更多请参考: Github: https://github.com/xianfeng92/ethereum-code-analysis

---

实例分析

合约代码

pragma solidity ^0.4.11;

contract Test{
    uint public c;
    function add(uint _a, uint _b) public{
        c = _a+_b;
    }

    function sub1() public{
        c = c - 1;
    }
}

编译后字节码

{
    "linkReferences": {},
    "object": "608060405234801561001057600080fd5b50610115806100206000396000f3006080604052600436106053576000357c0100000000000000000000000000000000000000000000000000000000900463ffffffff16806372a099b7146058578063771602f714606c578063c3da42b81460a0575b600080fd5b348015606357600080fd5b50606a60c8565b005b348015607757600080fd5b50609e600480360381019080803590602001909291908035906020019092919050505060d6565b005b34801560ab57600080fd5b5060b260e3565b6040518082815260200191505060405180910390f35b600160005403600081905550565b8082016000819055505050565b600054815600a165627a7a72305820d174b95459e0d9e0d7ea005561d1bcdbc285ed0058890c75f69862ba7c428df90029",
    "opcodes": "PUSH1 0x80 PUSH1 0x40 MSTORE CALLVALUE DUP1 ISZERO PUSH2 0x10 JUMPI PUSH1 0x0 DUP1 REVERT JUMPDEST POP PUSH2 0x115 DUP1 PUSH2 0x20 PUSH1 0x0 CODECOPY PUSH1 0x0 RETURN STOP PUSH1 0x80 PUSH1 0x40 MSTORE PUSH1 0x4 CALLDATASIZE LT PUSH1 0x53 JUMPI PUSH1 0x0 CALLDATALOAD PUSH29 0x100000000000000000000000000000000000000000000000000000000 SWAP1 DIV PUSH4 0xFFFFFFFF AND DUP1 PUSH4 0x72A099B7 EQ PUSH1 0x58 JUMPI DUP1 PUSH4 0x771602F7 EQ PUSH1 0x6C JUMPI DUP1 PUSH4 0xC3DA42B8 EQ PUSH1 0xA0 JUMPI JUMPDEST PUSH1 0x0 DUP1 REVERT JUMPDEST CALLVALUE DUP1 ISZERO PUSH1 0x63 JUMPI PUSH1 0x0 DUP1 REVERT JUMPDEST POP PUSH1 0x6A PUSH1 0xC8 JUMP JUMPDEST STOP JUMPDEST CALLVALUE DUP1 ISZERO PUSH1 0x77 JUMPI PUSH1 0x0 DUP1 REVERT JUMPDEST POP PUSH1 0x9E PUSH1 0x4 DUP1 CALLDATASIZE SUB DUP2 ADD SWAP1 DUP1 DUP1 CALLDATALOAD SWAP1 PUSH1 0x20 ADD SWAP1 SWAP3 SWAP2 SWAP1 DUP1 CALLDATALOAD SWAP1 PUSH1 0x20 ADD SWAP1 SWAP3 SWAP2 SWAP1 POP POP POP PUSH1 0xD6 JUMP JUMPDEST STOP JUMPDEST CALLVALUE DUP1 ISZERO PUSH1 0xAB JUMPI PUSH1 0x0 DUP1 REVERT JUMPDEST POP PUSH1 0xB2 PUSH1 0xE3 JUMP JUMPDEST PUSH1 0x40 MLOAD DUP1 DUP3 DUP2 MSTORE PUSH1 0x20 ADD SWAP2 POP POP PUSH1 0x40 MLOAD DUP1 SWAP2 SUB SWAP1 RETURN JUMPDEST PUSH1 0x1 PUSH1 0x0 SLOAD SUB PUSH1 0x0 DUP2 SWAP1 SSTORE POP JUMP JUMPDEST DUP1 DUP3 ADD PUSH1 0x0 DUP2 SWAP1 SSTORE POP POP POP JUMP JUMPDEST PUSH1 0x0 SLOAD DUP2 JUMP STOP LOG1 PUSH6 0x627A7A723058 KECCAK256 0xd1 PUSH21 0xB95459E0D9E0D7EA005561D1BCDBC285ED0058890C PUSH22 0xF69862BA7C428DF90029000000000000000000000000 ",
    "sourceMap": "26:161:0:-;;;;8:9:-1;5:2;;;30:1;27;20:12;5:2;26:161:0;;;;;;;"
}

