更新时间:2023-12-01 08:12:28
如您所见,EBP帧指针的值为NULL。因此,
我不能走堆栈。这是一个损坏的堆栈的迹象,还是
有另一个可能的解释?
As you can see, the value of the EBP frame pointer is NULL. Therefore, I cannot walk the stack. Is this the sign of a corrupted stack, or is there another possible explanation?
另一个解释,根源在于除了保存当前堆栈帧的地址之外,EBP寄存器还可以用于任何其他目的,例如通用寄存器。为了安全地这样做,需要两件事情:
I think there is another explanation, rooted in the fact that in addition to holding the address of the current stack frame, the EBP register can also be used for any other purpose like general-purpose registers. In order to do that safely, two things are required:
通过调用
Store its current content to the stack by calling
PUSH EBP
PUSH EBP
通用用法和退出当前过程之前调用
Restore the content after the general-purpose usage and before exiting the current procedue by calling
POP EBP
POP EBP
所以我以为你遇到的情况不一定是由堆栈的损坏引起的,因为技术上可能是转储而EBP寄存器暂时被用于进程代码中的其他地方的通用用途,甚至可能不是你编写的代码。
So I was thinking the case you were experiencing was not necessarily caused by corruption of the stack, as it technically may have been that the dump was generated while the EBP register was temporarily being used for general-purpose usage by someplace else in the process' code, maybe not even code you've written.