:
0x0000003650e1d8a0 <+0>: mov %rbp,-0x20(%rsp)
0x0000003650e1d8a5 <+5>: mov %rbx,-0x28(%rsp)
0x0000003650e1d8aa <+10>: mov %rcx,%rbp
0x0000003650e1d8ad <+13>: mov %r12,-0x18(%rsp)
0x0000003650e1d8b2 <+18>: mov %r13,-0x10(%rsp)
0x0000003650e1d8b7 <+23>: mov %r14,-0x8(%rsp)
0x0000003650e1d8bc <+28>: sub $0xb8,%rsp
0x0000003650e1d8c3 <+35>: mov 0x33355e(%rip),%rax # 0x3651150e28 <free+3356352>
0x0000003650e1d8ca <+42>: mov %rdx,0x8(%rsp)
0x0000003650e1d8cf <+47>: xor %edx,%edx
0x0000003650e1d8d1 <+49>: mov %rdi,0x18(%rsp)
0x0000003650e1d8d6 <+54>: mov %esi,0x14(%rsp)
0x0000003650e1d8da <+58>: mov %r9,%rdi
0x0000003650e1d8dd <+61>: test %rax,%rax
0x0000003650e1d8e0 <+64>: jne 0x3650e1d99b <__libc_start_main+251>
0x0000003650e1d8e6 <+70>: mov 0x333693(%rip),%rax # 0x3651150f80 <free+3356696>
0x0000003650e1d8ed <+77>: test %rdi,%rdi
0x0000003650e1d8f0 <+80>: mov %edx,(%rax)
0x0000003650e1d8f2 <+82>: je 0x3650e1d8fd <__libc_start_main+93>
0x0000003650e1d8f4 <+84>: xor %edx,%edx
0x0000003650e1d8f6 <+86>: xor %esi,%esi
0x0000003650e1d8f8 <+88>: callq 0x3650e33560 <__cxa_atexit_internal>
0x0000003650e1d8fd <+93>: mov 0x333594(%rip),%rbx # 0x3651150e98 <free+3356464>
0x0000003650e1d904 <+100>: movslq (%rbx),%rax
0x0000003650e1d907 <+103>: mov %rax,%r12
0x0000003650e1d90a <+106>: and $0x2,%r12d
0x0000003650e1d90e <+110>: jne 0x3650e1da29 <__libc_start_main+393>
0x0000003650e1d914 <+116>: test %rbp,%rbp
0x0000003650e1d917 <+119>: je 0x3650e1d92e <__libc_start_main+142>
0x0000003650e1d919 <+121>: mov 0x333628(%rip),%rax # 0x3651150f48 <free+3356640>
0x0000003650e1d920 <+128>: mov 0x8(%rsp),%rsi
0x0000003650e1d925 <+133>: mov 0x14(%rsp),%edi
0x0000003650e1d929 <+137>: mov (%rax),%rdx
0x0000003650e1d92c <+140>: callq *%rbp
0x0000003650e1d92e <+142>: mov 0x100(%rbx),%ebp
0x0000003650e1d934 <+148>: test %ebp,%ebp
0x0000003650e1d936 <+150>: jne 0x3650e1d9e9 <__libc_start_main+329>
0x0000003650e1d93c <+156>: test %r12,%r12
0x0000003650e1d93f <+159>: jne 0x3650e1d9c6 <__libc_start_main+294>
0x0000003650e1d945 <+165>: lea 0x20(%rsp),%rdi
0x0000003650e1d94a <+170>: callq 0x3650e30080 <_setjmp>
0x0000003650e1d94f <+175>: test %eax,%eax
0x0000003650e1d951 <+177>: jne 0x3650e1d9a8 <__libc_start_main+264>
0x0000003650e1d953 <+179>: mov %fs:0xc0,%rax
0x0000003650e1d95c <+188>: mov %rax,0x68(%rsp)
0x0000003650e1d961 <+193>: mov %fs:0xb8,%rax
0x0000003650e1d96a <+202>: mov %rax,0x70(%rsp)
0x0000003650e1d96f <+207>: lea 0x20(%rsp),%rax
0x0000003650e1d974 <+212>: mov %rax,%fs:0xc0
0x0000003650e1d97d <+221>: mov 0x3335c4(%rip),%rax # 0x3651150f48 <free+3356640>
0x0000003650e1d984 <+228>: mov 0x14(%rsp),%edi
0x0000003650e1d988 <+232>: mov 0x8(%rsp),%rsi
0x0000003650e1d98d <+237>: mov (%rax),%rdx
0x0000003650e1d990 <+240>: callq *0x18(%rsp) 这就是对main函数的调用的地方
=> 0x0000003650e1d994 <+244>: mov %eax,%edi 把main的返回值10作为参数传递给下一个函数调用，
0x0000003650e1d996 <+246>: callq 0x3650e332c0 <exit> 这个函数其实就是exit
