能力值:
( LV2,RANK:10 )
|
-
-
2 楼
这个原创创的好哇~
|
能力值:
( LV2,RANK:10 )
|
-
-
5 楼
偷偷告诉你……整个Windows的都被我过……
|
能力值:
( LV9,RANK:200 )
|
-
-
7 楼
顶LZ,确实神奇。
|
能力值:
( LV10,RANK:163 )
|
-
-
8 楼
吓死了,太吓人了,建议版主给10万个精.
|
能力值:
( LV3,RANK:20 )
|
-
-
11 楼
我擦。。原来windbg可以这样用的。。。必须给精华。。
|
能力值:
( LV4,RANK:50 )
|
-
-
12 楼
大家都喜欢调侃吗?
|
能力值:
( LV2,RANK:10 )
|
-
-
16 楼
发错板块了.... 这是娱乐贴吧 哈哈~
|
能力值:
( LV2,RANK:10 )
|
-
-
17 楼
说不定是人家自己写了一国windbg呢……此乃真大牛耶……
|
能力值:
( LV2,RANK:10 )
|
-
-
19 楼
太强悍了, 学习.
|
能力值:
( LV3,RANK:20 )
|
-
-
21 楼
楼主不会是直接拷贝windbg的吧!
以下是我从windbg上拷贝的
nt!KiFastCallEntry:
83e510c0 b923000000 mov ecx,23h
83e510c5 6a30 push 30h
83e510c7 0fa1 pop fs
83e510c9 8ed9 mov ds,cx
83e510cb 8ec1 mov es,cx
83e510cd 648b0d40000000 mov ecx,dword ptr fs:[40h]
83e510d4 8b6104 mov esp,dword ptr [ecx+4]
83e510d7 6a23 push 23h
83e510d9 52 push edx
83e510da 9c pushfd
83e510db 6a02 push 2
83e510dd 83c208 add edx,8
83e510e0 9d popfd
83e510e1 804c240102 or byte ptr [esp+1],2
83e510e6 6a1b push 1Bh
83e510e8 ff350403dfff push dword ptr ds:[0FFDF0304h]
83e510ee 6a00 push 0
83e510f0 55 push ebp
83e510f1 53 push ebx
83e510f2 56 push esi
83e510f3 57 push edi
83e510f4 648b1d1c000000 mov ebx,dword ptr fs:[1Ch]
83e510fb 6a3b push 3Bh
83e510fd 8bb324010000 mov esi,dword ptr [ebx+124h]
83e51103 ff33 push dword ptr [ebx]
83e51105 c703ffffffff mov dword ptr [ebx],0FFFFFFFFh
83e5110b 8b6e28 mov ebp,dword ptr [esi+28h]
83e5110e 6a01 push 1
83e51110 83ec48 sub esp,48h
83e51113 81ed9c020000 sub ebp,29Ch
83e51119 c6863a01000001 mov byte ptr [esi+13Ah],1
83e51120 3bec cmp ebp,esp
83e51122 7597 jne nt!KiFastCallEntry2+0x49 (83e510bb)
nt!KiFastCallEntry+0x64:
83e51124 83652c00 and dword ptr [ebp+2Ch],0
83e51128 f64603df test byte ptr [esi+3],0DFh
83e5112c 89ae28010000 mov dword ptr [esi+128h],ebp
83e51132 0f8538feffff jne nt!Dr_FastCallDrSave (83e50f70)
nt!KiFastCallEntry+0x78:
83e51138 8b5d60 mov ebx,dword ptr [ebp+60h]
83e5113b 8b7d68 mov edi,dword ptr [ebp+68h]
83e5113e 89550c mov dword ptr [ebp+0Ch],edx
83e51141 c74508000ddbba mov dword ptr [ebp+8],0BADB0D00h
83e51148 895d00 mov dword ptr [ebp],ebx
83e5114b 897d04 mov dword ptr [ebp+4],edi
83e5114e fb sti
nt!KiFastCallEntry+0x8f:
83e5114f 8bf8 mov edi,eax
83e51151 c1ef08 shr edi,8
83e51154 83e710 and edi,10h
83e51157 8bcf mov ecx,edi
83e51159 03bebc000000 add edi,dword ptr [esi+0BCh]
83e5115f 8bd8 mov ebx,eax
83e51161 25ff0f0000 and eax,0FFFh
83e51166 3b4708 cmp eax,dword ptr [edi+8]
83e51169 0f8333fdffff jae nt!KiBBTUnexpectedRange (83e50ea2)
nt!KiFastCallEntry+0xaf:
83e5116f 83f910 cmp ecx,10h
83e51172 751a jne nt!KiFastCallEntry+0xce (83e5118e)
nt!KiFastCallEntry+0xb4:
83e51174 8b8e88000000 mov ecx,dword ptr [esi+88h]
83e5117a 33f6 xor esi,esi
83e5117c 0bb1700f0000 or esi,dword ptr [ecx+0F70h]
83e51182 740a je nt!KiFastCallEntry+0xce (83e5118e)
nt!KiFastCallEntry+0xc4:
83e51184 52 push edx
83e51185 50 push eax
83e51186 ff154cd9f783 call dword ptr [nt!KeGdiFlushUserBatch (83f7d94c)]
83e5118c 58 pop eax
83e5118d 5a pop edx
nt!KiFastCallEntry+0xce:
83e5118e 64ff05b0060000 inc dword ptr fs:[6B0h]
83e51195 8bf2 mov esi,edx
83e51197 33c9 xor ecx,ecx
83e51199 8b570c mov edx,dword ptr [edi+0Ch]
83e5119c 8b3f mov edi,dword ptr [edi]
83e5119e 8a0c10 mov cl,byte ptr [eax+edx]
83e511a1 8b1487 mov edx,dword ptr [edi+eax*4]
83e511a4 2be1 sub esp,ecx
83e511a6 c1e902 shr ecx,2
83e511a9 8bfc mov edi,esp
83e511ab 3b351cd7f783 cmp esi,dword ptr [nt!MmUserProbeAddress (83f7d71c)]
83e511b1 0f832e020000 jae nt!KiSystemCallExit2+0xa5 (83e513e5)
nt!KiFastCallEntry+0xf7:
83e511b7 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
83e511b9 f6456c01 test byte ptr [ebp+6Ch],1
83e511bd 7416 je nt!KiFastCallEntry+0x115 (83e511d5)
nt!KiFastCallEntry+0xff:
83e511bf 648b0d24010000 mov ecx,dword ptr fs:[124h]
83e511c6 8b3c24 mov edi,dword ptr [esp]
83e511c9 89993c010000 mov dword ptr [ecx+13Ch],ebx
83e511cf 89b92c010000 mov dword ptr [ecx+12Ch],edi
nt!KiFastCallEntry+0x115:
83e511d5 8bda mov ebx,edx
83e511d7 f60508a9f48340 test byte ptr [nt!PerfGlobalGroupMask+0x8 (83f4a908)],40h
83e511de 0f954512 setne byte ptr [ebp+12h]
83e511e2 0f858c030000 jne nt!KiServiceExit2+0x17b (83e51574)
nt!KiFastCallEntry+0x128:
83e511e8 ffd3 call ebx
nt!KiFastCallEntry+0x12a:
83e511ea f6456c01 test byte ptr [ebp+6Ch],1
83e511ee 7434 je nt!KiFastCallEntry+0x164 (83e51224)
..........
既然逆向,楼主就把它逆向成高级语言吧!
|
能力值:
( LV6,RANK:90 )
|
-
-
22 楼
逆的不错,学习了!
|