Question

I am a bit interested in what does the run time do, so I write a simple c program like below.(I do not paste the code of some_function. I think it’s not important.)

int main(int argc, char *argv[]) {
    some_fucntion();
    return;
}

I use i686-apple-darwin10-llvm-gcc-4.2 on my Mac(10.6.8, Intel Core) and compiler the source with following command. Actually I have tried to use O3 and get same result.

gcc -O0 -o test test.c

Then I type following command and get those asm code.

otool -tV test

I get the following asm code. I guess those code relates to prepare the arguments for main function. But I still can’t figure out why there are a loop to set eax to 0x00? And why there are a “jmp” instruction? so the next instruction will never be executed, right?

I would be really appreciate if anyone could explain the whole asm code here. Thanks.

start:
0000000100000d20        pushq   $0x00
0000000100000d22        movq    %rsp,%rbp
0000000100000d25        andq    $0xf0,%rsp
0000000100000d29        movq    0x08(%rbp),%rdi
0000000100000d2d        leaq    0x10(%rbp),%rsi
0000000100000d31        movl    %edi,%edx
0000000100000d33        addl    $0x01,%edx
0000000100000d36        shll    $0x03,%edx
0000000100000d39        addq    %rsi,%rdx
0000000100000d3c        movq    %rdx,%rcx
0000000100000d3f        jmp     0x100000d45
0000000100000d41        addq    $0x08,%rcx
0000000100000d45        cmpq    $0x00,(%rcx)
0000000100000d49        jne     0x100000d41
0000000100000d4b        addq    $0x08,%rcx
0000000100000d4f        callq   _main
0000000100000d54        movl    %eax,%edi
0000000100000d56        callq   0x100000e7c     ; symbol stub for: _exit
0000000100000d5b        hlt
0000000100000d5c        nop

Answer 1

start:
0000000100000d20        pushq   $0x00               ; push NULL (end of dynamic frame pointer chain)
0000000100000d22        movq    %rsp,%rbp           ; set frame pointer
0000000100000d25        andq    $0xf0,%rsp          ; align stack
0000000100000d29        movq    0x08(%rbp),%rdi     ; mov argc to 1st arg
0000000100000d2d        leaq    0x10(%rbp),%rsi     ; mov argv to 2nd arg
0000000100000d31        movl    %edi,%edx           ; \
0000000100000d33        addl    $0x01,%edx          ; > 3rd arg = argv + (argc + 1) * 8
0000000100000d36        shll    $0x03,%edx          ; > = envp
0000000100000d39        addq    %rsi,%rdx           ; /
0000000100000d3c        movq    %rdx,%rcx           ; \
0000000100000d3f        jmp     0x100000d45         ; >
0000000100000d41        addq    $0x08,%rcx          ; > find 1st NULL after envp and
0000000100000d45        cmpq    $0x00,(%rcx)        ; > move to 4th arg
0000000100000d49        jne     0x100000d41         ; /
0000000100000d4b        addq    $0x08,%rcx          ; and add 8 (apple)
0000000100000d4f        callq   _main               ; call main
0000000100000d54        movl    %eax,%edi           ; move return value to 1st arg
0000000100000d56        callq   0x100000e7c         ; and call _exit (doesn't return)
0000000100000d5b        hlt
0000000100000d5c        nop

apple is an Apple-specific argument that contains the path to the executable (source).