VB API
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
__vbaVarTstEq(x,y) return 0 不相等，return -1 相等。
push parameter1 ;*(*( parameter1+8))->x
push parameter2 ;*(*( parameter2+8))->y
call __vbaVarTstEq;
(可以比较不同类型的数据)
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
__vbaVarTstNe(x,y) return -1 不相等，return 0 相等。
push parameter1 ;*( parameter1+8)->x
push parameter2 ;*( parameter2+8)->y
call __vbaVarTstNe ;
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
__vbastrcmp(x,y) return 0 不相等，return -1 相等。
ecx ;*ecx->x
edx ;*ecx->y
call __vbastrcmp(x,y);
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
__vbastrcomp(x,y) return 0 不相等，return -1 相等。
push parameter1 ;* parameter1->x
push parameter2 ;* parameter2->y
push 0/1 ;0为二进制比较，1为文本方式比较
call __vbastrcomp(x,y);
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
__vbaVarCopy ;拷贝字符串 如：a=”121212”
b=a
edx ; *(*(edx-8))->a
ecx ; *ecx->字符长度，*(*(ecx-8))->b(运行后)
call __vbaVarCopy;
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
__vbaVarMove ;传递数值 如：b=a
edx ; *(*(edx-8))->a
ecx ; *(*(ecx-8))->b(运行后)
call __ vbaVarMove;
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
__vbaVarAdd ;加 如：c=a+b
push parameter1 ;*( parameter1-8)->a
push parameter2 ;*( parameter2-8)->b
push parameter3 ;*( parameter3-8)->c
call __vbaVarAdd;
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
vbaVarMul ;加 如：c=a*b
push reg1 ;*(edx-8)->a
push reg2 ;*(edx-8)->b
push reg3 ;*(edx-8)->c
call __vbaVarMul;
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
vbastrcopy :copy 字符串 如：a=”121212”
b=a
edx ;*edx=a
ecx ;**ecx=b
call vbastrcopy;
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
vbastrcat ;累加字符串 如： a=”121212”
b=”ababab”
c=a+b
push parameter1 ;* parameter1=a
push parameter2 ; *parameter2=b
call vbastrcat
返回eax ;*eax=c
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
vbastrmove :copy 字符串 如：a=”121212”
b=a
edx ;*edx=a
ecx ;**ecx=b(运行后)
call vbastrmove;
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
vbainstrvar : 传回字串里某个字串在第几个字的位置
push parameter1 ;从第几个开始
push parameter2 ;所要检查原字串
push parameter3 ;某个字串
push parameter4 ；？
push parameter5 ；输出地址
call vbainstrvar
返回eax ; 输出地址
ecx ; 位置
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
vbaStrToAnsi : UNICODE 转换为 ASICII.
push parameter1 ;原UNICODE字符串个数
push parameter2 ;原UNICODE字符串地址
push parameter3 ;** parameter3输出ASICII地址
call vbaStrToAnsi
返回eax ; 输出ASICII地址
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
vbaStrToUnicode: ASICII 转换为 UNICODE.
push parameter1 ;原ASICII字符串地址
push parameter2 ；** parameter2->输出UNICODE地址
call vbaStrToUnicode
返回eax ; 输出UNICODE地址
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
[培训]内核驱动高级班，冲击BAT一流互联网大厂工
作，每周日13:00-18:00直播授课
