86
Disassembly Visual C++
Visual C++
, Visual C++. " C++, Visual C++ C++. , , . 12 14 , , .
, , , . , C/C++ . , .
:
NOP , .
NOP , , .
_asm, , ( ). :
void NOPFuncOne ( void )
{
_Asm NOP
_Asm NOP
}
void NOPFUncTwo ( void )
{
_Asm
{
NOP
NOP
}
}
. ASMer -.
,
Intel CPU; Intel Pentium Pro 467 . , , 467; . , , . , , , . , , .
Intel CPU . CPU, -, , Intel CPU . . ESP, . PUSH ESP , POP .
, . . CPU LIFO (Last In, First Out). , ,
PushPop:
void PushPop ( void )
{
_asm
{
// , EDX. ,
PUSH
PUSH
PUSH EDX
// ,
// .
// . ,
// LIFO-.
POP EDX .
POP ECX
POP EAX
}
}
, PUSH POP . , pop-:
void SwapRegistersWithPushAndPop ( void )
{
_asm
{
// EAX , .
PUSH EAX
PUSH EBX
POP EAX
POP EBX
}
}
.
PUSH- pop- .
MOV , . , ,
PUSH. ,
MOV.
SwapRegisters ( void )
{ _asm
{
// EAX .
// .
MOV ,
MOV ECX , EBX
MOV EBX , EAX
}
SUB . () () , .
ADD () () .
INT 3 Intel CPU. Microsoft . - (Portable Executable sections),
/ALIGN ( 4 ).
LEAVE CPU . .
:
Windows . , ( ). . (stack frame). CPU x86 , ( CPU ).
_asm
{
// .
PUSH EBP // .
MOV EBP , ESP //
// .
SUB ESP , 20h // 0x20
// . SUB ,
// .
}
, ( ). ,
PUSH MOV.
CPU (, Pentium) , , .
, , ,
. , FPO1-. , . , , " , " .
( ) . . .
_asm
{
//
MOV ESP , // .
POP EBP // -.
// .
}
LEAVE ,
MOV/POP,
LEAVE.
MOV/POP.
MOV/POP. , CPU 86
ENTER, ,
PUSH/MOV/ADD, .
, . , 2,
. FPO-.
FPO (Frame Pointer Omission ). .
,
. , . , . , . , , . ,
Disassembly , .
int g_iVal = 0 ;
void AccessGlobalMemory ( void )
_asm
{
// 48,059.
MOV g_iVal , OBBBBh
// , Disassembly
// MOV DWORD PTR [g_iVal (00403060)],OBBBBh.
// , Disassembly
// MOV DWORD PTR [00403060],OBBBBh.
}
}
,
. ,
, , , . .
void AccessParameter ( int iParam )
{
_asm
{
// iParam value .
MOV , iParam
// , Disassembly
// MOV ,DWORD PTR [iParam].
// , Disassembly
// MOV ,DWORD PTR [+8].
}
}
,
ESP, , FPO-.
ESP ,
. , ,
[ESP+20H] ,
[ESP+SH]. , , , . ,
. ,
SUB . :
void AccessLocalVariable ( void )
{
int iLocal ;
_asm
{
// 23.
MOV iLocal ,'017h
// , Disassembly
// MOV DWORD PTR [iLocal],017h.
// , Disassembly
// MOV
[EBP-4],017h.
}
}
, ( ). ,
ESP, , .
SUB, , .
ESP , , , , , .
, , , . -, ,
, ( ). - ( ,
ASMer).
void AccessLocalsAndParamsExample ( int * pParaml , int * pParam2 }
{
int iLocal1 = 3 ;
int iLocal2 = 0x42 ;
iLocal1 = *pParaml ;
iLocal2 = *pParam2 ;
}
// AccessLocalsAndParamsExample
//
00401097 PUSH EBP
00401098 MOV EBP , ESP
0040109A SUB ESP , 8
// int iLocal1 = 3 ;
0040109D MOV DWORD PTR [EBP-8h] , 3
// int iLocal2 = 0x42 ;
004010A4 MOV DWORD PTR [EBP-4h] , 42h
// iLocal1 = *pParaml ;
004010AB MOV EAX , DWORD PTR [EBP+8h]
004010AE MOV ECX , DWORD PTR [EAX]
004010BO MOV DWORD PTR [EBP-08h] , ECX
// iLocal2 = *pParam2 ;
004010B3 MOV EDX , DWORD PTR [EBP+OCh]
004010B6 MOV EAX , DWORD PTR [EDX]
004010B8 MOV DWORD PTR [EBP-4h] , EAX
//
004010BB MOV ESP , EBP
004010BD POP EBP
004010BE RET
}
AccessLocalsAndParamsExample (
0x00401097),
, . 6.2.
