在逆向一个1MB左右的程序的时候,在ida functions 里面可以找到大约有 1万个 sub_xxx 还有一定数量的 unknown_libname_xxx ,能识别的函数少之又少
这样我就猜想这里面肯定有非常多的库函数未被识别,我希望能得到各位有经验的大神的指导。
另外请允许我附带一段代码,也请大家鉴定下这是否为可以识别的库函数
如果有不对的地方,也请大家批评指出。
.text:00404550 sub_404550 proc near ; CODE XREF: sub_404340:loc_404379p
.text:00404550 ; sub_404870:loc_4048A1p
.text:00404550 ; sub_408860:loc_408899p
.text:00404550 ; sub_4088E0:loc_408983p
.text:00404550 ; sub_409390+43p
.text:00404550 ; sub_409F00:loc_409F7Fp ...
.text:00404550
.text:00404550 var_14 = dword ptr -14h
.text:00404550 var_10 = dword ptr -10h
.text:00404550 var_C = dword ptr -0Ch
.text:00404550 var_4 = dword ptr -4
.text:00404550 arg_0 = dword ptr 4
.text:00404550
.text:00404550 push 0FFFFFFFFh
.text:00404552 push offset loc_57ADB8
.text:00404557 mov eax, large fs:0
.text:0040455D push eax
.text:0040455E mov large fs:0, esp
.text:00404565 sub esp, 8
.text:00404568 mov eax, [esp+14h+arg_0]
.text:0040456C push ebx
.text:0040456D dec eax
.text:0040456E push ebp
.text:0040456F mov ebp, ds:InterlockedExchange
.text:00404575 push esi
.text:00404576 shr eax, 3
.text:00404579 push edi
.text:0040457A push 1 ; Value
.text:0040457C lea ecx, ds:5C8914h[eax*4]
.text:00404583 push offset Target ; Target
.text:00404588 mov [esp+2Ch+var_10], ecx
.text:0040458C call ebp ; InterlockedExchange
.text:0040458E test eax, eax
.text:00404590 jz loc_40465A
.text:00404590
.text:00404596 mov edi, dword_5BA498
.text:0040459C mov eax, dword_5C8958
.text:004045A1 mov [esp+24h+var_14], 11h
.text:004045A9 xor esi, esi
.text:004045AB test edi, edi
.text:004045AD jbe short loc_404610
.text:004045AD
.text:004045AF mov ebx, eax
.text:004045B1 shr ebx, 1
.text:004045B1
.text:004045B3
.text:004045B3 loc_4045B3: ; CODE XREF: sub_404550+BEj
.text:004045B3 cmp esi, ebx
.text:004045B5 jb short loc_4045CF
.text:004045B5
.text:004045B7 mov eax, Target
.text:004045BC test eax, eax
.text:004045BE jnz short loc_4045CF
.text:004045BE
.text:004045C0 push 1 ; Value
.text:004045C2 push offset Target ; Target
.text:004045C7 call ebp ; InterlockedExchange
.text:004045C9 test eax, eax
.text:004045CB jz short loc_40464A
.text:004045CB
.text:004045CD jmp short loc_40460B
.text:004045CD
.text:004045CF ; ---------------------------------------------------------------------------
.text:004045CF
.text:004045CF loc_4045CF: ; CODE XREF: sub_404550+65j
.text:004045CF ; sub_404550+6Ej
.text:004045CF mov edx, [esp+24h+var_14]
.text:004045D3 mov eax, [esp+24h+var_14]
.text:004045D7 imul edx, eax
.text:004045DA mov [esp+24h+var_14], edx
.text:004045DE mov ecx, [esp+24h+var_14]
.text:004045E2 mov edx, [esp+24h+var_14]
.text:004045E6 imul ecx, edx
.text:004045E9 mov [esp+24h+var_14], ecx
.text:004045ED mov eax, [esp+24h+var_14]
.text:004045F1 mov ecx, [esp+24h+var_14]
.text:004045F5 imul eax, ecx
.text:004045F8 mov [esp+24h+var_14], eax
.text:004045FC mov edx, [esp+24h+var_14]
.text:00404600 mov eax, [esp+24h+var_14]
.text:00404604 imul edx, eax
.text:00404607 mov [esp+24h+var_14], edx
.text:00404607
.text:0040460B
.text:0040460B loc_40460B: ; CODE XREF: sub_404550+7Dj
.text:0040460B inc esi
.text:0040460C cmp esi, edi
.text:0040460E jb short loc_4045B3
.text:0040460E
.text:00404610
.text:00404610 loc_404610: ; CODE XREF: sub_404550+5Dj
.text:00404610 mov ebx, ds:Sleep
.text:00404616 mov dword_5BA498, 1Eh
.text:00404620 mov edi, 6
.text:00404620
.text:00404625
.text:00404625 loc_404625: ; CODE XREF: sub_404550+F8j
.text:00404625 ; sub_404550+12Ej
.text:00404625 cmp edi, 1Bh
