|
[求助]如何知道在内存中的值是在程序中的什么时候写入?
[QUOTE=新手向导;385873]呵呵,这样,我告诉你.. 首先,在运行你刚才说的语句的时候看看[EBP-98]真实内存值是多少,比如说是408888 重新启动一下程序 好,在OD下面数据框下面的命令里输入 d 408888 到了吗? 在第一个内存值(就是408888处)右键==>断点==>...[/QUOTE] 我也是那么弄的,但是最好好像跟踪一定的时间,程序就自动终止了。奇怪的很,我再看看。 而且内存断点好像运行的速度慢的很!不过我时用虚拟机调试的。 |
|
[求助]如何知道在内存中的值是在程序中的什么时候写入?
谢谢,莫程桂NP,我贴了一些上,你看看能不能找到。 断点那句就在:00569E7D 8A55 14 MOV DL,BYTE PTR SS:[EBP+14]。 00569B38 51 PUSH ECX 00569B39 52 PUSH EDX 00569B3A 8945 9C MOV DWORD PTR SS:[EBP-64],EAX 00569B3D C745 94 0740000>MOV DWORD PTR SS:[EBP-6C],4007 00569B44 FF15 54134000 CALL DWORD PTR DS:[<&MSVBVM60.rtcBstrFro>; MSVBVM60.rtcBstrFromFormatVar 00569B4A 8BD0 MOV EDX,EAX 00569B4C 8D4D C4 LEA ECX,DWORD PTR SS:[EBP-3C] 00569B4F FF15 30134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrMo>; MSVBVM60.__vbaStrMove 00569B55 8B55 C4 MOV EDX,DWORD PTR SS:[EBP-3C] 00569B58 8D4D C8 LEA ECX,DWORD PTR SS:[EBP-38] 00569B5B 895D C4 MOV DWORD PTR SS:[EBP-3C],EBX 00569B5E FF15 30134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrMo>; MSVBVM60.__vbaStrMove 00569B64 50 PUSH EAX 00569B65 56 PUSH ESI 00569B66 68 3CB34100 PUSH FXCalend.0041B33C 00569B6B FFD7 CALL EDI 00569B6D 8D45 C4 LEA EAX,DWORD PTR SS:[EBP-3C] 00569B70 8D4D C8 LEA ECX,DWORD PTR SS:[EBP-38] 00569B73 50 PUSH EAX 00569B74 51 PUSH ECX 00569B75 6A 02 PUSH 2 00569B77 FF15 B0124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStrList 00569B7D 83C4 18 ADD ESP,18 00569B80 8D4D A4 LEA ECX,DWORD PTR SS:[EBP-5C] 00569B83 FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVar 00569B89 68 00A24200 PUSH FXCalend.0042A200 ; UNICODE "[Voice]" 00569B8E 56 PUSH ESI 00569B8F 68 3CB34100 PUSH FXCalend.0041B33C 00569B94 FFD7 CALL EDI 00569B96 8B55 E0 MOV EDX,DWORD PTR SS:[EBP-20] 00569B99 52 PUSH EDX 00569B9A 56 PUSH ESI 00569B9B 68 3CB34100 PUSH FXCalend.0041B33C 00569BA0 FFD7 CALL EDI 00569BA2 68 14A24200 PUSH FXCalend.0042A214 ; UNICODE "[DEL]" 00569BA7 56 PUSH ESI 00569BA8 68 3CB34100 PUSH FXCalend.0041B33C 00569BAD FFD7 CALL EDI 00569BAF 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C] 00569BB2 50 PUSH EAX 00569BB3 56 PUSH ESI 00569BB4 68 3CB34100 PUSH FXCalend.0041B33C 00569BB9 FFD7 CALL EDI 00569BBB 68 24A24200 PUSH FXCalend.0042A224 ; UNICODE "[Repetition]" 00569BC0 56 PUSH ESI 00569BC1 68 3CB34100 PUSH FXCalend.0041B33C 00569BC6 FFD7 CALL EDI 00569BC8 8B4D D8 MOV ECX,DWORD PTR SS:[EBP-28] 00569BCB 51 PUSH ECX 00569BCC 56 PUSH ESI 00569BCD 68 3CB34100 PUSH FXCalend.0041B33C 