LDWJ2016的博客

1. 功能：Hit trace 可以分析所选的代码中哪条指令执行了，哪条指令没执行。2. 原理：在所选择的每一条指令上设置INT 3断点，当中断发生时，OD把指令恢复为原来的指令。没执行的指令还保持为INT 3。3. 方法： 选择一块指令，选择右键菜单 “Hit trace / Add selection”，按F9运行程序，执行过的指令会被标记为不同的颜色。 ...

ORR         Logical OR.Syntax         ORR{S}{cond} Rd, Rn, Operand2where:S         is an optional suffix. If S is specified, the condition flags are updated on the result of the operation.cond   ...

You use branch instructions to call and return from subroutines. The Procedure Call Standard for theArm Architecture defines how to use registers in subroutine calls.A subroutine is a block of code ...

The read-modify-write operation ensures that you modify only the specific bits in a system register thatyou want to change.Individual bits in a system register control different system functionality...

Arm processors provide general-purpose and special-purpose registers. Some additional registers areavailable in privileged execution modes.In all Arm processors in AArch32 state, the following regis...

You can write the names of Advanced SIMD and floating-point registers either in upper case or lower case.The following table shows the predeclared extension register names:Register names Meaning...

Many of the core register names have synonyms.The following table shows the predeclared core registers:                                             Register names Meaning r0-r15 and R0-R15 ...

Object files produced by the assembler are divided into sections. In assembly source code, you use theAREA directive to mark the start of a section.ELF sections are independent, named, indivisible s...

Assembly language source code can contain numeric, string, Boolean, and single character literals.Literals can be expressed as:        • Decimal numbers, for example 123.        • Hexadecimal numbe...

The assembler parses and assembles assembly language to produce object code.SyntaxEach line of assembly language source code has this general form:           {symbol} {instruction|directive|pseudo-i...

Instructions that can be conditional have an optional two character condition code suffix.Condition codes are shown in syntax descriptions as {cond}. The following table shows the conditioncodes tha...

Logical shift left (LSL)Logical shift left by n bits moves the right-hand 32-n bits of a register to the left by n places, into the lefthand 32-n bits of the result. It sets the right-hand n bits o...

1) Logical shift right (LSR)Logical shift right by n bits moves the left-hand 32-n bits of a register to the right by n places, into theright-hand 32-n bits of the result. It sets the left-hand n ...

CMP and CMN                Compare and Compare Negative.Syntax                CMP{cond} Rn, Operand2                CMN{cond} Rn, Operand2where:cond               is an optional condition code.Rn...

UXTH             Zero extend Halfword.Syntax             UXTH{cond} {Rd}, Rm {,rotation}where:cond             is an optional condition code.Rd             is the destination register.Rm        ...

DCB           The DCB directive allocates one or more bytes of memory, and defines the initial runtime contents of the memory.Syntax           {label} DCB expr{,expr}...where:expr           is eit...

Move to Coprocessor from general-purpose register. Depending on the coprocessor, you might be able tospecify various additional operations.-------------- Note ----------------MCR2 is not supported ...

1. Run trace ( 运行跟踪) 可以把被调试程序所执行过的指令保存下来。2. Run trace 把程序运行过程中所执行指令的地址、寄存器的值、消息等保存到缓冲区中。 如果缓冲区设置过小，则当缓冲区    填满时，最早记录的数据会被覆盖。可在 “Optins / Debug options / Trace” 页中设置。3. 把Run trace记录的数据保存到文件：在运行 Run ...

1. 再调试一个程序之前，先设置OD使之可以停在程序的入口点。    单击 ” Options/Debugging options” 打开调试选项配置对话框，在 “event” 标签页上，设置OD在首次何处何时暂停。        1. 一般将暂停点设置在 “ Entry point of main module ” 或 “WinMain” 处而不是系统断点处。             1....

1. OD默认只能加载32个插件。2. OD的插件之间可能会有冲突。因此建议插件目录下仅放置常用的插件。3. 命令行插件    3.1 打开插件： 单击菜单“Plugins/command line/command line”。    3.2 命令行插件的命令很多，详细命令可参阅其自带的帮助文档。    3.3 常用命令：          命令 功能 ？ 表达式 计...

OD 常用的断点有： INT3断点，硬件断点，内存断点，消息断点，条件断点。一. INT3断点     1. 在CPU窗口，按F2 或 双击 “ Hex dump”列设置一个INT3断点，再次按F2或双击 “Hex dump”则取消已经设置的 INT3断点。      说明：如果将断点设置到当前应用程序代码之外，OD会弹出警告，可在“Options/Debuggging options/...

