86
Disassembly Visual C++
AND OR , , .
NOT NEG , , , , .
NOT , 1 0 0 1.
NEG 0. :
void NOTExample { void )
{
_asm {
MOV EAX , OFFh
MOV EBX , 1
NOT EAX // EAX OFFFFFFOOh.
NOT EBX // OFFFFFFFEh.
}
}
void NEGExample ( void ) (
_asm
{
MOV EAX , OFFh MOV EBX , 1
NEG EAX // EAX OFFFFFFOlh ( 0 - OFFh ).
NEC EBX // EBX OFFFFFFFFh ( 0 - 1 ).
}
}
XOR .
XOR 1, . , 0.
XOR ,
,
MOV EAX,0
( ), Microsoft
XOR .
, , , . , . , - ++
- -
, CPU x86. - « », .
.
.
EDX.
EDX. DIV
EDX, .
, .
DIV
MUL, , .
EDX. IDIV
EDX, .
, .
IMUL . ( ), . 86
IMUL .
LOCK , .
LOCK CPU, , , , CPU, , CPU .
, .
MOVSX , - (. . ).
MOVZX , - . .
LEA .
LEA. , ,
LEA API-
GetwindowsDirectory.
void LEAExamples ( void )
{
int * pint ;
int iVal ;
// -
// pint = siVal ;.
_asm
{
LEA EAX , iVal
MOV [pint] , EAX
}
///////////////////////////////////////////////////////////////////
char szBuff [ MAX_PATH ] ;
// LEA.
// -
// GetWindowsDirectory ( szBuff , _ ) ;.
_asm
{
PUSH 104h // _
// .
LEA , szBuff // szBuff.
PUSH ECX // szBuff
// .
CALL DWORD PTR [GetWindowsDirectory]
}
}
, ,
EFLAGS. - if. . 6.4 , .
6.4.
TEST " "
PL, ZR (SF, ZF PF Intel) .
TEST , .
, JMP .
- JE
,
- JL
,
- JG
,
- JNE
,
- JGE
,
- OLE
,
TEST , . . ,
Disassembly, ( 31) , , "NOT". ,
JLE (, ) ,
JNG (, ). ( Visual C++), . ,
jcc- Intel.
, . 6.4.
TEST. , , .
, , - , . .
void JumpExamples ( int i )
{
// -. ,
// "i > 0", .
// , , ,
// .
// .
// if ( i > 0 )
// {
// printf ( "i > 0\n" ) ;
// }
char szGreaterThan[] = "i > 0\n" ;
_asm
{
CMP i , 0 // i 0 (i - 0).
JLE JE_LessThanOne // i 0,
// .
PUSH i // .
LEA , szGreaterThan // .
PUSH CALL DWORD PTR [printf] // printf. , printf,
// , DLL,
// .
ADD ESP ,8 // printf _cdecl,
//
// .
JE_LessThanOne: //
// -.
}
////////////////////////////////////////////////////////////////////
// .
// -:
// int = abs ( i ) ;
// if. ( >=5 )
// {
// printf ( "abs(i) >= 5\n" ) ;
// }
// else
// {
// printf ( "abs(i) < 5\n" ) ;
// }
char szAbsGTEFive [] = "abs(i) >= 5\n" ;
char szAbsLTFive[] = "abs(i) < 5\n" ;
_asm
{
MOV EBX , i // i .
, 0 //
0 ( - 0).
JG JE_PosNum // 0,
// .
NEG // .
JE_PosNum:
, 5 // 5 ( - 5).
JL JE_LessThan5 // , 5.
LEA , szAbsGTEFive //
// .
JMP JE_DoPrintf // printf.
JE_LessThan5:
LEA , szAbsLTFive //
// .
JE_DoPrintf:
PUSH // .
CALL DWORD PTR [printf] // .
ADD ESP , 4 .. // .
}
}
, . " , , , if .
- J
,
- JBE
,
- JC
,
- JNC
,
- JNZ
,
- JZ
,
, ,
Disassembly. , .