00569BD2 FFD7 CALL EDI 00569BD4 83C4 48 ADD ESP,48 00569BD7 68 5CA24200 PUSH FXCalend.0042A25C ; UNICODE "[Password]" 00569BDC 56 PUSH ESI 00569BDD 68 3CB34100 PUSH FXCalend.0041B33C 00569BE2 FFD7 CALL EDI 00569BE4 8B55 E8 MOV EDX,DWORD PTR SS:[EBP-18] 00569BE7 52 PUSH EDX 00569BE8 56 PUSH ESI 00569BE9 68 3CB34100 PUSH FXCalend.0041B33C 00569BEE FFD7 CALL EDI 00569BF0 68 78A24200 PUSH FXCalend.0042A278 ; UNICODE "[Text]" 00569BF5 56 PUSH ESI 00569BF6 68 3CB34100 PUSH FXCalend.0041B33C 00569BFB FFD7 CALL EDI 00569BFD 83C4 24 ADD ESP,24 00569C00 6A 0A PUSH 0A 00569C02 FF15 64124000 CALL DWORD PTR DS:[<&MSVBVM60.rtcBstrFro>; MSVBVM60.rtcBstrFromAnsi 00569C08 8BD0 MOV EDX,EAX 00569C0A 8D4D B8 LEA ECX,DWORD PTR SS:[EBP-48] 00569C0D FF15 30134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrMo>; MSVBVM60.__vbaStrMove 00569C13 8D45 A4 LEA EAX,DWORD PTR SS:[EBP-5C] 00569C16 6A 0D PUSH 0D 00569C18 50 PUSH EAX 00569C19 FF15 2C124000 CALL DWORD PTR DS:[<&MSVBVM60.rtcVarBstr>; MSVBVM60.rtcVarBstrFromAnsi 00569C1F 8B45 CC MOV EAX,DWORD PTR SS:[EBP-34] 00569C22 3BC3 CMP EAX,EBX 00569C24 75 12 JNZ SHORT FXCalend.00569C38 00569C26 8D4D CC LEA ECX,DWORD PTR SS:[EBP-34] 00569C29 51 PUSH ECX 00569C2A 68 44844000 PUSH FXCalend.00408444 00569C2F FF15 84124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaNew2>>; MSVBVM60.__vbaNew2 00569C35 8B45 CC MOV EAX,DWORD PTR SS:[EBP-34] 00569C38 8B55 B8 MOV EDX,DWORD PTR SS:[EBP-48] 00569C3B 895D B8 MOV DWORD PTR SS:[EBP-48],EBX 00569C3E 8B18 MOV EBX,DWORD PTR DS:[EAX] 00569C40 8985 7CFFFFFF MOV DWORD PTR SS:[EBP-84],EAX 00569C46 8D45 C0 LEA EAX,DWORD PTR SS:[EBP-40] 00569C49 8995 68FFFFFF MOV DWORD PTR SS:[EBP-98],EDX 00569C4F 8D4D A4 LEA ECX,DWORD PTR SS:[EBP-5C] 00569C52 50 PUSH EAX 00569C53 8D55 C4 LEA EDX,DWORD PTR SS:[EBP-3C] 00569C56 51 PUSH ECX 00569C57 52 PUSH EDX 00569C58 FF15 48124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrVa>; MSVBVM60.__vbaStrVarVal 00569C5E 8B95 68FFFFFF MOV EDX,DWORD PTR SS:[EBP-98] 00569C64 50 PUSH EAX 00569C65 8D4D C8 LEA ECX,DWORD PTR SS:[EBP-38] 00569C68 FF15 30134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrMo>; MSVBVM60.