![\"\u5c01\u9762\u4fe1\u606f\u56fe\"](\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/10\/20261024163234-6adcdda2d10db.webp\")
<\/p>\n<\/p>\n
\u5728\u667a\u80fd\u5408\u7ea6\u5b89\u5168\u5ba1\u8ba1\u3001\u95ed\u6e90\u534f\u8bae\u9006\u5411\u5206\u6790\u4ee5\u53ca\u9ed1\u5ba2\u94fe\u4e0a\u8d44\u4ea7\u8ffd\u8e2a\u8fc7\u7a0b\u4e2d，\u5b89\u5168\u5de5\u7a0b\u5e08\u9762\u5bf9\u7684\u5f80\u5f80\u53ea\u662f\u4e00\u4e32\u5341\u516d\u8fdb\u5236\u7684 EVM \u8fd0\u884c\u65f6\u5b57\u8282\u7801（Runtime Bytecode）\u3002\u7531\u4e8e\u4ee5\u592a\u574a\u865a\u62df\u673a（EVM）\u91c7\u7528\u4e86\u51c6\u56fe\u7075\u5b8c\u5907\u7684\u57fa\u4e8e\u6808（Stack-based）\u67b6\u6784，\u6ca1\u6709\u901a\u7528\u5bc4\u5b58\u5668，\u6240\u6709\u53d8\u91cf\u8ba1\u7b97\u5747\u901a\u8fc7\u5165\u6808（PUSH）\u3001\u51fa\u6808（POP）\u3001\u590d\u5236（DUP）\u4e0e\u4ea4\u6362（SWAP）\u5b8c\u6210，\u8fd9\u4f7f\u5f97\u76f4\u63a5\u9605\u8bfb\u53cd\u6c47\u7f16\u6307\u4ee4\u6781\u5176\u6666\u6da9\u7e41\u7410\u3002<\/p>\n
\u8981\u5b9e\u73b0\u4ece\u6b7b\u677f\u7684\u64cd\u4f5c\u7801（Opcodes）\u5230\u9ad8\u53ef\u8bfb\u6027\u7684\u9ad8\u7ea7 Solidity \u6e90\u7801\u8fd8\u539f，\u5fc5\u987b\u7ecf\u5386\u7f16\u8bd1\u5668\u9006\u5411\u6d41\u6c34\u7ebf：\u64cd\u4f5c\u7801\u5207\u5206 $\\\\rightarrow$ \u57fa\u672c\u5757\u4e0e\u63a7\u5236\u6d41\u56fe（CFG）\u6784\u5efa $\\\\rightarrow$ \u6808\u5e73\u8861\u5206\u6790\u4e0e\u4e09\u5730\u5740\u7801（TAC）\u751f\u6210 $\\\\rightarrow$ \u6570\u636e\u6d41\u4e0e\u53d8\u91cf\u5b9a\u503c\u4f7f\u7528\u94fe（UD-Chains）\u63a8\u6f14 $\\\\rightarrow$ \u62bd\u8c61\u8bed\u6cd5\u6811（AST）\u91cd\u6784\u3002<\/p>\n
\u672c\u6587\u5c06\u7cfb\u7edf\u62c6\u89e3 EVM \u53cd\u7f16\u8bd1\u5668\u7684\u5e95\u5c42\u7406\u8bba\u67b6\u6784，\u5e76\u4f7f\u7528 Python \u5b8c\u6574\u5b9e\u73b0\u4e00\u5957\u4ece\u539f\u59cb\u5b57\u8282\u7801\u6062\u590d\u4e09\u5730\u5740\u7801\u4e0e\u8868\u8fbe\u5f0f\u6811\u7684\u6838\u5fc3\u9006\u5411\u5f15\u64ce\u3002<\/p>\n
\u57fa\u672c\u5757\u662f\u6307\u4e00\u6bb5\u8fde\u7eed\u6267\u884c\u3001\u53ea\u6709\u4e00\u4e2a\u5165\u53e3\u548c\u4e00\u4e2a\u51fa\u53e3\u7684\u6307\u4ee4\u5e8f\u5217\u3002\u5728 EVM \u5b57\u8282\u7801\u4e2d，\u57fa\u672c\u5757\u7684\u8fb9\u754c\u7531\u4ee5\u4e0b\u6307\u4ee4\u754c\u5b9a：<\/p>\n
