对一个软件反汇编,这个软件实现的是在linux上输入./cmd -i filename(后面还会有一些选项命令-m mode、-q xxx什么的)会将这个文件进行一定的算法后得到新的数据后生成一个新文件,但是反汇编后产生的main函数却是完全不懂
.text:0000000000400190 public start
.text:0000000000400190 start proc near
.text:0000000000400190 000 xor ebp, ebp
.text:0000000000400192 000 mov r9, rdx
.text:0000000000400195 000 pop rsi
.text:0000000000400196 -08 mov rdx, rsp
.text:0000000000400199 -08 and rsp, 0FFFFFFFFFFFFFFF0h
.text:000000000040019D -08 push rax
.text:000000000040019E 000 push rsp
.text:000000000040019F 008 mov r8, 670060h
.text:00000000004001A6 008 mov rcx, 6700A0h
.text:00000000004001AD 008 mov rdi, 40B040h ; main函数地址
.text:00000000004001B4 008 call __libc_start_main
.text:00000000004001B4 start endp
进入main函数却是这样了:
.text:000000000040B03B ; ------------------------------------------------------------------
.text:000000000040B03C align 20h ; main函数部分
.text:000000000040B040 push r15
.text:000000000040B042 mov rcx, 3FB999999999999Ah
.text:000000000040B04C mov edx, 8
.text:000000000040B051 push r14
.text:000000000040B053 push r13
.text:000000000040B055 mov r13, rsi
.text:000000000040B058 mov rsi, 412E848000000000h
.text:000000000040B062 push r12
.text:000000000040B064 mov r12d, edi
.text:000000000040B067 mov rdi, 3FF0000000000000h
.text:000000000040B071 push rbp
.text:000000000040B072 push rbx
.text:000000000040B073 sub rsp, 0A58h
.text:000000000040B07A mov [rsp+848h], rdi
.text:000000000040B082 lea rdi, [rsp+840h]
.text:000000000040B08A mov [rsp+850h], rsi
.text:000000000040B092 mov qword ptr [rsp+860h], 9C5638h
.text:000000000040B09E mov qword ptr [rsp+868h], 9C5638h
.text:000000000040B0AA mov esi, offset aBy_order ; "by_order"
.text:000000000040B0AF mov dword ptr [rsp+840h], 0Ah
.text:000000000040B0BA mov [rsp+858h], rcx
.text:000000000040B0C2 add rdi, 20h
.text:000000000040B0C6 call sub_62F320
.text:000000000040B0CB lea rdi, [rsp+840h]
.text:000000000040B0D3 mov edx, 5
.text:000000000040B0D8 mov esi, offset aDelay ; "delay"
.text:000000000040B0DD add rdi, 28h
.text:000000000040B0E1 call sub_62F320
.text:000000000040B0E6 lea rdx, [rsp+0A16h]
.text:000000000040B0EE mov esi, offset aNot_set ; "not_set"
.text:000000000040B0F3 lea rdi, [rsp+950h]
.text:000000000040B0FB call sub_62E710
.text:000000000040B100 lea rdx, [rsp+0A17h]
.text:000000000040B108 mov esi, offset aNot_set ; "not_set"
.text:000000000040B10D lea rdi, [rsp+940h]
.text:000000000040B115 call sub_62E710
.text:000000000040B11A mov dword ptr [rsp+870h], 5
.text:000000000040B125 mov byte ptr [rsp+874h], 0
.text:000000000040B12D call HeadOfUiMOR
.text:000000000040B132 lea rdi, [rsp+938h]
.text:000000000040B13A call sub_69B9F0
.text:000000000040B13F cmp r12d, 1
.text:000000000040B143 jz sub_40B255 ; option的信息
.text:000000000040B149 lea r14, [rsp+0A0Ch]
.text:000000000040B151 mov byte ptr [rsp+13h], 1
.text:000000000040B156 mov r15d, 1
.text:000000000040B15C
.text:000000000040B15C ; ======= S U B R O U T I N E ============
感觉像是main函数突然开始又突然结束,第一次反汇编个软件,小白伤不起啊,求大牛施以援手啊,现在就想找个文件指针还找不到