__vbaStrMove 00569C6E 50 PUSH EAX 00569C6F 8B45 DC MOV EAX,DWORD PTR SS:[EBP-24] 00569C72 8BCB MOV ECX,EBX 00569C74 8B9D 7CFFFFFF MOV EBX,DWORD PTR SS:[EBP-84] 00569C7A 50 PUSH EAX 00569C7B 53 PUSH EBX 00569C7C FF51 2C CALL DWORD PTR DS:[ECX+2C] 00569C7F 85C0 TEST EAX,EAX 00569C81 DBE2 FCLEX 00569C83 7D 0F JGE SHORT FXCalend.00569C94 00569C85 6A 2C PUSH 2C 00569C87 68 38B24100 PUSH FXCalend.0041B238 00569C8C 53 PUSH EBX 00569C8D 50 PUSH EAX 00569C8E FF15 B4104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj 00569C94 8B55 C0 MOV EDX,DWORD PTR SS:[EBP-40] 00569C97 52 PUSH EDX 00569C98 FF15 68104000 CALL DWORD PTR DS:[<&MSVBVM60.rtcTrimBst>; MSVBVM60.rtcTrimBstr 00569C9E 8B1D 30134000 MOV EBX,DWORD PTR DS:[<&MSVBVM60.__vbaSt>; MSVBVM60.__vbaStrMove 00569CA4 8BD0 MOV EDX,EAX 00569CA6 8D4D B4 LEA ECX,DWORD PTR SS:[EBP-4C] 00569CA9 FFD3 CALL EBX 00569CAB 8B55 B4 MOV EDX,DWORD PTR SS:[EBP-4C] 00569CAE 8D4D BC LEA ECX,DWORD PTR SS:[EBP-44] 00569CB1 C745 B4 0000000>MOV DWORD PTR SS:[EBP-4C],0 00569CB8 FFD3 CALL EBX 00569CBA 50 PUSH EAX 00569CBB 56 PUSH ESI 00569CBC 68 3CB34100 PUSH FXCalend.0041B33C 00569CC1 FFD7 CALL EDI 00569CC3 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C] 00569CC6 8D4D B8 LEA ECX,DWORD PTR SS:[EBP-48] 00569CC9 50 PUSH EAX 00569CCA 8D55 BC LEA EDX,DWORD PTR SS:[EBP-44] 00569CCD 51 PUSH ECX 00569CCE 8D45 C0 LEA EAX,DWORD PTR SS:[EBP-40] 00569CD1 52 PUSH EDX 00569CD2 8D4D C4 LEA ECX,DWORD PTR SS:[EBP-3C] 00569CD5 50 PUSH EAX 00569CD6 8D55 C8 LEA EDX,DWORD PTR SS:[EBP-38] 00569CD9 51 PUSH ECX 00569CDA 52 PUSH EDX 00569CDB 6A 06 PUSH 6 00569CDD FF15 B0124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStrList 00569CE3 83C4 28 ADD ESP,28 00569CE6 8D4D A4 LEA ECX,DWORD PTR SS:[EBP-5C] 00569CE9 FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVar 00569CEF 56 PUSH ESI 00569CF0 FF15 60114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFileC>; MSVBVM60.__vbaFileClose 00569CF6 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8] 00569CF9 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C] 00569CFC 8D55 80 LEA EDX,DWORD PTR SS:[EBP-80] 00569CFF C745 D0 FFFFFFF>MOV DWORD PTR SS:[EBP-30],-1 00569D06 8B0E MOV ECX,DWORD PTR DS:[ESI] 00569D08 52 PUSH EDX 00569D09 68 FB000000 PUSH 0FB 00569D0E 50 PUSH EAX 00569D0F 50 PUSH EAX 00569D10 56 PUSH ESI 00569D11 FF51 34 CALL DWORD PTR DS:[ECX+34] 00569D14 85C0 TEST EAX,EAX 00569D16 7D 0F JGE SHORT FXCalend.00569D27 00569D18 6A 34 PUSH 34 00569D1A 68 54B44100 PUSH FXCalend.0041B454 00569D1F 56 PUSH ESI 00569D20 50 PUSH EAX 00569D21 FF15 B4104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj 00569D27 68 849D5600 PUSH FXCalend.00569D84 00569D2C EB 2D JMP SHORT FXCalend.00569D5B 00569D2E 