像下面的循环有什么意义?
fcf634d2 ebbe jmp KeyMouse53!DriverEntry+0x62 (fcf63492)
kd> p
KeyMouse53!DriverEntry+0x62:
fcf63492 b801000000 mov eax,1
kd> p
KeyMouse53!DriverEntry+0x6b:
fcf6349b 8b4de8 mov ecx,dword ptr [ebp-18h]
kd> p
KeyMouse53!DriverEntry+0x73:
fcf634a3 8b45fc mov eax,dword ptr [ebp-4]
kd> p
KeyMouse53!DriverEntry+0x7f:
fcf634af 8b45e8 mov eax,dword ptr [ebp-18h]
kd> p
KeyMouse53!DriverEntry+0x88:
fcf634b8 8b55ec mov edx,dword ptr [ebp-14h]
kd> p
KeyMouse53!DriverEntry+0x90:
fcf634c0 8b4dfc mov ecx,dword ptr [ebp-4]
kd> p
KeyMouse53!DriverEntry+0x96:
fcf634c6 8b55e8 mov edx,dword ptr [ebp-18h]
kd> p
KeyMouse53!DriverEntry+0xa2:
fcf634d2 ebbe jmp KeyMouse53!DriverEntry+0x62 (fcf63492)
c代码是这样的
while(1)
{
//断去自身的链表
LtempF=FPLE->Flink;
LtempF->Blink=FPLE->Blink;//连接向后的链
LtempB=FPLE->Blink; //连接向前的链
LtempB->Flink=LtempF;
FPLE=LtempF;
if(FPLE->Flink==Fsave)
break;
}
寄存器和栈并不依赖所执行的指令而改变。怎么回事?
bp的内容一直没有改变,但是mov ecx,dword ptr [ebp-18h]这条指令每次循环所赋给ecx的值却是不同的。循环中并没有改变栈内容的指令啊 不知道有人明白我意思没有
[注意]看雪招聘,专注安全领域的专业人才平台!