0Pricing
Reverse Engineering & Binary Analysis Basics · レッスン

制御フローと関数呼び出し

条件分岐、ループ、関数呼び出しの仕組みについて、スタックの利用方法も含めて学びます。

「制御フローと関数呼び出し」はCoddyKit上の無料Reverse Engineering & Binary Analysis Basicsレッスンです。 これはレッスン3/4です。 下記で完全なレッスンを無料で読むことができます。その後、ブラウザ内の組み込みコードエディタと24時間対応のAIチューターでハンズオン演習できます。 これはReverse Engineering & Binary Analysis Basics学習パスの一部であり、ウェブとCoddyKitアプリ全体で進捗が同期されます。 Reverse Engineering & Binary Analysis Basicsコースには全4レッスンが含まれています。

このレッスンの一部はまだ翻訳されておらず、英語で表示されています。

Control Flow: Making Programs Smart

In assembly, instructions usually run one after another. This is called sequential execution. But real programs need to make decisions, repeat actions, and call functions.

This is where control flow comes in! It's how a program changes its execution path based on conditions, creating loops and calling subroutines.

Conditional Jumps: If-Statements

Conditional jumps are like if statements in high-level languages. They let your program execute different code blocks based on a condition.

The CMP instruction compares two values and sets CPU flags. Then, jump instructions like JE (Jump if Equal) or JNE (Jump if Not Equal) check these flags to decide whether to jump.

; Example: if (EAX == EBX) goto equal_label;
MOV EAX, 10
MOV EBX, 10
CMP EAX, EBX    ; Compare EAX and EBX
JE  equal_label ; Jump if Equal
; Code here runs if EAX != EBX
JMP end_label

equal_label:
; Code here runs if EAX == EBX

end_label:
; Program continues

More Jump Conditions

Beyond JE and JNE, many other conditional jump instructions exist to handle different comparisons:

  • JG: Jump if Greater
  • JL: Jump if Less
  • JGE: Jump if Greater or Equal
  • JLE: Jump if Less or Equal
  • JZ: Jump if Zero (often used after CMP or arithmetic)
  • JNZ: Jump if Not Zero

These instructions interpret the CPU's flags register, which stores the results of previous operations.

Building Loops in Assembly

You can create loops using conditional jumps. A loop typically involves:

  1. An initialization (e.g., setting a counter).
  2. A condition check (using CMP and a conditional jump).
  3. The loop body (instructions to repeat).
  4. An update (e.g., incrementing the counter).
  5. An unconditional jump back to the condition check.
; Example: int i = 0; while (i < 3) { i++; }
MOV ECX, 0      ; Initialize counter i = 0

loop_start:
CMP ECX, 3      ; Compare i with 3
JGE loop_end    ; Jump if i >= 3 (exit loop)

INC ECX         ; Increment i
JMP loop_start  ; Jump back to loop_start

loop_end:
; Loop has finished, continue here

The Stack: LIFO Storage

The stack is a crucial memory region used for temporary storage, especially during function calls. It operates on a LIFO (Last-In, First-Out) principle.

Think of it like a stack of plates: you can only add a new plate to the top (PUSH) or remove the top plate (POP).

  • PUSH: Decreases the stack pointer (ESP/RSP) and places data on the stack.
  • POP: Retrieves data from the top of the stack and increases the stack pointer.

Function Calls: CALL and RET

When a program needs to execute a separate block of code (a function or subroutine), it uses the CALL instruction. This is fundamental for modular programming.

  • The CALL instruction first pushes the return address (the address of the instruction immediately following CALL) onto the stack.
  • Then, it jumps unconditionally to the target function's entry point.
  • The RET instruction, typically found at the end of a function, pops the return address from the stack and jumps back to that address, resuming execution in the caller.
; Caller code:
; ... instructions
CALL my_function ; Calls the function
; ... execution continues here after my_function returns

; my_function definition:
my_function:
; ... function's body instructions
RET              ; Returns to the caller

Passing Arguments to Functions

How do functions receive input? In x86/x64 assembly, arguments are often passed via the stack or registers.

