http://f4l.sourceforge.net/
顺便COPY段代码先扔这里：
--- d:\vsprojects\vcpros\consolepros\vckbase1\first.cpp -------------------
1: #include <stdio.h>
2:
3: int main(int argc, char** argv, char** envp)
4: {
00401010 push ebp ;save ebp(cpu->内存)
00401011 mov ebp,esp ;set stack frame pointer
00401013 sub esp,40h ;allocate space for locals
00401016 push ebx ;save registers-------下面内容均如此
00401017 push esi
00401018 push edi
00401019 lea edi,[ebp-40h]
0040101C mov ecx,10h
00401021 mov eax,0CCCCCCCCh
00401026 rep stos dword ptr [edi]
5: return 0;
00401028 xor eax,eax
6: }
0040102A pop edi
0040102B pop esi
0040102C pop ebx ;restore registers
0040102D mov esp,ebp ;restore stack pointer
0040102F pop ebp ;restore ebp
00401030 ret ;return from function
--- No source file --------------------------------------------------------
argc = 1 ;因为在VC中要读取你的*argv指向的应用程序名字(*.exe)
* argv = D:\VSPROJECTS\VCPROS\CONSOLEPROS\vckbase1\Debug\vckbase1.exe
* envp = ALLUSERSPROFILE=C:\Documents and Settings\All Users
=============================================================
Considerations when Writing Prolog/Epilog Code
Microsoft Specific —>
Before writing your own prolog and epilog code sequences, it is important to understand how the stack frame is laid out. It is also useful to know how to use the __LOCAL_SIZE predefined constant.
C Stack Frame Layout
This example shows the standard prolog code that might appear in a 32-bit function:
push ebp ; Save ebp
mov ebp, esp ; Set stack frame pointer
sub esp, localbytes ; Allocate space for locals
push <registers> ; Save registers
The localbytes variable represents the number of bytes needed on the stack for local variables, and the registers variable is a placeholder that represents the list of registers to be saved on the stack. After pushing the registers, you can place any other appropriate data on the stack. The following is the corresponding epilog code:
pop <registers> ; Restore registers
mov esp, ebp ; Restore stack pointer
pop ebp ; Restore ebp
ret ; Return from function
The stack always grows down (from high to low memory addresses). The base pointer (ebp) points to the pushed value of ebp. The local variables area begins at ebp-2. To access local variables, calculate an offset from ebp by subtracting the appropriate value from ebp.
The __LOCAL_SIZE Constant
The compiler provides a constant, __LOCAL_SIZE, for use in the inline assembler block of function prolog code. This constant is used to allocate space for local variables on the stack frame in custom prolog code.
The compiler determines the value of __LOCAL_SIZE. The value is the total number of bytes of all user-defined local variables and compiler-generated temporary variables. __LOCAL_SIZE can be used only as an immediate operand; it cannot be used in an expression. You must not change or redefine the value of this constant. For example:
mov eax, __LOCAL_SIZE ;Immediate operand--Okay
mov eax, [ebp - __LOCAL_SIZE] ;Error
The following example of a naked function containing custom prolog and epilog sequences uses __LOCAL_SIZE in the prolog sequence:
__declspec ( naked ) func()
{
int i;
int j;
__asm /* prolog */
{
push ebp
mov ebp, esp
sub esp, __LOCAL_SIZE
}
/* Function body */
__asm /* epilog */
{
mov esp, ebp
pop ebp
ret
}
}
END Microsoft Specific