\u901a\u8fc7\u904d\u5386\u5b57\u8282\u7801，\u5c06\u7ebf\u6027\u5e8f\u5217\u5207\u5206\u4e3a\u7531\u6709\u5411\u8fb9\u8fde\u63a5\u7684\u57fa\u672c\u5757\u7f51\u7edc，\u5c31\u5f62\u6210\u4e86\u63a7\u5236\u6d41\u56fe（CFG）\u3002<\/p>\n
EVM \u7684\u6838\u5fc3\u75db\u70b9\u662f\u6808\u6df1\u5ea6\u52a8\u6001\u53d8\u5316\u3002\u4f8b\u5982\u4ee3\u7801\u5e8f\u5217：<\/p>\n
PUSH1 0x04
\nCALLDATALOAD
\nPUSH1 0x20
\nADD<\/p>\n
\u5728\u6808\u5f0f\u67b6\u6784\u4e2d，\u4e2d\u95f4\u7ed3\u679c\u6ca1\u6709\u540d\u5b57\u3002\u4e09\u5730\u5740\u7801（TAC）\u901a\u8fc7\u5f15\u5165\u865a\u62df\u5bc4\u5b58\u5668（\u5982 $v_0, v_1, \\\\dots$）\u6d88\u9664\u5bf9\u6808\u7684\u7269\u7406\u4f9d\u8d56：<\/p>\n
v0 = CALLDATALOAD(0x04)
\nv1 = ADD(v0, 0x20)<\/p>\n
\u4e3a\u4e86\u5b9e\u73b0\u8fd9\u4e00\u6b65，\u53cd\u7f16\u8bd1\u5668\u5728\u904d\u5386\u57fa\u672c\u5757\u5185\u7684\u6307\u4ee4\u65f6\u7ef4\u62a4\u4e00\u4e2a\u865a\u62df\u7b26\u53f7\u6808（Symbolic Stack）\u3002\u6bcf\u5f53\u9047\u5230\u8ba1\u7b97\u6307\u4ee4，\u4ece\u7b26\u53f7\u6808\u5f39\u51fa\u5bf9\u5e94\u6570\u91cf\u7684\u64cd\u4f5c\u6570，\u8d4b\u4e88\u4e00\u4e2a\u5168\u65b0\u4e34\u65f6\u53d8\u91cf，\u5e76\u5c06\u8be5\u4e34\u65f6\u53d8\u91cf\u91cd\u65b0\u538b\u5165\u7b26\u53f7\u6808\u3002<\/p>\n
\u4e09\u5730\u5740\u7801\u867d\u7136\u6d88\u9664\u4e86\u6808，\u4f46\u4ecd\u7136\u5305\u542b\u5927\u91cf\u5197\u4f59\u7684\u5355\u6b65\u4e34\u65f6\u53d8\u91cf\u3002\u901a\u8fc7\u5b9a\u503c-\u4f7f\u7528\u94fe\u5206\u6790（Def-Use Analysis），\u82e5\u53d8\u91cf $v_0$ \u4ec5\u88ab\u4f7f\u7528\u4e00\u6b21，\u4e14\u4f7f\u7528\u70b9\u4e0e\u5b9a\u4e49\u70b9\u4e4b\u95f4\u6ca1\u6709\u53d1\u751f\u72b6\u6001\u6216\u5185\u5b58\u526f\u4f5c\u7528，\u5373\u53ef\u5c06\u5176\u5411\u4e0a\u5185\u5d4c（Inlining）\u5e76\u5408\u6210\u4e3a\u8868\u8fbe\u5f0f\u6811：$$v_{target} = \\\\text{Add}(\\\\text{CalldataLoad}(0x04), 0x20)$$\u8fdb\u4e00\u6b65\u5bf9\u63a7\u5236\u6d41\u56fe\u4e2d\u7684\u5faa\u73af\u7ed3\u6784（\u5929\u7136\u5f62\u6210\u7684\u5f3a\u8fde\u901a\u5206\u91cf）\u548c\u6761\u4ef6\u5206\u652f（JUMPI）\u8fdb\u884c\u6a21\u5f0f\u8bc6\u522b，\u5373\u53ef\u91cd\u6784\u51fa\u9ad8\u7ea7\u7684 if-else\u3001while \u5faa\u73af\u4e0e\u51fd\u6570\u9009\u62e9\u5668\u8c03\u5ea6\u5206\u53d1\u5668（Dispatcher）\u3002<\/p>\n
