一、前言
上一节我们对Python编译及反汇编做了讲解，大家知道dis模块可以将编译好的pyc文件中提取出来的PyCodeObject反汇编为可以阅读字节码形式。本节我们对dis模块中的源码进行详细的解读。
二、dis模块原理解析
官方文档说明：https://docs.python.org/2/library/dis.html
The dis module supports the analysis of CPython bytecode by disassembling it. The CPython bytecode which this module takes as an input is defined in the file Include/opcode.h and used by the compiler and the interpreter.
dis模块通过反汇编来支持对python字节码形式的分析。dis模块可以将编译好的二进制数据或者python源码当作模块的输入源。
dis模块可以将python源码文件、内存中的类或者方法、或者经过反序列化的PyCodeObject翻译为相应的字节码供分析。
2.1、dis反汇编源码文件：
将源码文件作为dis模块的输入，dis模块将直接输入该源码文件编译后对应的字节码文本。
2.2、dis反汇编内存中的类或者函数：
将内存中的类、函数，甚至时普通的变量作为参数传递给dis模块中的dis函数，也可以返回该类对应的编译后的字节码形式。
2.3、dis反汇编PyCodeObject对象：
这一类情况是我们在做python逆向或者pyc文件分析时常用到的形式。
2.4、dis无参数：
如果dis.dis无参数传入，该方法默认会返回当前python shell上次报错时堆栈中储存的内存信息的字节码形式。
三、dis模块解读
dis模块包含许多类和方法，具体用法如下表：
| 方法或者属性 | 说明 |
|---|---|
| dis.dis([bytesource]) | Disassemble the bytesource object. bytesource can denote either a module, a class, a method, a function, or a code object. For a module, it disassembles all functions. For a class, it disassembles all methods. For a single code sequence, it prints one line per bytecode instruction. If no object is provided, it disassembles the last traceback. |
| dis.distb([tb]) | Disassembles the top-of-stack function of a traceback, using the last traceback if none was passed. The instruction causing the exception is indicated. |
| dis.disassemble(code[, lasti]) | Disassembles a code object, indicating the last instruction if lasti was provided. |
| dis.disco(code[, lasti]) | A synonym for disassemble(). It is more convenient to type, and kept for compatibility with earlier Python releases. |
| dis.findlinestarts(code) | This generator function uses the co_firstlineno and co_lnotab attributes of the code object code to find the offsets which are starts of lines in the source code. They are generated as (offset, lineno) pairs. |
| dis.findlabels(code) | Detect all offsets in the code object code which are jump targets, and return a list of these offsets. |
| dis.opname | Sequence of operation names, indexable using the bytecode. |
| dis.opmap | Dictionary mapping operation names to bytecodes. |
| dis.cmp_op | Sequence of all compare operation names. |
| dis.hasconst | Sequence of bytecodes that access a constant. |
| dis.hasfree | Sequence of bytecodes that access a free variable. |
| dis.hasname | Sequence of bytecodes that access an attribute by name. |
| dis.hasjrel | Sequence of bytecodes that have a relative jump target. |
| dis.hasjabs | Sequence of bytecodes that have an absolute jump target. |
| dis.haslocal | Sequence of bytecodes that access a local variable. |
| dis.hascompare | Sequence of bytecodes of Boolean operations. |
上表摘自官方文档整理，对各个方法及属性进行了详细的说明。下文将对dis模块运行流程进行说明。
3.1
dis模块主函数为dis，所有对dis模块的调用默认都会将参数传送给dis.dis（不排除进阶玩家直接调用dis.disb等其他模块来完成特定功能）
3.2
dis.dis先进行参数检查，根据无参数、字典、PyCodeObject实例化对象，代码段等不同类型参数调用不同的方法。如果提交的参数是字典，dis模块会通过迭代，将字典中的每个键值作为参数传递给dis.dis
3.3
经过dis方法的处理，最终参数会被交给disassemble或者disassemble_string方法处理，disassemble方法负责对提交的对象进行反汇编，disassemble_string方法负责对代码段进行反汇编，因为disassemble_string方法代码类似于disassemble，不对disassemble_string进行解读。
3.4
disassemble方法用来将PyCodeObject实例化对象翻译为可读字节码。首先调用findlabels和findlinestarts。findlabels将所有字节码跳转指向目的字节码地址存入堆栈。findlinestarts用来标记字节码对应的源码位置，官方注释说明findlinestarts会生成(offset, lineno)元组，其中offset为字节码偏移地址，lineno为源码偏移地址。
3.5
disassemble方法对字节码代码部分逐行翻译，并且添加必要变量及标志注释。
四、dis模块源码注释版本
"""Disassembler of Python byte code into mnemonics."""
import sys
import types
from opcode import *
from opcode import __all__ as _opcodes_all
__all__ = ["dis", "disassemble", "distb", "disco",
"findlinestarts", "findlabels"] + _opcodes_all
del _opcodes_all
_have_code = (types.MethodType, types.FunctionType, types.CodeType,
types.ClassType, type)
'''根据x所属type，判断对输入参数x执行何种反编译，其中co_code选项是
对pyc文件中提取的marshal数据进行反编译过程中常用的'''
def dis(x=None):
"""Disassemble classes, methods, functions, or code.
With no argument, disassemble the last traceback.