.text:00404628 mov esi, edi
.text:0040462A jle short loc_404631
.text:0040462A
.text:0040462C mov esi, 1Bh
.text:0040462C
.text:00404631
.text:00404631 loc_404631: ; CODE XREF: sub_404550+DAj
.text:00404631 push 1 ; Value
.text:00404633 push offset Target ; Target
.text:00404638 call ebp ; InterlockedExchange
.text:0040463A test eax, eax
.text:0040463C jz short loc_40465A
.text:0040463C
.text:0040463E cmp esi, 14h
.text:00404641 jg short loc_404670
.text:00404641
.text:00404643 push 0 ; dwMilliseconds
.text:00404645 call ebx ; Sleep
.text:00404647 inc edi
.text:00404648 jmp short loc_404625
.text:00404648
.text:0040464A ; ---------------------------------------------------------------------------
.text:0040464A
.text:0040464A loc_40464A: ; CODE XREF: sub_404550+7Bj
.text:0040464A mov dword_5C8958, esi
.text:00404650 mov dword_5BA498, 3E8h
.text:00404650
.text:0040465A
.text:0040465A loc_40465A: ; CODE XREF: sub_404550+40j
.text:0040465A ; sub_404550+ECj
.text:0040465A mov ecx, [esp+24h+var_10]
.text:0040465E xor ebp, ebp
.text:00404660 mov [esp+24h+var_4], ebp
.text:00404664 mov eax, [ecx]
.text:00404666 cmp eax, ebp
.text:00404668 jz short loc_404680
.text:00404668
.text:0040466A mov edx, [eax]
.text:0040466C mov [ecx], edx
.text:0040466E jmp short loc_4046D9
.text:0040466E
.text:00404670 ; ---------------------------------------------------------------------------
.text:00404670
.text:00404670 loc_404670: ; CODE XREF: sub_404550+F1j
.text:00404670 lea ecx, [esi-14h]
.text:00404673 mov edx, 1
.text:00404678 shl edx, cl
.text:0040467A push edx ; dwMilliseconds
.text:0040467B call ebx ; Sleep
.text:0040467D inc edi
.text:0040467E jmp short loc_404625
.text:0040467E
.text:00404680 ; ---------------------------------------------------------------------------
.text:00404680
.text:00404680 loc_404680: ; CODE XREF: sub_404550+118j
.text:00404680 mov eax, [esp+24h+arg_0]
.text:00404684 lea ecx, [esp+24h+var_14]
.text:00404688 push ecx
.text:00404689 mov [esp+28h+var_14], 14h
.text:00404691 lea esi, [eax+7]
.text:00404694 and esi, 0FFFFFFF8h
.text:00404697 push esi
.text:00404698 call sub_404710
.text:00404698
.text:0040469D mov ebx, [esp+2Ch+var_14]
.text:004046A1 add esp, 8
.text:004046A4 cmp ebx, 1
.text:004046A7 jz short loc_4046D9
.text:004046A7
.text:004046A9 lea edx, [esi-1]
.text:004046AC lea ecx, [eax+esi]
.text:004046AF shr edx, 3
.text:004046B2 mov dword_5C8914[edx*4], ecx
.text:004046B9 mov edx, ecx
.text:004046BB add ecx, esi
.text:004046BD mov edi, 1
.text:004046C2 dec ebx
.text:004046C3 cmp ebx, edi
.text:004046C5 jz short loc_4046D7
.text:004046C5
.text:004046C7
.text:004046C7 loc_4046C7: ; CODE XREF: sub_404550+185j
.text:004046C7 mov [edx], ecx
.text:004046C9 mov ebx, [esp+24h+var_14]
.text:004046CD mov edx, ecx
.text:004046CF inc edi
.text:004046D0 add ecx, esi
.text:004046D2 dec ebx
.text:004046D3 cmp ebx, edi
.text:004046D5 jnz short loc_4046C7
.text:004046D5
.text:004046D7
.text:004046D7 loc_4046D7: ; CODE XREF: sub_404550+175j
.text:004046D7 mov [edx], ebp
.text:004046D7
.text:004046D9
.text:004046D9 loc_4046D9: ; CODE XREF: sub_404550+11Ej
.text:004046D9 ; sub_404550+157j
.text:004046D9 mov Target, ebp
.text:004046DF mov ecx, [esp+24h+var_C]
.text:004046E3 pop edi
.text:004046E4 pop esi
.text:004046E5 pop ebp
.text:004046E6 pop ebx
.text:004046E7 mov large fs:0, ecx
.text:004046EE add esp, 14h
.text:004046F1 retn
.text:004046F1
.text:004046F1 sub_404550 endp
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课