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C] 00569D31 8D4D B8 LEA ECX,DWORD PTR SS:[EBP-48] 00569D34 50 PUSH EAX 00569D35 8D55 BC LEA EDX,DWORD PTR SS:[EBP-44] 00569D38 51 PUSH ECX 00569D39 8D45 C0 LEA EAX,DWORD PTR SS:[EBP-40] 00569D3C 52 PUSH EDX 00569D3D 8D4D C4 LEA ECX,DWORD PTR SS:[EBP-3C] 00569D40 50 PUSH EAX 00569D41 8D55 C8 LEA EDX,DWORD PTR SS:[EBP-38] 00569D44 51 PUSH ECX 00569D45 52 PUSH EDX 00569D46 6A 06 PUSH 6 00569D48 FF15 B0124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStrList 00569D4E 83C4 1C ADD ESP,1C 00569D51 8D4D A4 LEA ECX,DWORD PTR SS:[EBP-5C] 00569D54 FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVar 00569D5A C3 RETN 00569D5B 8B35 94134000 MOV ESI,DWORD PTR DS:[<&MSVBVM60.__vbaFr>; MSVBVM60.__vbaFreeStr 00569D61 8D4D E8 LEA ECX,DWORD PTR SS:[EBP-18] 00569D64 FFD6 CALL ESI 00569D66 8D4D E4 LEA ECX,DWORD PTR SS:[EBP-1C] 00569D69 FFD6 CALL ESI 00569D6B 8D4D E0 LEA ECX,DWORD PTR SS:[EBP-20] 00569D6E FFD6 CALL ESI 00569D70 8D4D DC LEA ECX,DWORD PTR SS:[EBP-24] 00569D73 FFD6 CALL ESI 00569D75 8D4D D8 LEA ECX,DWORD PTR SS:[EBP-28] 00569D78 FFD6 CALL ESI 00569D7A 8D4D CC LEA ECX,DWORD PTR SS:[EBP-34] 00569D7D FF15 98134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObj 00569D83 C3 RETN 00569D84 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 00569D87 50 PUSH EAX 00569D88 8B08 MOV ECX,DWORD PTR DS:[EAX] 00569D8A FF51 08 CALL DWORD PTR DS:[ECX+8] 00569D8D 8B55 30 MOV EDX,DWORD PTR SS:[EBP+30] 00569D90 66:8B45 D0 MOV AX,WORD PTR SS:[EBP-30] 00569D94 66:8902 MOV WORD PTR DS:[EDX],AX 00569D97 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 00569D9A 8B4D EC MOV ECX,DWORD PTR SS:[EBP-14] 00569D9D 5F POP EDI 00569D9E 5E POP ESI 00569D9F 64:890D 0000000>MOV DWORD PTR FS:[0],ECX 00569DA6 5B POP EBX 00569DA7 8BE5 MOV ESP,EBP 00569DA9 5D POP EBP 00569DAA C2 2C00 RETN 2C 00569DAD 90 NOP 00569DAE 90 NOP 00569DAF 90 NOP 00569DB0 55 PUSH EBP 00569DB1 8BEC MOV EBP,ESP 00569DB3 83EC 14 SUB ESP,14 00569DB6 68 96704000 PUSH <JMP.&MSVBVM60.__vbaExceptHandler> 00569DBB 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] 00569DC1 50 PUSH EAX 00569DC2 64:8925 0000000>MOV DWORD PTR FS:[0],ESP 00569DC9 83EC 58 SUB ESP,58 00569DCC 53 PUSH EBX 00569DCD 56 PUSH ESI 00569DCE 57 PUSH EDI 00569DCF 8965 EC MOV DWORD PTR SS:[EBP-14],ESP 00569DD2 C745 F0 A06A400>MOV DWORD PTR SS:[EBP-10],FXCalend.00406> 00569DD9 33F6 XOR ESI,ESI 00569DDB 8975 F4 MOV DWORD PTR SS:[EBP-C],ESI 