. 6.2. AccessLocalsAndParamsExample
AccessLocalsAndParamsExaraple
. (ESP) (),
,
. . 6.3 .
. 6.3.
AccessLocalsAndParamsExample
CALL
RET
, , , , .
CALL . , ,
ESP, .
CALL ,
Disassembly , , , .
CALL , , , ,
Registers.
. , , , , (Import Address Table IAT). , ,
CALL,
CallSomeFunctions. , IAT (
_imp_ !).
CallSomeFunctions , .
void CaiiSomeFunctions ( void }
{
_asm
{
// GetLastError,
// . .
// IAT, . . .
CALL DWORD PTR [GetLastError]
// , Disassembly
// CALL DWORD PTR [_imp__GetLastError@0 (00402000)].
// , Disassembly
// CALL DWORD PTR [00402000].
////////////////////////////////////////////////////////////////
// .
CALL NOPFuncOne
// , Disassembly
// CALL NOPFuncOne (00401000).
// , Disassembly
// CALL 00401000.
}
}
RET , ( ). ,
. RET , , , ,
.
, . , , . , ,
Disassembly, .
, , . , . , . CPU - .
Memory
Disassembly.
, : (__stdcall), - (__cdecl) this-. - , this- - , . (_fastcalll) "" (naked) . Win32 , CPU. "" (VxD) , ( , 12 14).
. 6.3 . 1 5. . 6.3 , .
"" C++ , , , , . .
, , : ?.
_cdecl _stdcall . , "" . (, ,
printf). _cdeci , . Win32, Visual Basic.
6.3.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Intel CPU. Borland Delphi
|
|
|
|
|
|
|
6-1
Disassembly Visual C++. , , .
(CALLING.CPP) -.
6-1 ; , . . , , . ,
NOP.
6-1
6: // , -
7: static char * g_szStdCall = "_stdcall";
8: static char * g_szCdeclCall = "_cdecl";
9: static char * g_szFastCall = "_fastcall" ;
10: static char * g_szNakedCall = "_naked" ;
11:
12: // extern "" C++ .
13: extern ""
14: {
15: .
16: // _cdecl-
17: void CDeclFunction { char * szString ,
18: unsigned long ulLong ,
19: char chChar ) ;
20:
21: // stdcall-
22: void _stdcall StdCallFunction ( char * szString ,
23: unsigned long ulLong ,
24: char chChar ) ;
25: // _fastcall-
26: void _fastcall FastCallFunction ( char * szString ,
27: unsigned long ulLong ,
28: char chChar ) ;
29:
30: /'/ "" . ,
31: // .
32: int NakedCallFunction ( char * szString ,
33: unsigned long ulLong ,
34: ' char chChar ) ;
35: }
36:
37: void main ( void )
38: {
00401000 55 push ebp
00401001 8B EC mov ebp,esp
00401003 53 push ebx
00401004 56 push esi
00401005 57 push edi
39: // .
