#include <stdio.h> 
#include <stdlib.h>
#include <string.h>
typedef unsigned short USHORT;
typedef USHORT *PUSHORT;
int main() 
{ 
	PUSHORT pus,pmp;
	USHORT pusss; //ushort 16bit
	int i,incnum;
	char *aa="3456ABCD";//这里要在十六进制的范围。测试这里要写大写字母
	i=strlen(aa);
	pus=(PUSHORT)aa;
	pmp=NULL;
	incnum=0;
	pmp=(PUSHORT)malloc(sizeof(USHORT)*(i+2));
	if (pmp==NULL)
	{
		printf("Error\n");
		return 0;
	}
//	RtlZeroMemory(pmp,i/2+1);
	memset(pmp,0,i+2);

	_asm
	{
		xor eax,eax
		mov edx,0 
		mov ebx,1//标志
		mov esi,[pus] //字符串地址
		mov edi,[pmp] //要写入的目的地址
		mov ecx,0
	
	comstart:
		mov al,BYTE PTR [esi]
		cmp al,41h
		jge completesm
		cmp al,39h
		jle completenum

	completesm:
		cmp al,46h
		jle comsmok


	completenum:
		cmp al,30h
		jge comnumok

	comnumok:
		sub al,30h
		cmp ebx,1
		jz editnumok
		or al,dl //高位与低位相或结果放在al中
		mov BYTE PTR [edi],al
		add edi,2
		inc esi
		inc ebx
		inc ecx
		cmp ecx,i
		jz exitloop
		jmp comstart
	comsmok:

		sub al,41h
		add al,10 //这里转为十六进制
		cmp ebx,1
		jz editsmok
		or al,dl //高位与低位相或结果放在al中
		mov BYTE PTR [edi],al
		add edi,2
		inc esi
		inc ebx
		inc ecx
		cmp ecx,i
		jz exitloop
		jmp comstart

	editnumok:

		mov dl,al
		shl dl,4
		inc esi
		dec ebx
		inc ecx
		cmp ecx,i
		jz exitloop
		jmp comstart

	editsmok:

		mov dl,al
		shl dl,4
		inc esi
		dec ebx
		inc ecx
		cmp ecx,i
		jz exitloop
		jmp comstart


exitloop:

	}
    while ((*pmp)!=0)
    {
		printf("%X\n",*pmp);
		pmp++;
    }


	return 0; 
} 

[课程]Android-CTF解题方法汇总！