C语言 _malloc 在汇编中究竟做了什么？

What exactly does _malloc do in assembly?

提问by user3089458

public main
main proc near
push    ebp
mov     ebp, esp
and     esp, 0FFFFFFF0h
sub     esp, 30h
mov     dword ptr [esp], 8 ; size
call    _malloc
mov     [esp+2Ch], eax
mov     dword ptr [esp+4], 4
mov     eax, [esp+2Ch]
mov     [esp], eax
call    __start

The code above represents a portion of a large project I am working on. I am trying to reverse this code into C equivalent but I am having difficulty understanding how malloc works.

上面的代码代表了我正在处理的一个大型项目的一部分。我正在尝试将此代码反转为 C 等效代码，但我很难理解 malloc 的工作原理。

I am figuring 8 bytes would be the size of the memory being allocated; however, I am not sure about this line.

我认为 8 个字节将是分配的内存大小；但是，我不确定这条线。

mov      eax, [esp+2ch] 

What does malloc do to eax?

malloc 对 eax 做了什么？

Furthermore would this be equivalent C code?

此外，这是否是等效的 C 代码？

int main(void)
{
int *ptr1;
ptr1 = (int *)malloc(sizeof(8));
*ptr1 = 4;
__start(*ptr1);

回答by Sajad Karuthedath

The function malloc() will allocate a block of memory that is sizebytes large. If the requested memory can be allocated a pointer is returned to the beginning of the memory block.

函数 malloc() 将分配一个size字节大的内存块。如果可以分配请求的内存，则返回指向内存块开头的指针。

Note: the content of the received block of memory is not initialized.

注意：接收到的内存块的内容没有被初始化。

Syntax of malloc():

malloc() 的语法：

void *malloc ( size_t size );

void *malloc ( size_t size );

Parameters:

参数：

Size of the memory block in bytes.

内存块的大小（以字节为单位）。

Return value:

返回值：

If the request is successful then a pointer to the memory block is returned. If the function failed to allocate the requested block of memory, a NULL is returned, NULL may also be returned by a successful call to malloc()with a size of zero.

如果请求成功，则返回指向内存块的指针。如果函数未能分配请求的内存块，则返回 NULL，成功调用 NULL 也可能返回malloc()大小为零的NULL 。

As stated in this CS 301 lecture by Dr. Lawlor:

正如Lawlor 博士在CS 301 讲座中所述：

Calling Malloc from Assembly Language

It's a pretty straightforward function: pass the number of BYTESyou want as the only parameter, in rdi. "call malloc." You'll get back a pointer to the allocated bytes returned in rax. To clean up the space afterwards, copy the pointer over to rdi, and "call free" (I'm leaving off the free below, because you need the stack to do that properly).

Here's a complete example of assembly memory access. I call malloc to get 40 bytes of space. malloc returns the starting address of this space in rax (the 64-bit version of eax). That is, the rax register is acting like a pointer. I can then read and write from the pointed-to memory using the usual assembly bracket syntax:

mov edi, 40; malloc's first (and only) parameter: number of bytes to allocate
extern malloc
call malloc
; on return, rax points to our newly-allocated memory
mov ecx,7; set up a constant
mov [rax],ecx; write it into memory
mov edx,[rax]; read it back from memory
mov eax,edx; copy into return value register
ret

Rather than copy via the ecx register, you can specify you want a 32-bit memory write and read using "DWORD" in front of the brackets, like this:

mov edi, 40; malloc's first (and only) parameter: number of bytes to allocate
extern malloc
call malloc
; on return, rax points to our newly-allocated memory
mov DWORD [rax],7; write constant into memory
mov eax,DWORD [rax]; read it back from memory
ret

从汇编语言调用 malloc

这是一个非常简单的函数：在 rdi 中传递您想要的字节数作为唯一参数。“调用 malloc。” 您将得到一个指向 rax 中返回的已分配字节的指针。之后要清理空间，将指针复制到 rdi，然后“调用 free”（我在下面省略了 free，因为您需要堆栈来正确执行此操作）。

这是汇编内存访问的完整示例。我调用 malloc 来获得 40 字节的空间。malloc 在 rax（eax 的 64 位版本）中返回该空间的起始地址。也就是说，rax 寄存器就像一个指针。然后我可以使用通常的汇编括号语法从指向的内存中读取和写入：

mov edi, 40; malloc's first (and only) parameter: number of bytes to allocate
extern malloc
call malloc
; on return, rax points to our newly-allocated memory
mov ecx,7; set up a constant
mov [rax],ecx; write it into memory
mov edx,[rax]; read it back from memory
mov eax,edx; copy into return value register
ret

不是通过 ecx 寄存器复制，您可以使用括号前的“DWORD”指定您想要的 32 位内存写入和读取，如下所示：

mov edi, 40; malloc's first (and only) parameter: number of bytes to allocate
extern malloc
call malloc
; on return, rax points to our newly-allocated memory
mov DWORD [rax],7; write constant into memory
mov eax,DWORD [rax]; read it back from memory
ret

for malloc in assembly language..see this link malloc

对于汇编语言中的malloc ..see这个链接malloc