PA 2-1 add testcase HIT BAD TRAP at eip = 0x00030060

老师你好，我在做2-1实验实现case add所需要的指令时，经过反汇编后逐条执行指令（即使是模拟正确的指令执行过程）后，还是无法正确运行完程序。下面是case add反汇编后的代码：

```

testcase/bin/add:     file format elf32-i386

Disassembly of section .text:

00030000 <start>:
   30000:	e9 00 00 00 00       	jmp    30005 <main>

00030005 <main>:
   30005:	55                   	push   %ebp
   30006:	89 e5                	mov    %esp,%ebp
   30008:	53                   	push   %ebx
   30009:	83 ec 10             	sub    $0x10,%esp
   3000c:	e8 8f 00 00 00       	call   300a0 <__x86.get_pc_thunk.dx>
   30011:	81 c2 ef 2f 00 00    	add    $0x2fef,%edx
   30017:	c7 45 f0 00 00 00 00 	movl   $0x0,-0x10(%ebp)
   3001e:	c7 45 f8 00 00 00 00 	movl   $0x0,-0x8(%ebp)
   30025:	eb 48                	jmp    3006f <main+0x6a>
   30027:	c7 45 f4 00 00 00 00 	movl   $0x0,-0xc(%ebp)
   3002e:	eb 34                	jmp    30064 <main+0x5f>
   30030:	8b 45 f8             	mov    -0x8(%ebp),%eax
   30033:	8b 8c 82 20 00 00 00 	mov    0x20(%edx,%eax,4),%ecx
   3003a:	8b 45 f4             	mov    -0xc(%ebp),%eax
   3003d:	8b 84 82 20 00 00 00 	mov    0x20(%edx,%eax,4),%eax
   30044:	8d 1c 01             	lea    (%ecx,%eax,1),%ebx
   30047:	8b 45 f0             	mov    -0x10(%ebp),%eax
   3004a:	8d 48 01             	lea    0x1(%eax),%ecx
   3004d:	89 4d f0             	mov    %ecx,-0x10(%ebp)
   30050:	8b 84 82 40 00 00 00 	mov    0x40(%edx,%eax,4),%eax
   30057:	39 c3                	cmp    %eax,%ebx
   30059:	74 06                	je     30061 <main+0x5c>
   3005b:	b8 01 00 00 00       	mov    $0x1,%eax
   30060:	82                   	nemu_trap 
   30061:	ff 45 f4             	incl   -0xc(%ebp)
   30064:	8b 45 f4             	mov    -0xc(%ebp),%eax
   30067:	83 f8 07             	cmp    $0x7,%eax
   3006a:	76 c4                	jbe    30030 <main+0x2b>
   3006c:	ff 45 f8             	incl   -0x8(%ebp)
   3006f:	8b 45 f8             	mov    -0x8(%ebp),%eax
   30072:	83 f8 07             	cmp    $0x7,%eax
   30075:	76 b0                	jbe    30027 <main+0x22>
   30077:	83 7d f8 08          	cmpl   $0x8,-0x8(%ebp)
   3007b:	74 06                	je     30083 <main+0x7e>
   3007d:	b8 01 00 00 00       	mov    $0x1,%eax
   30082:	82                   	nemu_trap 
   30083:	83 7d f4 08          	cmpl   $0x8,-0xc(%ebp)
   30087:	74 06                	je     3008f <main+0x8a>
   30089:	b8 01 00 00 00       	mov    $0x1,%eax
   3008e:	82                   	nemu_trap 
   3008f:	b8 00 00 00 00       	mov    $0x0,%eax
   30094:	82                   	nemu_trap 
   30095:	b8 00 00 00 00       	mov    $0x0,%eax
   3009a:	83 c4 10             	add    $0x10,%esp
   3009d:	5b                   	pop    %ebx
   3009e:	5d                   	pop    %ebp
   3009f:	c3                   	ret

000300a0 <__x86.get_pc_thunk.dx>:
   300a0:	8b 14 24             	mov    (%esp),%edx
   300a3:	c3                   	ret

```

执行到300a0 处  当时的$esp 值为 ：

```
(nemu) si
000300a0:   8b 14 24                                  movl (%esp), %edx
(nemu) info r
eax	0x00000000
ecx	0x00000000
edx	0x0003000c
ebx	0x00000000
esp	0x07ffffd4
ebp	0x07ffffec
esi	0x00000000
edi	0x00000000
eip	0x000300a3

```

通过扫描地址，存储的值为：

```
(nemu) x 1 0x7ffffd4
0x7FFFFD4:         3000c
```

执行 00030011:   81 c2 ef 2f 00 00                         addl $0x2fef, %edx
后，edx的值为：

```
(nemu) si
00030011:   81 c2 ef 2f 00 00                         addl $0x2fef, %edx
(nemu) info r
eax	0x00000000
ecx	0x00000000
edx	0x00032ffb
ebx	0x00000000
esp	0x07ffffd8
ebp	0x07ffffec
esi	0x00000000
edi	0x00000000
eip	0x00030017
CF = 0,  ZF = 0,  SF = 0,  OF = 0
```

扫描$edx指向的地址存储的值：

```
(nemu) x 50 0x32ffb
0x32FFB:             0           0           0           0
0x3300B:             0           0           0           0
0x3301B:             0           0         100         200
0x3302B:      ffffff00          7f         180    fffffe80
0x3303B:      ffffffff          ff         100         200
0x3304B:      ffffff00          7f         180    fffffe80
0x3305B:      ffffffff         1ff         200         300
0x3306B:             0         180         280    ffffff80
0x3307B:            ff         200         300         400
0x3308B:           100         280         380          80
0x3309B:           100    ffffff00          7f         180
0x330AB:      fffffe80    ffffffff          ff    fffffd00
0x330BB:      fffffe7f          7f
```

经过 3003d -- 30050 处指令后

```
(nemu) si
00030057:   39 c3                                     cmpl %eax, %ebx
(nemu) info r
eax	0xffffffff
ecx	0x00000001
edx	0x00032ffb
ebx	0x00000000
esp	0x07ffffd8
ebp	0x07ffffec
esi	0x00000000
edi	0x00000000
eip	0x00030059
CF = 1,  ZF = 0,  SF = 0,  OF = 0

```

$eax $ebx 的值并不相同，之后会直接进入nemu_trap，与预期情况不符，老师知道原因吗？

wl-ics-nju/pa2020_spring_temp_release

内容风险标识

评论 (2)

wl-ics-nju/pa2020_spring_temp_release .gitee-modal { width: 500px !important; }

内容风险标识