LOOP, Microsoft . ( , Microsoft ) .
LOOP .
, .
LOOP. ,
.
,
LOOP ( ).
, , . if, , , if-
JMP, . .
void LoopingExample ( int q )
{
// -:
// for ( ; q < 10 ; q++ )
// {
// printf ( "q = %d\n" , q ) ;
// }
char szEmt[] = "q = %d\n" ;
_asm
{
JMP LE_CompareStep //
// 10.
LE_IncrementStep:
INC q // q.
LE_CompareStep:
CMP q , OAh // q 10.
JGE LE_End // q >= 10, .
MOV , DWORD PTR [q] // q .
PUSH // .
LEA , szFmt // .
PUSH // .
CALL DWORD PTR [printf] // .
ADD ESP , 8 // .
JMP LE_IncrementStep // q, .
LE_End: // .
}
}
Intel CPU , . . . , Intel.
Disassembly Visual C++ , . , .
MOVS
ESI EDI. ,
ESI EDI.
MOVS - memcpy.
Disassembly Visual C++ , , . ,
ESI EDI , (DF)
EFLAGS (
UP Registers Visual C++).
UP 0, , 1, . , : 1 , 2 4 .
SCAS , EDI,
AL, ( ).
EFLAGS. , . 6.4.
NULL- ( ),
SCAS , - strien.
MOVS, SCAS
EDI.
STOS
AL, ( ) ,
EDI. STOS -
memset.
MOVS SCAS,
STOS
EDI.
CMPS
EFLAGS. SCAS ,
CMPS .
CMPS -
memcmp. ,
CMPS , .
, , , . (
) .
Disassembly Step Into .
Step Over, .
Step Into
ESI EDI. :
, , .
, . ( ), :
void MemCPY ( char * szSrc , char * szDest , int iLen )
{
_asm
{
MOV ESI , szSrc // .
MOV EDI , szDest // ng.
MOV , iLen // .
// !
REP MOVS BYTE PTR [EDI] , BYTE PTR [ESI]
}
}
int StrLEN (char * szSrc )
{
int iReturn ; _asm
{
XOR EAX , EAX // .
MOV EDI , szSrc // EDI.
MOV ECX , 0FFFFFFFFh //
// .
REPNE SCAS BYTE PTR [EDI] // ,
// 0
// .
,0 // 0,
JE StrLEN_NoNull // NULL.
NOT ECX // ,
// .
DEC ' // NULL.
MOV EAX , // .
JMP StrLen_Done .// . StrLENJNoNull:
MOV EAX , OFFFFFFFFh // NULL ,
-1.
StrLEN_Done:
}
_asm MOV iReturn , EAX ;
return ( iReturn ) ;
}
void MemSET ( char * szDest , irit iVal , int iLen )
{ _asm
{
MOV EAX , iVal // EAX .
MOV EDI , szDest // EDI.
MOV ECX , iLen // .
REP STOS BYTE PTR [EDI] // .
}
}
int MemCMP ( char * szMeml , char * szMem2 , int iLen )
{
int iReturn ;
_asm
{
MOV ESI , szMeml // ESI .
MOV EDI , szMem2 // EDI .
MOV ECX , iLen //
// .
REPE CMPS BYTE PTR.
[ESI], BYTE PTR [EDI]
JL MemCMP_LessThan // szSrc < szDest
JG MemCMP_GreaterThan // szSrc > szDest
// .
XOR EAX', EAX // 0.
JMP MemCMP_Done
MemCMP_Les sThan:
MOV EAX , 0FFFFFFFFh // -1.
JMP MemCMP_Done
MemCMP_GreaterThan:
MOV EAX , 1 // 1.
JMP MemCMP_Done
XemCMP_Done:
}
_asm MOV iReturn ,
EAX return ( iReturn ) ;
}
. ,
Disassembly, , .
FS
FS Win32 : (Thread Information Block TIB).