1. 乱码     现象：如果反汇编面板中显示的都是db之类的数据，那就说明OD把代码当成数据了，没有进行反汇编。     解决方法： 1）在反汇编面板上选择右键菜单里的 “ Analysis / Analyse code” （或其快捷键 Ctrl + A）强制OD重新把此处当                              成代码来进行分析即可。                ...

1. OllyDbg可以用两种方式加载被调试的目标程序，一是通过CreateProcess创建进程，二是用函数DebugActiveProcess将OD    绑定到一个正在运行的程序上。    1.1 用CreateProcess创建进程          1.1.1  单击菜单“File / Open” 或 快捷键F3打开要调试的可执行程序，OD会调用CreateProcess创建一个用...

1） OD的安装       OD是以zip压缩包的形式发布的，比如 odbg110.zip 或，odbg200.zip把zip解压到任意目录，然后运行解压目录下      的OLLYDBG.EXE即可。2） OD 的窗口       打开或附加到程序后，OD会打开多个子窗口，但是CPU窗口是最大化显示的，把其它窗口隐藏了，要查看其它窗       口，要么单击窗口切换面板上的图标。...

1. STMFD sp!,  {r0-r15}    保存到栈中的sp的值是这条指令执行之后的sp值。

BIC        Bit Clear.Syntax        BIC{S}{cond} Rd, Rn, Operand2where:S        is an optional suffix. If S is specified, the condition flags are updated on the result of the operation.cond       ...

To make source files easier to read, you can split a long line of source into several lines by placing a backslash character (\) at the end of the line. The backslash must not be followed by any other...

You must write instruction mnemonics, pseudo-instructions, directives, and symbolic register names(except a1-a4 and v1-v8 in A32 or T32 instructions) in either all uppercase or all lowercase. You mus...

----------------------------

When you use an Operand2 register in an instruction, you can optionally also specify a shift value.Syntax        Rm {, shift}where:Rm        is the register holding the data for the second operand....

An Operand2 constant in an instruction has a limited range of values.Syntax        #constantwhere constant is an expression evaluating to a numeric value.UsageIn A32 instructions, constant can have...

Many A32 and T32 general data processing instructions have a flexible second operand.This is shown as Operand2 in the descriptions of the syntax of each instruction.Operand2 can be a:        • Cons...

AND             Logical AND.Syntax             AND{S}{cond} Rd, Rn, Operand2where:S            is an optional suffix. If S is specified, the condition flags are updated on the result of the operat...

文档1： Arm® Compiler armasm User Guide Version 6.10.pdf             非常方便查找ARM指令功能及用法。文档2：ARM®v5 Architecture Reference Manual.pdf             学习CPU架构、内存及系统架构的不二之选。文档3：ARM926EJ-S Development Chip...

Many of the core register names have synonyms.The following table shows the predeclared core registers: Register names Meaning r0-r15 and R0-R15 General purpose registers. a1-a4 Argum...

#pragma   pack ( n )结构体#pragma   pack (  )对齐参数： n 为对齐参数，其取值为1、2、4、8，默认为8。规则1：       如果这个值比结构体成员的sizeof值小，那么该成员的偏移量应该以此为准。       亦即，结构体成员的偏移量应该取二者的最小值。规则2：      结构体整体所占空间要是n的整数倍。

数组的内存特征：元素 地址连续而且元素等宽。结构的内存特征：元素地址连续但元素不等宽。

被调函数调用前的准备：       1）主调函数把被调函数的参数由右到左依次压栈       2）把CALL指令的下一条指令的地址（亦即：返回地址）压栈，同时把EIP修改为被调函数的首地址（通过CALL指令）。被调函数执行时：      1）把EBP压入堆栈（PUSH EBP）。      3）使EBP指向堆栈中原EBP的值(MOV EBP, ESP)。      3）

函数内部功能分析步骤：  1. 分析参数  2. 分析局部变量  3.分析全局变量  4. 功能分析  5. 返回值分析  6. 还原成C函数

观察步骤：   1. 不考虑EBP、ESP。    2. 只找给别人赋值的寄存器：EAX 、ECX、 EDX、EBX、ESI、EDI。    3.找到之后追查其来源。如果，如果该寄存器的值不是在函数内被赋值的，那一定是传进来的参数。    公式一： 寄存器 + ret   4 =  参数个数     公式二： 寄存器 + [EBP + 8]、[EBP + 0x]  = 参数