被调函数返回不同类型的值给主调函数,根据返回值类型的大小,有不同的返回方式。
1 返回int
示例代码:
int funcReturnInt()
{
int a = 3;
int b = 4;
return a+b;
}
int main()
{
int d = 0;
d = funcReturnInt();
return 0;
}
汇编:
13: int d = 0;
004010A8 mov dword ptr [ebp-4],0
14: d = funcReturnInt();
004010AF call @ILT+20(funcReturnDouble) (00401019)
004010B4 mov dword ptr [ebp-4],eax // int返回值保存在eax寄存器,mov到[ebp-4]
函数调用时:
9: return a+b;
00401046 mov eax,dword ptr [ebp-4] // 这里的[ebp-4]是被调函数的局部变量a
00401049 add eax,dword ptr [ebp-8]
如果是返回指针,也同样是通过寄存器eax。
2 返回double
示例代码:
double funcReturndouble()
{
double a = 1.1;
double b = 2.2;
return a+b;
}
double main()
{
double d = 0;
d = funcReturndouble();
return 0;
}
汇编:
13: double d = 0;
00401088 mov dword ptr [ebp-8],0
0040108F mov dword ptr [ebp-4],0
14: d = funcReturndouble();
00401096 call @ILT+10(funcReturndouble) (0040100f)
0040109B fstp qword ptr [ebp-8] // 浮点栈pop给[ebp-8]
调用函数时有一个压浮点栈操作:
9: return a+b;
00401054 fld qword ptr [ebp-8] // 浮点栈push被调函数的局部变量a
00401057 fadd qword ptr [ebp-10h] // 先前push入的值再加入b
float也是同样的fstp和fld指令。
3 返回复合类型
示例代码:
struct employee{
int id;
char sex;
double salary;
};
employee funcReturnCompoundValue(employee ee)
{
employee tmp(ee);
return tmp;
}
int main()
{
employee ee;
ee.id=3;
ee.sex = 'm';
ee.salary = 5555;
employee ef;
ef=funcReturnCompoundValue(ee);
return 0;
}
函数调用的汇编代码:
19: employee ef;
20: ef=funcReturnCompoundValue(ee);
004010C4 sub esp,10h // 参数需要16个字节
004010C7 mov eax,esp
004010C9 mov ecx,dword ptr [ebp-10h]
004010CC mov dword ptr [eax],ecx // 开始压参
004010CE mov edx,dword ptr [ebp-0Ch]
004010D1 mov dword ptr [eax+4],edx
004010D4 mov ecx,dword ptr [ebp-8]
004010D7 mov dword ptr [eax+8],ecx
004010DA mov edx,dword ptr [ebp-4]
004010DD mov dword ptr [eax+0Ch],edx
004010E0 lea eax,[ebp-40h]
004010E3 push eax // 压入存放返回值的起始地址(被调函数栈帧内)
004010E4 call @ILT+5(funcReturnCompoundValue) (0040100a) // 跳转的同时会压入返回地址004010E9
开始调用函数:
7: employee funcReturnCompoundValue(employee ee)
8: {
00401020 push ebp
00401021 mov ebp,esp
00401023 sub esp,50h
00401026 push ebx
00401027 push esi
00401028 push edi
00401029 lea edi,[ebp-50h]
0040102C mov ecx,14h
00401031 mov eax,0CCCCCCCCh
00401036 rep stos dword ptr [edi]
9: employee tmp(ee);
00401038 mov eax,dword ptr [ebp+0Ch]
0040103B mov dword ptr [ebp-10h],eax
0040103E mov ecx,dword ptr [ebp+10h]
00401041 mov dword ptr [ebp-0Ch],ecx
00401044 mov edx,dword ptr [ebp+14h]
00401047 mov dword ptr [ebp-8],edx
0040104A mov eax,dword ptr [ebp+18h]
0040104D mov dword ptr [ebp-4],eax
此时的栈帧:
调用函数时返回的汇编
10: return tmp;
00401050 mov ecx,dword ptr [ebp+8] // 将返回地值的起始地址读入 ecx
00401053 mov edx,dword ptr [ebp-10h] // 待返回值的起始地址的值读入 edx
00401056 mov dword ptr [ecx],edx // 3
00401058 mov eax,dword ptr [ebp-0Ch]
0040105B mov dword ptr [ecx+4],eax // 'm'
0040105E mov edx,dword ptr [ebp-8] // 5555的半段
00401061 mov dword ptr [ecx+8],edx
00401064 mov eax,dword ptr [ebp-4]
00401067 mov dword ptr [ecx+0Ch],eax
0040106A mov eax,dword ptr [ebp+8]
11: }
回到主调函数:
004010E9 add esp,14h // 参数16个字节+4个字节的存入返回值的起始地址
004010EC mov ecx,dword ptr [eax] // eax存储的是存放返回值的起始地址
004010EE mov dword ptr [ebp-30h],ecx // ebp-30 = 下图的0012FF18
004010F1 mov edx,dword ptr [eax+4]
004010F4 mov dword ptr [ebp-2Ch],edx
004010F7 mov ecx,dword ptr [eax+8]
004010FA mov dword ptr [ebp-28h],ecx
004010FD mov edx,dword ptr [eax+0Ch]
00401100 mov dword ptr [ebp-24h],edx
00401103 mov eax,dword ptr [ebp-30h]
00401106 mov dword ptr [ebp-20h],eax // ebp-20 = 下图的0012FF28
00401109 mov ecx,dword ptr [ebp-2Ch]
0040110C mov dword ptr [ebp-1Ch],ecx
0040110F mov edx,dword ptr [ebp-28h]
00401112 mov dword ptr [ebp-18h],edx
00401115 mov eax,dword ptr [ebp-24h]
00401118 mov dword ptr [ebp-14h],eax
21: return 0;
0040111B xor eax,eax
图示:
当返回复合类型,需要在主调函数的栈帧内指定一块内存空间。在被调函数的栈帧上,会保存指向主调函数存储返回值的内存空间的起始地址。
-End-