TIB (Thread Environment Block
). TIB , . (SEH), .
SEH- 9. 15
Memstress-.
TIB ,
TIB, FS . , FS, : SEH-,
TIB .
SEH-
, , _try-. SEH-
TIB 0.
_except_ handlers.
MOV TIB. 0 , . ,
PUSH 004060d0
PUSH 004014a0
MOV EAX , FS:[00000000]
PUSH EAX
MOV DWORD PTR FS:[0] , ESP
, .
SEH-. , ,
CPU. , KERNEL32.DLL,
IsBadReadPtr Microsoft Windows NT 4.
MOV EAX , FS:[00000000h]
PUSH EBP
MOV EBP , ESP
PUSH 0FFh
PUSH 77F3DlE8h
PUSH _except_handler3
PUSH EAX
MOV EAX , [BaseStaticServerData];
MOV DWORD PTR FS:[0000000h] , ESP
,
SEH- , . , , , FS: [0]
SEH.
MOV , DWORD PTR [EBP-lOh] .
MOV DWORD PTR FS:[0] , ECX
TIB
FS:[18]
TIB. GetCurrentThreadid ( Windows 2000) TIB- , 0x24 ( 1-) (ID) .
GetCurrentThreadid:
MOV EAX , FS:[00000018h]
MOV EAX , DWORD PTR [EAX+024h]
RET
(Thread Local Storage TLS) Win32, ( ) .
TIB
02. , .
MOV , DWORD PTR FS:[2Ch]
MOV EDX , DWORD PTR [ECX+EAX*4]
Windows-, . , , , . "" .
"" (Binary Large Object BLOB). -, , , . , BLOB , . -, (to blob) " e-mail", . . : "If that program crashes again, I'm going to BLOB the core dump to you" ( "", ). . (The Jargon File). -.
, , , . , , CPU x86 4 8 .
. Mystruct, , .
MyStruct .
typedef struct tag_MyStruct
{
DWORD dwFirst ; // 0-
char szBuff[ 256 ] ; // 4-
int iVal ; // 260-
} MyStruct , * PMyStruct ;
void FillStruct ( PMyStruct pSt )
{
char szName[] = "Pam\n" ;
_asm
{
MOV EAX , pSt // pSt EAX.
// , ,
// .
//
// <struct>.<field>.
// -: pSt->dwFirst = 23 ;
MOV DWORD PTR [EAX] ,
17h.
// -: pSt->iVal = 0x33 ;
MOV DWORD PTR [EAX + 0104h] , 0x33
// -: strcpy ( pSt->szBuff , szName ) ;
LEA ECX , szName // szName .
PUSH ECX .
LEA ECX , [EAX + 4] //. szBuff.
PUSH ECX
CALL strcpy
ADD ESP ,8 // strcpy _cdecl .
// -: pSt->szBuff[ 1 ] = 'A' ;
MOV BYTE PTR [EAX + 5] , 41h
// -: printf ( pSt->szBuff ) ;
MOV EAX , pSt // pSt . EAX
// strcpy.
LEA ECX , [EAX + 4]
PUSH ECX
CALL DWORD PTR [printf]
ADD ESP , 4 // printf _cdecl-.
}
}
Intel-, API- Win32. 6.2
IstrcpyA KERNEL32.DLL Service Pack 4 Windows NT 4.
IstrcpyA . , , , , . , , , .
6-2. IstrcpyA-
; :
; LPTSTR Istrcpy ( LPTSTR IpStringl , LPCTSTR lpString2 )
IstrcpyA:
; SEH-.
77F127E6: MOV EAX , ES:[00000000h]
; .
77F127EC: PUSH EBP
77F127ED: MOV EBP , ESP
; SEH-.
77F127EF: PUSH OFFh
77F127F1: PUSH 77F3CD48h
77F127F6: PUSH _except_handler3
77F127FB: PUSH EAX
77F127FC: MOV DWORD PTR FS:[00000000h] , ESP
; 12 .
