能力值:
( LV2,RANK:10 )
|
-
-
2 楼
不会吧,真没看懂。
这两汇编 没什么联系啊 没看出来啥意思 1DH 25H 都是常数啊
.text:00401042 mov eax, 1Dh //DecryptCodeLen
text:0040105D push 25h //DCEntryoffset
|
能力值:
( LV6,RANK:90 )
|
-
-
3 楼
我写错了应该是
.text:00401042 mov eax, 1Dh //DecryptCodeLen
text:0040105D push 25h //DecryptCodeLen
也就是同一个常量DecryptCodeLen,在
mov eax,DecryptCodeLen
和
invoke FixJumpAddr,NULL,0,0,DecryptCodeLen,xxx,xxxx,0
被编译成不同的值
|
能力值:
( LV9,RANK:610 )
|
-
-
4 楼
好奇怪 不知道为什么 。。。
|
能力值:
( LV3,RANK:30 )
|
-
-
5 楼
那都没有错,错就错在你这样定义了
DecryptCodeLen equ _DecryptCodeEnd - _DecryptCodeStart
CloneCodeLen equ _CloneCodeEnd - _CloneCodeStart
DCEntryoffset equ _DecryptCodeEntry - _DecryptCodeStart
|
能力值:
( LV3,RANK:30 )
|
-
-
6 楼
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.386
.model flat,stdcall
option casemap:none
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
include windows.inc
include kernel32.inc
include user32.inc
includelib kernel32.lib
includelib user32.lib
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.data
DecryptCodeLen dword 0
CloneCodeLen dword 0
DCEntryoffset dword 0
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.code
_DecryptCodeStart:
;...................................................................................................
_RVAToOffset proc _lpFileHead,_dwRVA
pushad
;若没有后面jmp @F 语句及@@标号,就没有问题,若有,则不一致
;++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
jmp @F
@@:
;++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
popad
ret
_RVAToOffset endp
_CloneCodeStart:
FixJumpAddr proc _rawBase,_sclen,_rblen,_dclen,_clen,_dcentryoffset,_scentryoffset
pushad
popad
ret
FixJumpAddr endp
;...................................................................................................
nop
nop
nop
nop
_CloneCodeEnd:
;...................................................................................................
nop
_DecryptCodeEntry:
nop
nop
nop
nop
_DecryptCodeEnd:
nop
start:
mov eax,_DecryptCodeEnd
sub eax,_DecryptCodeStart
mov DecryptCodeLen,eax
mov eax,_CloneCodeEnd
sub eax,_CloneCodeStart
mov CloneCodeLen ,eax
mov eax,_DecryptCodeEntry
sub eax,_DecryptCodeStart
mov DCEntryoffset,eax
mov eax,DecryptCodeLen
mov ebx,CloneCodeLen
mov ecx,DCEntryoffset
invoke FixJumpAddr,NULL,0,0,DecryptCodeLen,CloneCodeLen,DCEntryoffset,0
invoke ExitProcess,NULL
end start
|
能力值:
( LV6,RANK:90 )
|
-
-
7 楼
楼上,你规避这个问题实质了,
;若没有后面jmp @F 语句及@@标号,就没有问题,若有,则不一致
;++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
jmp @F
@@:
;++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
你把我的代码,这部分去掉,再编译看看,这几个值就是一样的,只要里面没用@@标号,值都是对的,用了值就对不上了
我觉得,masm32编译器处理@@与其它全局标量上可能有问题
|
能力值:
( LV9,RANK:610 )
|
-
-
8 楼
我用RadASM编译 也出现一样的问题 继续关注中 希望大牛来解答。
|
能力值:
( LV6,RANK:90 )
|
-
-
9 楼
微软编译器的bug啦
|
能力值:
( LV10,RANK:160 )
|
-
-
10 楼
mark~~,有意思的东西~~
|