40: // NOP-,
41: //
42: _asm NOP _asm NOP
00401006 90 n
00401007 90 n
43: CDeclFunction ( g_szCdeclCall , 1 , '' ) ;
00401008 6 61 push 61h
0040100A 6A 01 push 1
0040100C Al 14 30 40 00 mov eax,[g_szCdeclCall (00403014)]
00401011 50 push eax
00401012 E8 45 00 00 00 call CDeclFunction (0040105)
00401017 83 C4 add esp,OCh
44: _asm NOP _asm NOP
0040101A 90 n
0040101B 90 n
45: StdCallFunction ( g_szStdCall , 2 , 'b' ) ;
0040101C 6A 62 push 62h
0040101E 6A 02 push 2
00401020 8B OD 10 30 40 00 mov ecx,dword ptr
[g_szStdCall (00403010)]
00401026 51 push ecx
00401027 E8 3D 00 00 00 call StdCallFunction (00401069)
46: _asm NOP _asm NOP
0040102C 90 n
0040102D 90 n
47: FastCallFunction ( g_szFastCall , 3 , 'c' ) ;
0040102E 6A 63 push 63h
00401030 BA 03 00 00 00 mov edx,3
00401035 8B OD 18 30 40 00 mov ecx,dword ptr
[g_szFastCall (00403018)]
0040103 8 38 00 00 00 call FastCallFunction (00401078)
48: _asm NOP _asm NOP
00401040 90 n
00401041 90 n
49: NakedCallFunction ( g_szNakedCall , 4 , 'd' ) ;
00401042 6A 64 , push 64h
00401044 6A 04 push 4
00401046 8B 15 1C 30 40 00 mov edx,dword ptr
[g-_szNakedCall (0040301)]
0040104C 52 push edx
0040104D E8 40 00 00 00 call NakedCallFunction (00401092)
00401052 83 C4 add esp,OCh
50: _asm NOP _asm NOP
00401055 90 n
00401056 90 n
51:
52: }
00401057 5F pop edi
00401058 5E pop esi
00401059 5B pop ebx
0040105A 5D pop ebp
0040105 ret
53:
54: void CDeclFunction ( char * szString ,
55: unsigned long ulLong ,
56: char chChar )
57: {
0040105C 55 push ebp
0040105D 8B EC mov ebp,esp
0040105F 53 push ebx
00401060 56 push esi
00401061 57 push edi 58: _asm NOP _asm NOP
00401062 90 n
00401063 90 n
59: }
00401064 5F pop edi
00401065 5E pop esi
00401066 5B pop ebx
00401067 5D pop ebp
00401068 C3 ret
60:
61: void _stdcall StdCallFunction ( char * szString ,
62: unsigned long ulLong ,
63: char chChar )
64: {
00401069 55 push ' ebp
0040106A-8B EC mov ebp,esp
0040106C 53 push ebx
0040106D 56 push esi
0040.106E 57 push edi
65: _asm NOP _asm NOP
0040106F 90 n
00401070 90 n
66: }
00401071 5F pop edi
00401072 5E pop esi
00401073 5B pop ebx
00401074 5D pop ebp
00401075 C2 00 ret OCh
67:
68: void _fastcall FastCallFunction ( char * szString ,
69: unsigned long ulLong ,
70: char chChar )
71: {
00401078 55 push ebp
00401079 8B EC mov ebp,esp
0040107B 83 EC 08 sub ,
esp,8
0040107E 53 push ebx
0040107F 56 push esi
00401080 57 push edi
00401081 89 55 F8 mov dword ptr [ebp-8],edx
00401084 89 4D FC mov dword ptr [ebp-4],ecx
72: _asm NOP _asm NOP
00401087 90 n
00401088 90 n
73: }
00401089 5F pop edi
0040108A 5E pop esi
0040108 5 pop ebx
0040108C 8 5 , mov esp,ebp
0040108 5D pop ebp
0040108F C2 04 00 ret 4
74:
75: _declspec(naked) int NakedCa11Function ( char * szString ,
76: unsigned long ulLong ,
77: . char chChar )
78: {
00401092 90 n
00401093 9.0 n
79: _asm NOP _asm NOP
80: // .
81: _asm RET
00401094 ret
, , , , , .
, , Class diagram - - , - .
| | 10.11.2021 - 12:37: - Personalias -> WHO IS WHO - - _.
10.11.2021 - 12:36: - Conscience -> . ? - _.
10.11.2021 - 12:36: , , - Upbringing, Inlightening, Education -> ... - _.
10.11.2021 - 12:35: - Ecology -> - _.
10.11.2021 - 12:34: , - War, Politics and Science -> - _.
10.11.2021 - 12:34: , - War, Politics and Science -> . - _.
10.11.2021 - 12:34: , , - Upbringing, Inlightening, Education -> , - _.
10.11.2021 - 09:18: - New Technologies -> , 5G- - _.
10.11.2021 - 09:18: - Ecology -> - _.
10.11.2021 - 09:16: - Ecology -> - _.
10.11.2021 - 09:15: , , - Upbringing, Inlightening, Education -> - _.
10.11.2021 - 09:13: , , - Upbringing, Inlightening, Education -> - _.
|
