反汇编小代码说明

最新推荐文章于 2024-05-12 10:01:45 发布

幻昱

最新推荐文章于 2024-05-12 10:01:45 发布

阅读量473

点赞数

文章标签： c++ 反汇编 c#

本文链接：https://blog.csdn.net/weixin_45239587/article/details/105028734

版权

#include "函数.h"
void _tmain()
{
	int v10[4] = { 0 };
	_asm
	{
		mov ecx, 4//循环计数为4
		mov eax,1//将1 放入eax寄存器中，进行累加计算
		lea edi,v10//取v10地址放入寄存器edi中
		rep stos dword ptr es:[edi]//将edi中地址 一次（dword）（byte一个字节)4个字节 循环4次 进行初始化为1
	}



	int v1 = 1;
	int v2 = 2;
	int v3 = 3;
	int v4 = 4;
	int v5 = 5;
	int Result = sub_1(v1, v2, v3, v4, v5);

	_tprintf(_T("%d\r\n"), Result);


	_tprintf(_T("Input AnyKey Exit\r\n"));
	getchar();
}


int sub_1(int p1, int p2, int p3, int p4, int p5)
{
	int Result = p1 + p2 + p3 + p4 + p5;

	_asm
	{
		mov eax,dword ptr[ebp] //栈回溯，直接取栈底地址进行操作
		sub eax,8
		mov eax,dword ptr[eax]
		mov Result,eax
	}

	return Result;


}


以上代码说明
/*
void _tmain()
{
	
	   *00A24210  push        ebp //将esp地址向上移动一个（4字节移动）
		00A24211  mov         ebp, esp  //确定ebp
		00A24213  sub         esp, 108h//esp内存操作

		00A24219  push        ebx//放入ebx,esi的值的同时，esp指向也跟着向上移动
		00A2421A  push        esi
		00A2421B  push        

		00A2421C  lea         edi, [ebp - 108h]
		00A24222  mov         ecx, 42h
		00A24227  mov         eax, 0CCCCCCCCh
		00A2422C  rep stos    dword ptr es : [edi]//将地址初始化0CCCCCCCCh*///开栈操作

/*
		int v1 = 1;
	00A2422E  mov         dword ptr[v1], 1//压栈操作。注意压参顺序1,2,3,4，5
		int v2 = 2;
	00A24235  mov         dword ptr[v2], 2
		int v3 = 3;
	00A2423C  mov         dword ptr[v3], 3
		int v4 = 4;
	00A24243  mov         dword ptr[v4], 4
		int v5 = 5;
	00A2424A  mov         dword ptr[v5], 5
		int Result = sub_1(v1, v2, v3, v4, v5);
	00A24251  mov         eax, dword ptr[v5]//将dword ptr[v5]（5）放入到eax中
		00A24254  push        eax//将eax入栈
		00A24255  mov         ecx, dword ptr[v4]
		00A24258  push        ecx
		00A24259  mov         edx, dword ptr[v3]
		00A2425C  push        edx
		00A2425D  mov         eax, dword ptr[v2]
		00A24260  push        eax
		00A24261  mov         ecx, dword ptr[v1]
		00A24264  push        ecx  //顺序变为5,4,3,2,1,以上是压参数列表操作
		00A24265  call        sub_1(0A21078h)//call指令，需要存入call指令的下一条地址进行寻址
		                         
		00A2426A  add         esp, 14h//恢复参数列表
		00A2426D  mov         dword ptr[Result], eax



		_tprintf(_T("%d\r\n"), Result);
	00A24270  mov         eax, dword ptr[Result]
		00A24273  push        eax
		00A24274  push        offset string L"%d\r\n" (0A26BCCh)
		00A24279  call        _wprintf(0A21375h)
		00A2427E  add         esp, 8





		_tprintf(_T("Input AnyKey Exit\r\n"));
	00A24281  push        offset string L"Input AnyKey Exit\r\n" (0A26CD0h)
		00A24286  call        _wprintf(0A21375h)
		00A2428B  add         esp, 4
		getchar();
	00A2428E  mov         esi, esp
		00A24290  call        dword ptr[__imp__getchar(0A2A16Ch)]
		00A24296  cmp         esi, esp
		00A24298  call        __RTC_CheckEsp(0A21113h)
}
00A2429D  xor         eax, eax
00A2429F  pop         edi
00A242A0  pop         esi
00A242A1  pop         ebx
00A242A2  add         esp, 108h
00A242A8  cmp         ebp, esp
00A242AA  call        __RTC_CheckEsp(0A21113h)
}
00A242AF  mov         esp, ebp
00A242B1  pop         ebp
00A242B2  ret
*/



/*  子函数反汇编


int sub_1(int p1, int p2, int p3, int p4, int p5)
{
	00FA1780  push        ebp//被调用函数首先要开栈保留主调函数栈底
		00FA1781  mov         ebp, esp
		00FA1783  sub         esp, 0D0h
		00FA1789  push        ebx//将ebx,esi,edi的值保存在栈中
		00FA178A  push        esi
		00FA178B  push        edi
		00FA178C  lea         edi, [ebp - 0D0h]
		00FA1792  mov         ecx, 34h
		00FA1797  mov         eax, 0CCCCCCCCh
		00FA179C  rep stos    dword ptr es : [edi]//snb_1()函数进行开栈，


		int sub_1(int p1, int p2, int p3, int p4, int p5)
	{
		00FA179E  mov         eax, dword ptr[__security_cookie(0FA9004h)]
			00FA17A3  xor         eax, ebp//异或操作
			00FA17A5  mov         dword ptr[ebp - 4], eax
			int Result = p1 + p2 + p3 + p4 + p5;
		00FA17A8  mov         eax, dword ptr[p1]
			00FA17AB  add         eax, dword ptr[p2]//操作时将主函数ebp进行操作（ebp-向上取局部内存，ebp+向下取参数
			00FA17AE  add         eax, dword ptr[p3]
			00FA17B1  add         eax, dword ptr[p4]
			00FA17B4  add         eax, dword ptr[p5]
			00FA17B7  mov         dword ptr[Result], eax

			_asm
		{
			mov eax, dword ptr[ebp] //栈回溯，直接取栈底地址
			00FA17BA  mov         eax, dword ptr[ebp]
			sub eax, 8
			00FA17BD  sub         eax, 8
			mov eax, dword ptr[eax]
			00FA17C0  mov         eax, dword ptr[eax]
			mov Result, eax
			00FA17C2  mov         dword ptr[Result], eax
		}

		return Result;
		00FA17C5  mov         eax, dword ptr[Result]


	}
	00FA17C8  pop         edi
		00FA17C9  pop         esi
		00FA17CA  pop         ebx
		00FA17CB  mov         ecx, dword ptr[ebp - 4]
		00FA17CE  xor         ecx, ebp
		00FA17D0  call        @__security_check_cookie@4 (0FA1285h)
		00FA17D5  add         esp, 0D0h
		00FA17DB  cmp         ebp, esp
		00FA17DD  call        __RTC_CheckEsp(0FA1127h)
		00FA17E2  mov         esp, ebp
		00FA17E4  pop         ebp
		00FA17E5  ret

		*/