反汇编_if特征识别

if特征标志

#include<stdio.h>
void main()
{
	
	int flag1=0;
	int flag2=0;
	int flag3=0;

	if(flag1==0)
	{
		printf("%d\n",flag1);
	}
	if(flag2 > 0)
	{
		printf("%d\n",flag2);
	}
	if(flag3 < 0)
	{
		printf("%d\n",flag3);
	}
	return 0;
}

汇编
2: void main()
3: {
00401010 push ebp
00401011 mov ebp,esp
00401013 sub esp,4Ch
00401016 push ebx
00401017 push esi
00401018 push edi
00401019 lea edi,[ebp-4Ch]
0040101C mov ecx,13h
00401021 mov eax,0CCCCCCCCh
00401026 rep stos dword ptr [edi]
4:
5: int flag1=0;
00401028 mov dword ptr [ebp-4],0
6: int flag2=0;
0040102F mov dword ptr [ebp-8],0
7: int flag3=0;
00401036 mov dword ptr [ebp-0Ch],0
8:
9: if(flag1==0)
0040103D cmp dword ptr [ebp-4],0
00401041 jne main+44h (00401054)
10: {
11: printf("%d\n",flag1);
00401043 mov eax,dword ptr [ebp-4]
00401046 push eax
00401047 push offset string “%d\n” (0042201c)
0040104C call printf (004010c0)
00401051 add esp,8
12: }
13: if(flag2 > 0)
00401054 cmp dword ptr [ebp-8],0
00401058 jle main+5Bh (0040106b)
14: {
15: printf("%d\n",flag2);
0040105A mov ecx,dword ptr [ebp-8]
0040105D push ecx
0040105E push offset string “%d\n” (0042201c)
00401063 call printf (004010c0)
00401068 add esp,8
16: }
17: if(flag3 < 0)
0040106B cmp dword ptr [ebp-0Ch],0
0040106F jge main+72h (00401082)
18: {
19: printf("%d\n",flag3);
00401071 mov edx,dword ptr [ebp-0Ch]
00401074 push edx
00401075 push offset string “%d\n” (0042201c)
0040107A call printf (004010c0)
0040107F add esp,8
20: }
21: return 0;
22: }
00401082 pop edi
00401083 pop esi
00401084 pop ebx
00401085 add esp,4Ch
00401088 cmp ebp,esp
0040108A call __chkesp (00401140)
0040108F mov esp,ebp
00401091 pop ebp
00401092 ret

结论

if语句汇编中的条件判断与源代码条件相反

2021/2/16