且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

如果EBP帧指针为NULL,堆栈是否损坏?

更新时间:2023-12-01 08:12:28


如您所见,EBP帧指针的值为NULL。因此,
我不能走堆栈。这是一个损坏的堆栈的迹象,还是
有另一个可能的解释?

As you can see, the value of the EBP frame pointer is NULL. Therefore, I cannot walk the stack. Is this the sign of a corrupted stack, or is there another possible explanation?

另一个解释,根源在于除了保存当前堆栈帧的地址之外,EBP寄存器还可以用于任何其他目的,例如通用寄存器。为了安全地这样做,需要两件事情:

I think there is another explanation, rooted in the fact that in addition to holding the address of the current stack frame, the EBP register can also be used for any other purpose like general-purpose registers. In order to do that safely, two things are required:


  1. 通过调用

  1. Store its current content to the stack by calling


PUSH EBP

PUSH EBP


  • 通用用法和退出当前过程之前调用

  • Restore the content after the general-purpose usage and before exiting the current procedue by calling


    POP EBP

    POP EBP


  • 所以我以为你遇到的情况不一定是由堆栈的损坏引起的,因为技术上可能是转储而EBP寄存器暂时被用于进程代码中的其他地方的通用用途,甚至可能不是你编写的代码。

    So I was thinking the case you were experiencing was not necessarily caused by corruption of the stack, as it technically may have been that the dump was generated while the EBP register was temporarily being used for general-purpose usage by someplace else in the process' code, maybe not even code you've written.