00569DDE 8975 F8 MOV DWORD PTR SS:[EBP-8],ESI 00569DE1 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 00569DE4 8B08 MOV ECX,DWORD PTR DS:[EAX] 00569DE6 50 PUSH EAX 00569DE7 FF51 04 CALL DWORD PTR DS:[ECX+4] 00569DEA 8975 D8 MOV DWORD PTR SS:[EBP-28],ESI 00569DED 8975 D4 MOV DWORD PTR SS:[EBP-2C],ESI 00569DF0 8975 D0 MOV DWORD PTR SS:[EBP-30],ESI 00569DF3 8975 CC MOV DWORD PTR SS:[EBP-34],ESI 00569DF6 8975 BC MOV DWORD PTR SS:[EBP-44],ESI 00569DF9 8975 A8 MOV DWORD PTR SS:[EBP-58],ESI 00569DFC 8975 A4 MOV DWORD PTR SS:[EBP-5C],ESI 00569DFF 6A 01 PUSH 1 00569E01 FF15 F4104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaOnErr>; MSVBVM60.__vbaOnError 00569E07 8B7D 0C MOV EDI,DWORD PTR SS:[EBP+C] 00569E0A 8B17 MOV EDX,DWORD PTR DS:[EDI] 00569E0C 52 PUSH EDX 00569E0D FF15 C8124000 CALL DWORD PTR DS:[<&MSVBVM60.rtcFileLen>; MSVBVM60.rtcFileLen 00569E13 8945 E0 MOV DWORD PTR SS:[EBP-20],EAX 00569E16 6A 01 PUSH 1 00569E18 50 PUSH EAX 00569E19 6A 01 PUSH 1 00569E1B 6A 11 PUSH 11 00569E1D 8D45 D4 LEA EAX,DWORD PTR SS:[EBP-2C] 00569E20 50 PUSH EAX 00569E21 6A 01 PUSH 1 00569E23 68 80000000 PUSH 80 00569E28 FF15 C4114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaRedim>; MSVBVM60.__vbaRedim 00569E2E 83C4 1C ADD ESP,1C 00569E31 C745 C4 0400028>MOV DWORD PTR SS:[EBP-3C],80020004 00569E38 C745 BC 0A00000>MOV DWORD PTR SS:[EBP-44],0A 00569E3F 8D4D BC LEA ECX,DWORD PTR SS:[EBP-44] 00569E42 51 PUSH ECX 00569E43 FF15 88124000 CALL DWORD PTR DS:[<&MSVBVM60.rtcFreeFil>; MSVBVM60.rtcFreeFile 00569E49 8AD8 MOV BL,AL 00569E4B 8D4D BC LEA ECX,DWORD PTR SS:[EBP-44] 00569E4E FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVar 00569E54 66:0FB6F3 MOVZX SI,BL 00569E58 8B17 MOV EDX,DWORD PTR DS:[EDI] 00569E5A 52 PUSH EDX 00569E5B 56 PUSH ESI 00569E5C 6A FF PUSH -1 00569E5E 6A 20 PUSH 20 00569E60 FF15 78124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFileO>; open .key 文件 00569E66 56 PUSH ESI 00569E67 8D45 D4 LEA EAX,DWORD PTR SS:[EBP-2C] 00569E6A 50 PUSH EAX 00569E6B 68 8CA24200 PUSH FXCalend.0042A28C 00569E70 FF15 3C124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaGetOw>; MSVBVM60.__vbaGetOwner3 00569E76 56 PUSH ESI 00569E77 FF15 60114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFileC>; MSVBVM60.