When using the stack, arguments are pushed onto the stack by the caller before the CALL instruction. The called function then accesses these arguments relative to the stack pointer (ESP/RSP) or base pointer (EBP/RBP).

The calling convention dictates the order and method of argument passing.

Local Variables and the Stack Frame

Functions also need space for their own local variables. This space is allocated on the stack within what's called a stack frame.

A stack frame is typically established by:

  1. Saving the old base pointer (PUSH EBP/RBP).
  2. Setting the new base pointer to the current stack pointer (MOV EBP, ESP/RBP, RSP).
  3. Allocating space for local variables (SUB ESP, size).

The base pointer (EBP/RBP) provides a stable reference point to access arguments and local variables within the current function.

Function Call Walkthrough

Let's see a simple C function and understand how its call, arguments, and local variables relate to assembly and the stack.

When main calls calculate_sum, the arguments 15 and 25 are pushed onto the stack. Inside calculate_sum, space for local_var is allocated on the stack. The function's return value is typically placed in a register like EAX.

#include <stdio.h>

int calculate_sum(int a, int b) {
  int local_var = a + b; // Local variable on stack
  return local_var;
}

int main() {
  int result = calculate_sum(15, 25);
  printf("Result: %d\n", result);
  return 0;
}

Quick Check: Function Calls

Understanding the stack's role in function calls is crucial for reverse engineering.

Which of the following actions occur when an x86/x64 CALL instruction is executed?

Recap: Control Flow & Functions

Great job! You've learned how programs make decisions and execute functions in assembly.

  • Conditional Jumps (JE, JNE, JG, etc.) combined with CMP enable if statements and loops.
  • The Stack is a LIFO structure critical for temporary data, managed by PUSH and POP.
  • Function Calls use CALL to push the return address and jump, and RET to pop it and return.
  • Arguments and local variables are often handled via the stack within a function's stack frame.

Understanding these concepts is vital for tracing program execution and analyzing binaries!

よくある質問

「制御フローと関数呼び出し」レッスンは無料ですか？

はい。「制御フローと関数呼び出し」の完全なテキストはこのウェブで無料で読めます。インタラクティブに演習し（組み込みコードエディタと24時間対応のAIチューター）、Reverse Engineering & Binary Analysis Basicsコースの残りをアンロックするには、CoddyKit PROにアップグレードしてください。 Reverse Engineering & Binary Analysis Basicsコースには全4レッスンが含まれています。

「制御フローと関数呼び出し」で何を学びますか？

条件分岐、ループ、関数呼び出しの仕組みについて、スタックの利用方法も含めて学びます。 ブラウザで直接実行するハンズオンコードでReverse Engineering & Binary Analysis Basicsを演習し、24時間対応のAIチューターがレッスンを進める中での質問に答えます。

Reverse Engineering & Binary Analysis Basicsを始めるのに経験は必要ですか？

事前経験は必要ありません。CoddyKitのReverse Engineering & Binary Analysis Basicsは初級者から上級者向けに構成されているため、ここから始めるか最初から始めて、自分のペースで進むことができます。 これはレッスン3/4です。

「制御フローと関数呼び出し」レッスンにはどのくらい時間がかかりますか？

ほとんどのCoddyKitレッスンは約5～10分かかります。各レッスンはコンパクトでインタラクティブなので、着実に進歩し、ウェブとアプリ全体で正確に前回の場所から再開できます。

このReverse Engineering & Binary Analysis Basicsレッスンでコードを書いて実行できますか？

はい。すべてのReverse Engineering & Binary Analysis Basicsレッスンに組み込みコードエディタが含まれているため、ブラウザでリアルコードを書いて実行し、即座のAIフィードバックを取得できます。ローカル設定は不要です。

このコースのすべてのレッスン

  1. x86/x64アセンブリの基礎
  2. レジスタとメモリ操作
  3. 制御フローと関数呼び出し
  4. スタックと呼び出し規約
← Reverse Engineering & Binary Analysis Basicsに戻る