0x0000003650e1d99b <+251>: xor %edx,%edx 感兴趣的可以继续step by step
0x0000003650e1d99d <+253>: cmpl $0x0,(%rax)
0x0000003650e1d9a0 <+256>: sete %dl
0x0000003650e1d9a3 <+259>: jmpq 0x3650e1d8e6 <__libc_start_main+70>
0x0000003650e1d9a8 <+264>: callq *0x338562(%rip) # 0x3651155f10 <__libc_pthread_functions+400>
0x0000003650e1d9ae <+270>: mov 0x33854b(%rip),%rax # 0x3651155f00 <__libc_pthread_functions+384>
0x0000003650e1d9b5 <+277>: lock decl (%rax)
0x0000003650e1d9b8 <+280>: sete %dl
0x0000003650e1d9bb <+283>: xor %edi,%edi
0x0000003650e1d9bd <+285>: test %dl,%dl
0x0000003650e1d9bf <+287>: jne 0x3650e1d996 <__libc_start_main+246>
0x0000003650e1d9c1 <+289>: callq 0x3650ec4e90 <__exit_thread>
0x0000003650e1d9c6 <+294>: mov 0x8(%rsp),%rax
0x0000003650e1d9cb <+299>: mov 0x3334c6(%rip),%rdx # 0x3651150e98 <free+3356464>
0x0000003650e1d9d2 <+306>: lea 0x101a25(%rip),%rdi # 0x3650f1f3fe
0x0000003650e1d9d9 <+313>: mov (%rax),%rsi
0x0000003650e1d9dc <+316>: xor %eax,%eax
0x0000003650e1d9de <+318>: callq *0xb8(%rdx)
0x0000003650e1d9e4 <+324>: jmpq 0x3650e1d945 <__libc_start_main+165>
0x0000003650e1d9e9 <+329>: mov 0x3335a8(%rip),%rax # 0x3651150f98 <free+3356720>
0x0000003650e1d9f0 <+336>: mov 0xf8(%rbx),%rbx
0x0000003650e1d9f7 <+343>: xor %r13d,%r13d
0x0000003650e1d9fa <+346>: mov (%rax),%r14
0x0000003650e1d9fd <+349>: mov 0x18(%rbx),%rax
0x0000003650e1da01 <+353>: test %rax,%rax
0x0000003650e1da04 <+356>: je 0x3650e1da17 <__libc_start_main+375>
0x0000003650e1da06 <+358>: mov %r13d,%edi
0x0000003650e1da09 <+361>: shl $0x4,%rdi
0x0000003650e1da0d <+365>: lea 0x468(%rdi,%r14,1),%rdi
0x0000003650e1da15 <+373>: callq *%rax
0x0000003650e1da17 <+375>: add $0x1,%r13d
0x0000003650e1da1b <+379>: mov 0x40(%rbx),%rbx
0x0000003650e1da1f <+383>: cmp %ebp,%r13d
0x0000003650e1da22 <+386>: jne 0x3650e1d9fd <__libc_start_main+349>
0x0000003650e1da24 <+388>: jmpq 0x3650e1d93c <__libc_start_main+156>
0x0000003650e1da29 <+393>: mov 0x8(%rsp),%rax
0x0000003650e1da2e <+398>: lea 0x1019af(%rip),%rdi # 0x3650f1f3e4
0x0000003650e1da35 <+405>: mov (%rax),%rsi
0x0000003650e1da38 <+408>: xor %eax,%eax
0x0000003650e1da3a <+410>: callq *0xb8(%rbx)
0x0000003650e1da40 <+416>: jmpq 0x3650e1d914 <__libc_start_main+116>
End of assembler dump.
(gdb)
(gdb)
(gdb) i reg
rax 0xa 10
rbx 0x3650c1bbc0 233283107776
rcx 0x3650ec5f80 233285902208
rdx 0x3651152980 233288575360
rsi 0x0 0
rdi 0x3651151780 233288570752
rbp 0x0 0x0
rsp 0x7fffffffe530 0x7fffffffe530 刚才的main函数的栈整个都被撤销了，世界终于平静了，
r8 0x7ffff7de36f0 140737351923440
r9 0x7ffff7de36f0 140737351923440
r10 0x0 0
r11 0x3650e61180 233285489024
r12 0x0 0
r13 0x7fffffffe600 140737488348672
r14 0x0 0
r15 0x0 0
rip 0x3650e1d994 0x3650e1d994 <__libc_start_main+244>
eflags 0x202 [ IF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
fctrl 0x37f 895
fstat 0x0 0
ftag 0xffff 65535
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
mxcsr 0x1f80 [ IM DM ZM OM UM PM ]