__vbaFileClose 00569E7D 8A55 14 MOV DL,BYTE PTR SS:[EBP+14] 00569E80 8B45 D8 MOV EAX,DWORD PTR SS:[EBP-28] 00569E83 3B45 E0 CMP EAX,DWORD PTR SS:[EBP-20] 00569E86 7D 13 JGE SHORT FXCalend.00569E9B 00569E88 40 INC EAX 00569E89 8945 D8 MOV DWORD PTR SS:[EBP-28],EAX 00569E8C 8B4D D4 MOV ECX,DWORD PTR SS:[EBP-2C] 00569E8F 8B71 0C MOV ESI,DWORD PTR DS:[ECX+C] 00569E92 2B71 14 SUB ESI,DWORD PTR DS:[ECX+14] 00569E95 03C6 ADD EAX,ESI 00569E97 3010 XOR BYTE PTR DS:[EAX],DL 00569E99 ^ EB E5 JMP SHORT FXCalend.00569E80 00569E9B C745 C4 0400028>MOV DWORD PTR SS:[EBP-3C],80020004 00569EA2 C745 BC 0A00000>MOV DWORD PTR SS:[EBP-44],0A 00569EA9 8D4D BC LEA ECX,DWORD PTR SS:[EBP-44] 00569EAC 51 PUSH ECX 00569EAD FF15 88124000 CALL DWORD PTR DS:[<&MSVBVM60.rtcFreeFil>; MSVBVM60.rtcFreeFile 00569EB3 8AD8 MOV BL,AL 00569EB5 8D4D BC LEA ECX,DWORD PTR SS:[EBP-44] 00569EB8 FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVar 00569EBE 8B45 CC MOV EAX,DWORD PTR SS:[EBP-34] 00569EC1 85C0 TEST EAX,EAX 00569EC3 75 12 JNZ SHORT FXCalend.00569ED7 00569EC5 8D55 CC LEA EDX,DWORD PTR SS:[EBP-34] 00569EC8 52 PUSH EDX 00569EC9 68 44844000 PUSH FXCalend.00408444 00569ECE FF15 84124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaNew2>>; MSVBVM60.__vbaNew2 00569ED4 8B45 CC MOV EAX,DWORD PTR SS:[EBP-34] 00569ED7 8BF0 MOV ESI,EAX 00569ED9 C745 A8 0000000>MOV DWORD PTR SS:[EBP-58],0 00569EE0 8B08 MOV ECX,DWORD PTR DS:[EAX] 00569EE2 8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C] 00569EE5 52 PUSH EDX 00569EE6 8D55 A8 LEA EDX,DWORD PTR SS:[EBP-58] 00569EE9 52 PUSH EDX 00569EEA 8B7D 10 MOV EDI,DWORD PTR SS:[EBP+10] 00569EED 57 PUSH EDI 00569EEE 50 PUSH EAX 00569EEF FF51 24 CALL DWORD PTR DS:[ECX+24] ; 读取文件后的处理 call 0040854a 00569EF2 DBE2 FCLEX 00569EF4 85C0 TEST EAX,EAX 00569EF6 7D 0F JGE SHORT FXCalend.00569F07 00569EF8 6A 24 PUSH 24 00569EFA 68 38B24100 PUSH FXCalend.0041B238 00569EFF 56 PUSH ESI 00569F00 50 PUSH EAX 00569F01 FF15 B4104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj 00569F07 66:0FB6F3 MOVZX SI,BL 00569F0B 8B07 MOV EAX,DWORD PTR DS:[EDI] 00569F0D 50 PUSH EAX 00569F0E 56 PUSH ESI 00569F0F 6A FF PUSH -1 00569F11 6A 20 PUSH 20 00569F13 FF15 78124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFileO>; MSVBVM60.__vbaFileOpen 00569F19 56 PUSH ESI 00569F1A 8D4D D4 LEA ECX,DWORD PTR SS:[EBP-2C] 00569F1D 51 PUSH ECX 00569F1E 68 8CA24200 PUSH FXCalend.0042A28C 00569F23 FF15 80114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaPutOw>; MSVBVM60.__vbaPutOwner3 00569F29 56 PUSH ESI 00569F2A FF15 60114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFileC>; MSVBVM60.