ida反编译程序 linux,[求助]IDA反汇编一个软件后的main函数的求助

对一个软件反汇编,这个软件实现的是在linux上输入./cmd -i filename(后面还会有一些选项命令-m mode、-q xxx什么的)会将这个文件进行一定的算法后得到新的数据后生成一个新文件,但是反汇编后产生的main函数却是完全不懂

.text:0000000000400190 public start

.text:0000000000400190 start proc near

.text:0000000000400190 000 xor ebp, ebp

.text:0000000000400192 000 mov r9, rdx

.text:0000000000400195 000 pop rsi

.text:0000000000400196 -08 mov rdx, rsp

.text:0000000000400199 -08 and rsp, 0FFFFFFFFFFFFFFF0h

.text:000000000040019D -08 push rax

.text:000000000040019E 000 push rsp

.text:000000000040019F 008 mov r8, 670060h

.text:00000000004001A6 008 mov rcx, 6700A0h

.text:00000000004001AD 008 mov rdi, 40B040h ; main函数地址

.text:00000000004001B4 008 call __libc_start_main

.text:00000000004001B4 start endp

进入main函数却是这样了:

.text:000000000040B03B ; ------------------------------------------------------------------

.text:000000000040B03C align 20h ; main函数部分

.text:000000000040B040 push r15

.text:000000000040B042 mov rcx, 3FB999999999999Ah

.text:000000000040B04C mov edx, 8

.text:000000000040B051 push r14

.text:000000000040B053 push r13

.text:000000000040B055 mov r13, rsi

.text:000000000040B058 mov rsi, 412E848000000000h

.text:000000000040B062 push r12

.text:000000000040B064 mov r12d, edi

.text:000000000040B067 mov rdi, 3FF0000000000000h

.text:000000000040B071 push rbp

.text:000000000040B072 push rbx

.text:000000000040B073 sub rsp, 0A58h

.text:000000000040B07A mov [rsp+848h], rdi

.text:000000000040B082 lea rdi, [rsp+840h]

.text:000000000040B08A mov [rsp+850h], rsi

.text:000000000040B092 mov qword ptr [rsp+860h], 9C5638h

.text:000000000040B09E mov qword ptr [rsp+868h], 9C5638h

.text:000000000040B0AA mov esi, offset aBy_order ; "by_order"

.text:000000000040B0AF mov dword ptr [rsp+840h], 0Ah

.text:000000000040B0BA mov [rsp+858h], rcx

.text:000000000040B0C2 add rdi, 20h

.text:000000000040B0C6 call sub_62F320

.text:000000000040B0CB lea rdi, [rsp+840h]

.text:000000000040B0D3 mov edx, 5

.text:000000000040B0D8 mov esi, offset aDelay ; "delay"

.text:000000000040B0DD add rdi, 28h

.text:000000000040B0E1 call sub_62F320

.text:000000000040B0E6 lea rdx, [rsp+0A16h]

.text:000000000040B0EE mov esi, offset aNot_set ; "not_set"

.text:000000000040B0F3 lea rdi, [rsp+950h]

.text:000000000040B0FB call sub_62E710

.text:000000000040B100 lea rdx, [rsp+0A17h]

.text:000000000040B108 mov esi, offset aNot_set ; "not_set"

.text:000000000040B10D lea rdi, [rsp+940h]

.text:000000000040B115 call sub_62E710

.text:000000000040B11A mov dword ptr [rsp+870h], 5

.text:000000000040B125 mov byte ptr [rsp+874h], 0

.text:000000000040B12D call HeadOfUiMOR

.text:000000000040B132 lea rdi, [rsp+938h]

.text:000000000040B13A call sub_69B9F0

.text:000000000040B13F cmp r12d, 1

.text:000000000040B143 jz sub_40B255 ; option的信息

.text:000000000040B149 lea r14, [rsp+0A0Ch]

.text:000000000040B151 mov byte ptr [rsp+13h], 1

.text:000000000040B156 mov r15d, 1

.text:000000000040B15C

.text:000000000040B15C ; ======= S U B R O U T I N E ============

感觉像是main函数突然开始又突然结束,第一次反汇编个软件,小白伤不起啊,求大牛施以援手啊,现在就想找个文件指针还找不到

1c26347f1c84e71d929702fbb9b8c909.gif

1c26347f1c84e71d929702fbb9b8c909.gif

1c26347f1c84e71d929702fbb9b8c909.gif

评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值