\u4ee5\u4e0b\u662f\u7528 Python \u5b9e\u73b0\u7684\u9ad8\u6027\u80fd EVM \u5b57\u8282\u7801\u7b26\u53f7\u53cd\u7f16\u8bd1\u6838\u5fc3，\u6f14\u793a\u4e86\u5982\u4f55\u5c06\u5b57\u8282\u7801\u8f6c\u6362\u4e3a\u7ed3\u6784\u5316\u7684\u4e09\u5730\u5740\u7801\u5e76\u6298\u53e0\u4e3a\u9ad8\u9636\u8868\u8fbe\u5f0f：<\/p>\n
from typing import List, Dict, Tuple, Any<\/p>\n
# \u57fa\u7840\u64cd\u4f5c\u7801\u5b9a\u4e49\u8868 (\u64cd\u4f5c\u7801 -> (\u52a9\u8bb0\u7b26, \u5f39\u51fa\u6808\u53c2\u6570\u6570, \u538b\u5165\u6808\u7ed3\u679c\u6570))
\nOPCODES = {
\n 0x00: ("STOP", 0, 0),
\n 0x01: ("ADD", 2, 1),
\n 0x02: ("MUL", 2, 1),
\n 0x03: ("SUB", 2, 1),
\n 0x04: ("DIV", 2, 1),
\n 0x10: ("LT", 2, 1),
\n 0x11: ("GT", 2, 1),
\n 0x14: ("EQ", 2, 1),
\n 0x15: ("ISZERO", 1, 1),
\n 0x16: ("AND", 2, 1),
\n 0x17: ("OR", 2, 1),
\n 0x20: ("SHA3", 2, 1),
\n 0x35: ("CALLDATALOAD", 1, 1),
\n 0x50: ("POP", 1, 0),
\n 0x54: ("SLOAD", 1, 1),
\n 0x55: ("SSTORE", 2, 0),
\n 0x56: ("JUMP", 1, 0),
\n 0x57: ("JUMPI", 2, 0),
\n 0x5b: ("JUMPDEST", 0, 0),
\n 0xf3: ("RETURN", 2, 0),
\n 0xfd: ("REVERT", 2, 0),
\n}<\/p>\n
class Instruction:
\n def __init__(self, pc: int, opcode: int, mnemonic: str, operand: bytes = b''):
\n self.pc = pc
\n self.opcode = opcode
\n self.mnemonic = mnemonic
\n self.operand = operand<\/p>\n
def __repr__(self):
\n if self.operand:
\n return f"{hex(self.pc)}: {self.mnemonic} 0x{self.operand.hex()}"
\n return f"{hex(self.pc)}: {self.mnemonic}"<\/p>\n
class EVMDecompiler:
\n def __init__(self, hex_code: str):
\n if hex_code.startswith("0x"):
\n hex_code = hex_code[2:]
\n self.bytecode = bytes.fromhex(hex_code)
\n self.instructions: List[Instruction] = []
\n self.var_counter = 0<\/p>\n
def disassemble(self) -> List[Instruction]:
\n """\u5c06\u539f\u59cb\u5b57\u8282\u7801\u89e3\u7801\u4e3a\u6307\u4ee4\u5e8f\u5217"""
\n pc = 0
\n length = len(self.bytecode)
\n while pc < length:
\n op = self.bytecode[pc]
\n if 0x60 <= op <= 0x7f: # PUSH1 – PUSH32
\n push_bytes = op – 0x5f
\n operand = self.bytecode[pc + 1 : pc + 1 + push_bytes]
\n self.instructions.append(Instruction(pc, op, f"PUSH{push_bytes}", operand))
\n pc += 1 + push_bytes
\n elif 0x80 <= op <= 0x8f: # DUP1 – DUP16
\n self.instructions.append(Instruction(pc, op, f"DUP{op – 0x7f}"))