"""
if x is None:
distb()
return
if isinstance(x, types.InstanceType):
x = x.__class__
if hasattr(x, 'im_func'):
x = x.im_func
if hasattr(x, 'func_code'):
x = x.func_code
if hasattr(x, '__dict__'):
items = x.__dict__.items()
items.sort()
for name, x1 in items:
if isinstance(x1, _have_code):
print "Disassembly of %s:" % name
try:
dis(x1)
except TypeError, msg:
print "Sorry:", msg
print
elif hasattr(x, 'co_code'):
disassemble(x)
elif isinstance(x, str):
disassemble_string(x)
else:
raise TypeError, \
"don't know how to disassemble %s objects" % \
type(x).__name__
'''无参数x传入时，对上次报错的堆栈信息进行反编译'''
def distb(tb=None):
"""Disassemble a traceback (default: last traceback)."""
if tb is None:
try:
tb = sys.last_traceback
except AttributeError:
raise RuntimeError, "no last traceback to disassemble"
while tb.tb_next: tb = tb.tb_next
disassemble(tb.tb_frame.f_code, tb.tb_lasti)
'''反编译的主函数'''
def disassemble(co, lasti=-1):
"""Disassemble a code object."""
code = co.co_code
labels = findlabels(code)
linestarts = dict(findlinestarts(co))
n = len(code)
i = 0
'''***'''
extended_arg = 0
free = None
while i < n:
c = code[i]
op = ord(c)
'''字节码对应源码偏移量标注'''
if i in linestarts:
if i > 0:
print
print "%3d" % linestarts[i],
else:
print ' ',
if i == lasti: print '-->',
else: print ' ',
'''标注跳转标记'''
if i in labels: print '>>',
else: print ' ',
'''标注字节码偏移和opcode名字'''
print repr(i).rjust(4),
print opname[op].ljust(20),
i = i+1
if op >= HAVE_ARGUMENT:
'''根据不同的变量类型进行变量标注'''
oparg = ord(code[i]) + ord(code[i+1])*256 + extended_arg
extended_arg = 0
i = i+2
if op == EXTENDED_ARG:
extended_arg = oparg*65536L
print repr(oparg).rjust(5),
if op in hasconst:
print '(' + repr(co.co_consts[oparg]) + ')',
elif op in hasname:
print '(' + co.co_names[oparg] + ')',
elif op in hasjrel:
print '(to ' + repr(i + oparg) + ')',
elif op in haslocal:
print '(' + co.co_varnames[oparg] + ')',
elif op in hascompare:
print '(' + cmp_op[oparg] + ')',
elif op in hasfree:
if free is None:
free = co.co_cellvars + co.co_freevars
print '(' + free[oparg] + ')',
print
'''字符串反编译的主函数'''
def disassemble_string(code, lasti=-1, varnames=None, names=None,
constants=None):
labels = findlabels(code)
n = len(code)
i = 0
while i < n:
c = code[i]
op = ord(c)
if i == lasti: print '-->',
else: print ' ',
if i in labels: print '>>',
else: print ' ',
print repr(i).rjust(4),
print opname[op].ljust(15),
i = i+1
if op >= HAVE_ARGUMENT:
oparg = ord(code[i]) + ord(code[i+1])*256
i = i+2
print repr(oparg).rjust(5),
if op in hasconst:
if constants:
print '(' + repr(constants[oparg]) + ')',
else:
print '(%d)'%oparg,
elif op in hasname:
if names is not None:
print '(' + names[oparg] + ')',
else:
print '(%d)'%oparg,
elif op in hasjrel:
print '(to ' + repr(i + oparg) + ')',
elif op in haslocal:
if varnames:
print '(' + varnames[oparg] + ')',
else:
print '(%d)' % oparg,
elif op in hascompare:
print '(' + cmp_op[oparg] + ')',
print
disco = disassemble # XXX For backwards compatibility
'''遍历寻找co_code中为跳转操作的opcode，并将跳转的目的地址（字节码的偏
移地址）存入labels中'''
def findlabels(code):
"""Detect all offsets in a byte code which are jump targets.
Return the list of offsets.
"""
labels = []
n = len(code)
i = 0
while i < n:
c = code[i]
op = ord(c)
i = i+1
if op >= HAVE_ARGUMENT:
'''计算argv表示的偏移地址'''
oparg = ord(code[i]) + ord(code[i+1])*256
i = i+2
label = -1
'''根据跳转类型将跳转后的地址加入数组labels中'''
if op in hasjrel:
label = i+oparg
elif op in hasjabs:
label = oparg
if label >= 0:
if label not in labels:
labels.append(label)
return labels
def findlinestarts(code):
"""Find the offsets in a byte code which are start of lines in the source.
Generate pairs (offset, lineno) as described in Python/compile.c.
"""
'''汇编偏移'''
byte_increments = [ord(c) for c in code.co_lnotab[0::2]]
'''源码偏移'''
line_increments = [ord(c) for c in code.co_lnotab[1::2]]
'''上一行源码的绝对地址'''
lastlineno = None
'''当前汇编对应源码的行'''
lineno = code.co_firstlineno
addr = 0
for byte_incr, line_incr in zip(byte_increments, line_increments):
if byte_incr:
if lineno != lastlineno:
yield (addr, lineno)
lastlineno = lineno
addr += byte_incr
lineno += line_incr
'''byte偏移量一定每次递增不为零，但是源码可能出现lambda类似
语句，因此不同区块的字节码可能对应于源码的同一行'''
if lineno != lastlineno:
yield (addr, lineno)
def _test():
"""Simple test program to disassemble a file."""
if sys.argv[1:]:
if sys.argv[2:]:
sys.stderr.write("usage: python dis.py [-|file]\n")
sys.exit(2)
fn = sys.argv[1]
if not fn or fn == "-":
fn = None
else:
fn = None
if fn is None:
f = sys.stdin
else:
f = open(fn)
source = f.read()
if fn is not None:
f.close()
else:
fn = "<stdin>"
code = compile(source, fn, "exec")
dis(code)
if __name__ == "__main__":
_test()