************************* 你在SICE中所见到的 ************************* 

**Softice中断时,你会在这儿. 一直按F10走过这部分代码 

0041454F  FFFF                INVALID 
00414556  55                  PUSH      EBP 
00414557  8BEC                MOV      EBP,ESP 
00414559  56                  PUSH      ESI 
0041455A  57                  PUSH      EDI 
0041455B  756B                JNZ      004145C8                (NO JUMP) 
0041455D  6800010000          PUSH      00000100 
00414562  E8D60B0000          CALL      0041513D 
00414567  83C404              ADD      ESP,04 
0041456A  8B7508              MOV      ESI,[EBP+08] 
0041456D  A3B4F14000          MOV      [0040F1B4],EAX 
00414572  85F6                TEST      ESI,ESI 
00414574  7423                JZ        00414599                (JUMP) 
00414599  33FF                XOR      EDI,EDI 
0041459B  57                  PUSH      EDI 
0041459C  893D8C184100        MOV      [0041188C],EDI 
004145A2  FF1510224100        CALL      [KERNEL32!GetModuleHandleA] 
004145A8  8BF0                MOV      ESI,EAX 
004145AA  68FF000000          PUSH      000000FF 
004145AF  A1B4F14000          MOV      EAX,[0040F1B4] 
004145B4  897D10              MOV      [EBP+10],EDI 
004145B7  C7450C01000000      MOV      DWORD PTR [EBP+0C],00000001 
004145BE  50                  PUSH      EAX 
004145BF  56                  PUSH      ESI 
004145C0  FF15F4214100        CALL      [KERNEL32!GetModuleFileNameA] 
004145C6  EB03                JMP      004145CB                (JUMP) 
004145CB  E830EAFFFF          CALL      00413000 
004145D0  FF7510              PUSH      DWORD PTR [EBP+10] 
004145D3  FF750C              PUSH      DWORD PTR [EBP+0C] 
004145D6  56                  PUSH      ESI 
004145D7  E806000000          CALL      004145E2 

**当你走过这个位于004145D7的CALL, 压缩过的notepad.exe就自由运行了. 再次用 
  symbol loader装入. 再次来到这个CALL时, 按F8追进去. 你将看到以下代码. 不 
  过记着先BPX 004145D7. 

004145E2  64A100000000        MOV      EAX,FS:[00000000] 
004145E8  55                  PUSH      EBP 
004145E9  8BEC                MOV      EBP,ESP 
004145EB  6AFF                PUSH      FF 
004145ED  6810E04000          PUSH      0040E010 
004145F2  68EC5D4100          PUSH      00415DEC 
004145F7  50                  PUSH      EAX 
004145F8  64892500000000      MOV      FS:[00000000],ESP 
004145FF  83EC14              SUB      ESP,14 
00414602  C745E401000000      MOV      DWORD PTR [EBP-1C],00000001 
00414609  53                  PUSH      EBX 
0041460A  56                  PUSH      ESI 
0041460B  57                  PUSH      EDI 
0041460C  8965E8              MOV      [EBP-18],ESP 
0041460F  C745FC00000000      MOV      DWORD PTR [EBP-04],00000000 
00414616  8B450C              MOV      EAX,[EBP+0C] 
00414619  83F801              CMP      EAX,01 
0041461C  7510                JNZ      0041462E                (NO JUMP) 
0041461E  E886030000          CALL      004149A9 
00414623  FF05C0F14000        INC      DWORD PTR [0040F1C0] 
00414629  E882F6FFFF          CALL      00413CB0 
0041462E  8B35C0F14000        MOV      ESI,[0040F1C0] 
00414634  85F6                TEST      ESI,ESI 
00414636  0F848D000000        JZ        004146C9                (NO JUMP) 
0041463C  833DC4F1400000      CMP      DWORD PTR [0040F1C4],00 
00414643  7526                JNZ      0041466B                (NO JUMP) 
00414645  833D6417410000      CMP      DWORD PTR [00411764],00 
0041464C  741D                JZ        0041466B                (NO JUMP) 
0041464E  A164174100          MOV      EAX,[00411764]

上一页  [1] [2] [3] 下一页