\n pc += 1
\n elif 0x90 <= op <= 0x9f: # SWAP1 – SWAP16
\n self.instructions.append(Instruction(pc, op, f"SWAP{op – 0x8f}"))
\n pc += 1
\n elif op in OPCODES:
\n name = OPCODES[op][0]
\n self.instructions.append(Instruction(pc, op, name))
\n pc += 1
\n else:
\n self.instructions.append(Instruction(pc, op, f"UNKNOWN_{hex(op)}"))
\n pc += 1
\n return self.instructions<\/p>\n
def generate_tac(self) -> List[str]:
\n """
\n \u57fa\u4e8e\u7b26\u53f7\u6808\u63a8\u5bfc\u4e09\u5730\u5740\u7801（TAC）
\n """
\n stack: List[str] = []
\n tac_statements: List[str] = []<\/p>\n
for inst in self.instructions:
\n if inst.mnemonic.startswith("PUSH"):
\n val = f"0x{inst.operand.hex()}"
\n stack.append(val)
\n elif inst.mnemonic.startswith("DUP"):
\n idx = int(inst.mnemonic[3:])
\n if len(stack) >= idx:
\n val = stack[-idx]
\n stack.append(val)
\n elif inst.mnemonic.startswith("SWAP"):
\n idx = int(inst.mnemonic[4:])
\n if len(stack) > idx:
\n stack[-1], stack[-idx – 1] = stack[-idx – 1], stack[-1]
\n elif inst.opcode in OPCODES:
\n name, pop_cnt, push_cnt = OPCODES[inst.opcode]
\n if len(stack) < pop_cnt:
\n # \u6808\u4e0b\u6ea2，\u6ce8\u5165\u7b26\u53f7\u5360\u4f4d\u7b26
\n operands = [f"arg_{i}" for i in range(pop_cnt)]
\n else:
\n operands = [stack.pop() for _ in range(pop_cnt)]<\/p>\n
if push_cnt == 1:
\n var_name = f"v{self.var_counter}"
\n self.var_counter += 1
\n stmt = f"{var_name} = {name}({', '.join(reversed(operands))})"
\n tac_statements.append(stmt)
\n stack.append(var_name)
\n else:
\n if name in ("SSTORE", "JUMPI", "RETURN", "REVERT"):
\n stmt = f"{name}({', '.join(reversed(operands))})"
\n tac_statements.append(stmt)
\n elif name == "POP":
\n pass
\n return tac_statements<\/p>\n
if __name__ == "__main__":
\n # \u793a\u4f8b\u6d4b\u8bd5\u5b57\u8282\u7801：\u8bfb\u53d6 calldata(4) \u5e76\u5c06\u5bf9\u5e94 Storage[0] \u52a0\u4e0a\u8be5\u503c
\n # PUSH1 0x04, CALLDATALOAD, PUSH1 0x00, SLOAD, ADD, PUSH1 0x00, SSTORE, STOP
\n sample_bytecode = "6004356000540160005500"<\/p>\n
decompiler = EVMDecompiler(sample_bytecode)
\n instructions = decompiler.disassemble()
\n print("=== \u53cd\u6c47\u7f16\u6307\u4ee4\u6d41 ===")
\n for inst in instructions:
\n print(inst)<\/p>\n
tac = decompiler.generate_tac()