77F12803: SUB ESP , 00Ch
; ,
;
77F12806: PUSH EBX
77F12807: PUSH ESI
77F12808: PUSH EDI
.
- SEH.
7F12809: MOV DWORD PTR [EBP-018h] , ESP
0. ,
_try.
77F1280C: MOV DWORD PTR [EBP-004h] ,
00000000h
. - .
(, ) EDI.
77F12813: MOV EDI , DWORD PTR [EBP+OOCh]
Istrcpy 4,294,967,295 NULL-.
EDX -1, .
, REPNE SCAS .
77F12816: MOV EDX , FFFFFFFFh
77F1281B: MOV , EDX
; EAX, SCAS NULL.
77F1281D: SUB EAX , EAX ; NULL.
77F1281F: REPNE SCAS BYTE PTR [EDI]
; , ,
; . NULL.
77F12821: NOT
; REPNE SCAS EDI,
; EDI , EDI , .
77F12823: SUB EDI ,
.
77F12825: MOV ,
; ESI, .. ESI
; .
77F12827: MOV ESI , EDI
; ( ) EDI.
77F12829: MOV EDI , DWORD PTR [EBP+008h]
; . 4,
; (DWORDS).
;, REPE MOVS .
;
; REPE MOVS.
77F1282C: shr , 002h
; .
77F1282F: REPE MOVS DWORD PTR [EDI] , DWORD PTR [ESI]
; .
77F12831: MOV ,
; AND 3,
;
77F12833: AND , 00h
; .
77F12836: REPE MOVS BYTE PTR [EDI] , BYTE PTR [ESI]
Istrcpy ,
;
77F12838: MOV , DWORD PTR [EBP+008h]
; -1, ,
; try/except.
77F1283B: MOV DWORD PTR [EBP-004h] , EDX
; ; .
77F1283E: JMP 77F12852h
; , ,
;,
0x77F12840.
; SEH. -
; , SEH, .
;
;_except (EXCEPTION_EXECUTE_HANDLER).
;, RET.
; MSDN
;
;" Microsoft Windows" (Jeffrey Richter,
;"Programming Applications for Microsoft Windows".-
;Microsoft Press, 1999)
77F12840: MOV EAX , 00000001h
77F12845: RET
; .
; , .
77F12846: MOV ESP , DWORD PTR [EBP-018h]
; -1, ,
; try/except.
77F12849: MOV DWORD PTR [EBP-004h] , FFFFFFFFh
; 0 .
77F12850: XOR ,
; SEH-.
77F12852: MOV ECX , DWORD PTR [EBP-010h]
; EDI.
77F12855: POP EDI
; SHE-.
"7F12856: MOV DWORD PTR FS: [00000000h] , ECX
; ESI.
77F1285D: POP ESI
; EBI, .
77F1285E: POP EBX
;
77F1285F: MOV ESP ,
77F12861: POP EBP
; 8 .
; Istrcpy is a __sdtcall function.
77F12862: RET 00008h
, - - :
- - ;
- (obj) (dll).
| | 10.11.2021 - 12:37: - Personalias -> WHO IS WHO - - _.
10.11.2021 - 12:36: - Conscience -> . ? - _.
10.11.2021 - 12:36: , , - Upbringing, Inlightening, Education -> ... - _.
10.11.2021 - 12:35: - Ecology -> - _.
10.11.2021 - 12:34: , - War, Politics and Science -> - _.
10.11.2021 - 12:34: , - War, Politics and Science -> . - _.
10.11.2021 - 12:34: , , - Upbringing, Inlightening, Education -> , - _.
10.11.2021 - 09:18: - New Technologies -> , 5G- - _.
10.11.2021 - 09:18: - Ecology -> - _.
10.11.2021 - 09:16: - Ecology -> - _.
10.11.2021 - 09:15: , , - Upbringing, Inlightening, Education -> - _.
10.11.2021 - 09:13: , , - Upbringing, Inlightening, Education -> - _.
|
