setjmp与longjmp的分析

#include <setjmp.h>

int main(int argc, const char* argv[])

    jmp_buf buf = {0,};

    int k = 0;

    setjmp(buf);

    k = 1;

    longjmp(buf, 1);

测试代码如上所示， 看一下Disassemble的代码

__setjmp3:

69CDFC38  mov         edx,dword ptr [esp+4]

69CDFC3C  mov         dword ptr [edx],ebp

69CDFC3E  mov         dword ptr [edx+4],ebx

69CDFC41  mov         dword ptr [edx+8],edi

69CDFC44  mov         dword ptr [edx+0Ch],esi

69CDFC47  mov         dword ptr [edx+10h],esp

69CDFC4A  mov         eax,dword ptr [esp]

69CDFC4D  mov         dword ptr [edx+14h],eax

69CDFC50  mov         dword ptr [edx+20h],56433230h

69CDFC57  mov         dword ptr [edx+24h],0

69CDFC5E  mov         eax,dword ptr fs:[00000000h]

69CDFC64  mov         dword ptr [edx+18h],eax

69CDFC67  cmp         eax,0FFFFFFFFh

69CDFC6A  jne         _s3_get_count (69CDFC75h)

69CDFC6C  mov         dword ptr [edx+1Ch],0FFFFFFFFh

69CDFC73  jmp         _s3_done (69CDFCB0h)

_s3_get_count:

69CDFC75  mov         ecx,dword ptr [esp+8]

69CDFC79  or          ecx,ecx

69CDFC7B  je          _s3_default_trylevel (69CDFC87h)

69CDFC7D  mov         eax,dword ptr [esp+0Ch]

69CDFC81  mov         dword ptr [edx+24h],eax

69CDFC84  dec         ecx

69CDFC85  jne         _s3_save_trylevel (69CDFC8Fh)

_s3_default_trylevel:

69CDFC87  mov         eax,dword ptr [eax+0Ch]

69CDFC8A  mov         dword ptr [edx+1Ch],eax

69CDFC8D  jmp         _s3_done (69CDFCB0h)

_s3_save_trylevel:

69CDFC8F  mov         eax,dword ptr [esp+10h]

69CDFC93  mov         dword ptr [edx+1Ch],eax

69CDFC96  dec         ecx

69CDFC97  je          _s3_done (69CDFCB0h)

69CDFC99  push        esi

69CDFC9A  push        edi

69CDFC9B  lea         esi,[esp+1Ch]

69CDFC9F  lea         edi,[edx+28h]

69CDFCA2  cmp         ecx,6

69CDFCA5  jbe         _s3_save_data (69CDFCACh)

69CDFCA7  mov         ecx,6

_s3_save_data:

69CDFCAC  rep movs    dword ptr es:[edi],dword ptr [esi]

69CDFCAE  pop         edi

69CDFCAF  pop         esi

_s3_done:

69CDFCB0  sub         eax,eax

69CDFCB2  ret

69CDFCB3  int         3

69CDFCB4  int         3

69CDFCB5  int         3

69CDFCB6  int         3

69CDFCB7  int         3

69CDFCB8  int         3

69CDFCB9  int         3

69CDFCBA  int         3

69CDFCBB  int         3

69CDFCBC  int         3

69CDFCBD  int         3

69CDFCBE  int         3

69CDFCBF  int         3

将刚刚压入栈中的buf[esp + 4]赋值给edx，然后分别将线程相关的Context的各个register，以及TEB中的某些字段fs:[00000000h]放到该结构体中。

fs:[00000000h]保存的是与SEH相关的信息，参考：http://www.mouseos.com/windows/SEH3.html

总之，一旦调用longjmp，那么包括esp在内的Context可能都会被改变

巴特西