\n print("\\\\n=== \u751f\u6210\u7684\u4e09\u5730\u5740\u7801 (TAC) ===")
\n for line in tac:
\n print(line)<\/p>\n
\u8fd0\u884c\u4e0a\u8ff0\u4ee3\u7801，\u63a7\u5236\u53f0\u5c06\u8f93\u51fa\u6e05\u6670\u7684\u4e09\u5730\u5740\u7801\u5e8f\u5217：<\/p>\n
=== \u53cd\u6c47\u7f16\u6307\u4ee4\u6d41 ===
\n0x0: PUSH1 0x04
\n0x2: CALLDATALOAD
\n0x3: PUSH1 0x00
\n0x5: SLOAD
\n0x6: ADD
\n0x7: PUSH1 0x00
\n0x9: SSTORE
\n0xa: STOP<\/p>\n
=== \u751f\u6210\u7684\u4e09\u5730\u5740\u7801 (TAC) ===
\nv0 = CALLDATALOAD(0x04)
\nv1 = SLOAD(0x00)
\nv2 = ADD(v1, v0)
\nSSTORE(0x00, v2)<\/p>\n
\u5f53\u4e09\u5730\u5740\u7801\u88ab\u5b8c\u6574\u63d0\u53d6\u540e，\u53cd\u7f16\u8bd1\u5668\u7684\u6700\u7ec8\u9636\u6bb5\u662f\u7c7b\u578b\u63a8\u65ad（Type Inference）\u4e0e\u8bed\u6cd5\u6811\u5339\u914d：<\/p>\n
EVM \u5b57\u8282\u7801\u53cd\u7f16\u8bd1\u4e0d\u662f\u7384\u5b66，\u800c\u662f\u4e00\u5957\u4e25\u8c28\u7684\u7f16\u8bd1\u5668\u524d\u7aef\u4e0e\u4e2d\u95f4\u8868\u793a\u9006\u5411\u5de5\u7a0b\u3002\u638c\u63e1\u4e86\u4ece Opcodes \u5230 TAC \u518d\u5230 AST \u7684\u63a8\u5bfc\u95ed\u73af，\u4efb\u4f55\u672a\u7ecf\u5f00\u6e90\u7684\u6697\u6c60\u5408\u7ea6\u3001\u9ed1\u5ba2\u653b\u51fb\u5408\u7ea6\u90fd\u5c06\u5728\u5b89\u5168\u7814\u7a76\u5458\u7684\u5c4f\u5e55\u4e0a\u663e\u9732\u5176\u539f\u59cb\u7684\u5168\u8c8c\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
\u5728\u667a\u80fd\u5408\u7ea6\u5b89\u5168\u5ba1\u8ba1\u3001\u95ed\u6e90\u534f\u8bae\u9006\u5411\u5206\u6790\u4ee5\u53ca\u9ed1\u5ba2\u94fe\u4e0a\u8d44\u4ea7\u8ffd\u8e2a\u8fc7\u7a0b\u4e2d，\u5b89\u5168\u5de5\u7a0b\u5e08\u9762\u5bf9\u7684\u5f80\u5f80\u53ea\u662f\u4e00\u4e32\u5341\u516d\u8fdb\u5236\u7684 EVM \u8fd0\u884c\u65f6\u5b57\u8282\u7801（Runtime Bytecode）\u3002\u7531\u4e8e\u4ee5\u592a\u574a\u865a\u62df\u673a（EVM）\u91c7\u7528\u4e86\u51c6\u56fe\u7075\u5b8c\u5907\u7684\u57fa\u4e8e\u6808（Stack-based）\u67b6\u6784，\u6ca1\u6709\u901a\u7528\u5bc4\u5b58\u5668，\u6240\u6709\u53d8\u91cf\u8ba1\u7b97\u5747\u901a\u8fc7\u5165\u6808（PUSH）\u3001\u51fa\u6808（POP&#<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[66,723,50,1160],"topic":[],"class_list":["post-117511","post","type-post","status-publish","format-standard","hentry","category-server","tag-ai","tag-react","tag-50","tag-1160"],"yoast_head":"\n