其中 object 和 opcodes 是相对应的，比如 60 对应就是 operation PUSH1,合约编译后的字节码即为一组的 operation。

合约部署

var testContract = web3.eth.contract([{"constant":false,"inputs":[],"name":"sub1","outputs":[],"payable":false,"stateMutability":"nonpayable","type":"function"},{"constant":false,"inputs":[{"name":"_a","type":"uint256"},{"name":"_b","type":"uint256"}],"name":"add","outputs":[],"payable":false,"stateMutability":"nonpayable","type":"function"},{"constant":true,"inputs":[],"name":"c","outputs":[{"name":"","type":"uint256"}],"payable":false,"stateMutability":"view","type":"function"}]);
var test = testContract.new(
   {
     from: web3.eth.accounts[0], 
     data: '0x608060405234801561001057600080fd5b50610115806100206000396000f3006080604052600436106053576000357c0100000000000000000000000000000000000000000000000000000000900463ffffffff16806372a099b7146058578063771602f714606c578063c3da42b81460a0575b600080fd5b348015606357600080fd5b50606a60c8565b005b348015607757600080fd5b50609e600480360381019080803590602001909291908035906020019092919050505060d6565b005b34801560ab57600080fd5b5060b260e3565b6040518082815260200191505060405180910390f35b600160005403600081905550565b8082016000819055505050565b600054815600a165627a7a72305820d174b95459e0d9e0d7ea005561d1bcdbc285ed0058890c75f69862ba7c428df90029', 
     gas: '4700000'
   }, function (e, contract){
    console.log(e, contract);
    if (typeof contract.address !== 'undefined') {
         console.log('Contract mined! address: ' + contract.address + ' transactionHash: ' + contract.transactionHash);
    }
 })

合约部署其实就是实例化一个 contract 对象，并将 data 的值设给Code属性。

• 创建合约的 tx

contraAddress： 0x5e72914535f202659083db3a02c984188fa26e9f
from: 0xca35b7d915458ef540ade6068dfe2f44e8fa733c
to: Test.(constructor)
gas: 3000000
transaction cost: 126381
execution cost: 55505
hash : 0xc2abcb19d477b2fa475b981c08d5389139e9a584ad06e1c89c49d294c2c15e78
input :0x608060405234801561001057600080fd5b50610115806100206000396000f3006080604052600436106053576000357c0100000000000000000000000000000000000000000000000000000000900463ffffffff16806372a099b7146058578063771602f714606c578063c3da42b81460a0575b600080fd5b348015606357600080fd5b50606a60c8565b005b348015607757600080fd5b50609e600480360381019080803590602001909291908035906020019092919050505060d6565b005b34801560ab57600080fd5b5060b260e3565b6040518082815260200191505060405180910390f35b600160005403600081905550565b8082016000819055505050565b600054815600a165627a7a72305820d174b95459e0d9e0d7ea005561d1bcdbc285ed0058890c75f69862ba7c428df90029

创建合约的tx中，input字段对应的是合约的字节码，即指令数组。

函数调用

• add

from:0xca35b7d915458ef540ade6068dfe2f44e8fa733c
to:0x5e72914535f202659083db3a02c984188fa26e9f
gas:3000000
transaction cost: 41918
execution cost: 41918
hash: 0xc7f4f67e2101b716f299e639580a85d3fae2b2412a61d57337251334e4b38510
input: 0x771602f700000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002
decoded input :{
    "uint256 _a": "1",
    "uint256 _b": "2"
}

logs:[][]
value:0 wei

其中 input 字段对应所要调用的函数签名的前四个字节（771602f7）以及对应的参数（1,2）

• sub1

from:0xca35b7d915458ef540ade6068dfe2f44e8fa733c
to:0x5e72914535f202659083db3a02c984188fa26e9f
gas:3000000
transaction cost: 26625
execution cost: 5353
hash: 0x4aeb198977b1658e46a099d8ca181d96912a86aff510f0d1ba496e7821e067a7
input: 0x72a099b7
decoded input :{
    "uint256 _a": "1",
    "uint256 _b": "2"
}

logs:[][]
value:0 wei

其中 input 字段为所要调用的合约函数签名的前四个字节（72a099b7）

关于函数调用，Call会把对应的Code读出来，依次解析，Code中会把所有的public签名的函数标志（4字节）push到栈里。然后依据 input 中需要调用函数的签名标志（前4字节）来匹配 Code， 匹配之后跳转到对应的 opcode 。