__vbaFileClose 00569F30 C745 D0 FFFFFFF>MOV DWORD PTR SS:[EBP-30],-1 00569F37 EB 07 JMP SHORT FXCalend.00569F40 00569F39 C745 D0 0000000>MOV DWORD PTR SS:[EBP-30],0 00569F40 FF15 E8104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaExitP>; MSVBVM60.__vbaExitProc 00569F46 68 6D9F5600 PUSH FXCalend.00569F6D 00569F4B EB 0A JMP SHORT FXCalend.00569F57 00569F4D 8D4D BC LEA ECX,DWORD PTR SS:[EBP-44] 00569F50 FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVar 00569F56 C3 RETN 00569F57 8D55 D4 LEA EDX,DWORD PTR SS:[EBP-2C] 00569F5A 52 PUSH EDX 00569F5B 6A 00 PUSH 0 00569F5D FF15 D0104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaAryDe>; MSVBVM60.__vbaAryDestruct 00569F63 8D4D CC LEA ECX,DWORD PTR SS:[EBP-34] 00569F66 FF15 98134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObj 00569F6C C3 RETN 00569F6D 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 00569F70 8B08 MOV ECX,DWORD PTR DS:[EAX] 00569F72 50 PUSH EAX 00569F73 FF51 08 CALL DWORD PTR DS:[ECX+8] 00569F76 8B55 18 MOV EDX,DWORD PTR SS:[EBP+18] 00569F79 66:8B45 D0 MOV AX,WORD PTR SS:[EBP-30] 00569F7D 66:8902 MOV WORD PTR DS:[EDX],AX 00569F80 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C] 00569F83 8B4D E4 MOV ECX,DWORD PTR SS:[EBP-1C] 00569F86 64:890D 0000000>MOV DWORD PTR FS:[0],ECX 00569F8D 5F POP EDI 00569F8E 5E POP ESI 00569F8F 5B POP EBX 00569F90 8BE5 MOV ESP,EBP 00569F92 5D POP EBP 00569F93 C2 1400 RETN 14 00569F96 90 NOP 00569F97 90 NOP 00569F98 90 NOP 00569F99 90 NOP 00569F9A 90 NOP 00569F9B 90 NOP 00569F9C 90 NOP 00569F9D 90 NOP 00569F9E 90 NOP 00569F9F 90 NOP 00569FA0 55 PUSH EBP 00569FA1 8BEC MOV EBP,ESP 00569FA3 83EC 14 SUB ESP,14 00569FA6 68 96704000 PUSH <JMP.&MSVBVM60.__vbaExceptHandler> 00569FAB 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] 00569FB1 50 PUSH EAX 00569FB2 64:8925 0000000>MOV DWORD PTR FS:[0],ESP 00569FB9 81EC 40010000 SUB ESP,140 00569FBF 53 PUSH EBX 00569FC0 56 PUSH ESI 00569FC1 57 PUSH EDI 00569FC2 8965 EC MOV DWORD PTR SS:[EBP-14],ESP |
|
[求助]如何知道在内存中的值是在程序中的什么时候写入?
如果是程序载入的时候就生成的,那得找到什么时候? |
|
[原创][推荐]查看浮点数再内存中结构的工具
是的, 因为不能发附件,所以发在我的blog上。 |
|
|
操作理由
RANk
{{ user_info.golds == '' ? 0 : user_info.golds }}
雪币
{{ experience }}
课程经验
{{ score }}
学习收益
{{study_duration_fmt}}
学习时长
基本信息
荣誉称号:
{{ honorary_title }}
能力排名:
No.{{ rank_num }}
等 级:
LV{{ rank_lv-100 }}
活跃值:
在线值:
浏览人数:{{ visits }}
最近活跃:{{ last_active_time }}
注册时间:{{ user_info.create_date_jsonfmt }}
勋章
兑换勋章
证书
证书查询 >
能力值