能力值：
( LV5，RANK：70 )
|
-
-
2 楼
按F8或F11跟进去，或输“t”，单步跟进。
|
能力值：
( LV2，RANK：10 )
|
-
-
3 楼
我只是想反汇编一下ZwReadfile这个函数，没有动态调试
|
能力值：
( LV2，RANK：10 )
|
-
-
4 楼
往上顶..
|
能力值：
( LV2，RANK：10 )
|
-
-
5 楼
求大牛解答
|
能力值：
( LV4，RANK：50 )
|
-
-
6 楼
直接在windbg里面输入
uf ntdll!NtReadFile+0xd
即可查看该处的代码了
|
能力值：
( LV2，RANK：10 )
|
-
-
7 楼
不行，反汇编出来的结果跟uf ntdll!ZwReadfile 是一样的
|
能力值：
( LV2，RANK：10 )
|
-
-
8 楼
把e803000000 这个基址带上试试
|
能力值：
( LV2，RANK：10 )
|
-
-
9 楼
这个不是基址，是汇编指令对应的16进制...
|
能力值：
( LV2，RANK：10 )
|
-
-
10 楼
win8ms很麻烦的样子
|
能力值：
( LV2，RANK：10 )
|
-
-
11 楼
确实很麻烦
|
能力值：
( LV2，RANK：10 )
|
-
-
12 楼
已经放了很长时间了，大神快来吧
|
能力值：
( LV2，RANK：10 )
|
-
-
13 楼
你就不能用vc自带的反汇编调试吗
|
能力值：
( LV2，RANK：10 )
|
-
-
14 楼
Connected to Windows 7 9200 x64 target at (Wed Jun 12 21:39:00.993 2013 (UTC + 8:00)), ptr64 TRUE
Symbol search path is: SRV*D:\\symbols*d9eK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4y4&6L8h3u0G2L8s2y4Q4x3X3g2E0L8%4A6A6L8r3I4S2i4K6u0W2L8%4u0Y4i4K6u0r3k6X3W2J5k6h3k6G2P5q4)9K6b7W2y4d9g2W2)9J5b7f1c8Q4x3@1q4Q4y4f1y4Q4y4f1y4K6P5h3#2T1L8$3I4K6i4K6u0m8K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3#2K6k6r3I4Q4x3X3g2E0K9h3y4J5L8%4y4G2k6Y4c8Q4x3X3g2U0L8$3#2Q4x3V1k6V1L8%4N6F1L8r3!0S2k6q4)9J5c8Y4y4&6L8h3u0G2L8s2y4Q4x3@1u0Z5N6s2c8H3i4K6y4m8i4K6u0r3i4K6u0r3j5$3S2J5L8$3#2A6N6h3#2Q4x3X3c8T1M7X3!0%4M7$3g2J5i4K6u0V1M7%4W2E0M7%4u0$3i4K6u0W2j5$3!0E0L8h3!0F1k6r3q4@1j5i4y4@1L8%4u0S2k6$3g2Q4x3X3g2Y4L8$3!0Y4L8r3g2S2M7r3W2K6i4K6u0W2j5$3!0E0i4K6y4n7f1#2u0h3i4K6u0m8c8q4)9K6b7g2)9#2b7#2)9#2b7%4y4&6L8h3u0G2L8s2y4Q4x3V1q4Z5N6s2c8H3i4K6y4m8i4K6u0r3i4K6u0r3j5%4c8^5M7%4W2E0i4K6u0W2j5$3W2@1M7X3W2^5i4K6u0W2j5$3!0E0i4K6u0r3M7%4W2E0j5X3!0D9M7#2)9K6b7W2y4d9g2W2)9J5b7f1c8Q4x3@1q4Q4y4f1y4Q4y4f1y4K6P5h3#2T1L8$3I4K6i4K6u0m8K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3c8W2N6X3g2D9L8%4m8W2M7W2)9J5k6h3q4H3M7r3I4W2i4K6u0W2j5$3!0E0i4K6u0r3K9h3&6@1k6i4u0F1k6i4c8Q4x3V1k6K6j5h3k6S2M7X3W2Q4x3V1k6%4K9h3&6V1L8%4N6K6i4K6g2X3M7%4W2E0j5X3!0D9M7H3`.`.
Executable search path is:
Windows 7 Kernel Version 9200 MP (2 procs) Free x64
Product: Server, suite: TerminalServer DataCenter SingleUserTS
Built by: 9200.16581.amd64fre.win8_gdr.130410-1505
Machine Name:
Kernel base = 0xfffff803`ab211000 PsLoadedModuleList = 0xfffff803`ab4dda20
Debug session time: Wed Jun 12 21:39:01.243 2013 (UTC + 8:00)
System Uptime: 0 days 0:09:15.117
lkd> u ZwReadFile
nt!ZwReadFile:
fffff803`ab26c0c0 488bc4 mov rax,rsp
fffff803`ab26c0c3 fa cli
fffff803`ab26c0c4 4883ec10 sub rsp,10h
fffff803`ab26c0c8 50 push rax
fffff803`ab26c0c9 9c pushfq
fffff803`ab26c0ca 6a10 push 10h
fffff803`ab26c0cc 488d055d350000 lea rax,[nt!KiServiceLinkage (fffff803`ab26f630)]
fffff803`ab26c0d3 50 push rax
lkd> u NtReadFile
nt!NtReadFile:
fffff803`ab6abc80 4c8bdc mov r11,rsp
fffff803`ab6abc83 4d894b20 mov qword ptr [r11+20h],r9
fffff803`ab6abc87 4d894318 mov qword ptr [r11+18h],r8
fffff803`ab6abc8b 49895310 mov qword ptr [r11+10h],rdx
fffff803`ab6abc8f 53 push rbx
fffff803`ab6abc90 56 push rsi
fffff803`ab6abc91 57 push rdi
fffff803`ab6abc92 4154 push r12
lkd> uf ZwReadFile
Flow analysis was incomplete, some code may be missing
nt!KiServiceInternal:
fffff803`ab26a140 4883ec08 sub rsp,8
fffff803`ab26a144 55 push rbp
fffff803`ab26a145 4881ec58010000 sub rsp,158h
fffff803`ab26a14c 488dac2480000000 lea rbp,[rsp+80h]
fffff803`ab26a154 48899dc0000000 mov qword ptr [rbp+0C0h],rbx
fffff803`ab26a15b 4889bdc8000000 mov qword ptr [rbp+0C8h],rdi
fffff803`ab26a162 4889b5d0000000 mov qword ptr [rbp+0D0h],rsi
fffff803`ab26a169 fb sti
fffff803`ab26a16a 65488b1c2588010000 mov rbx,qword ptr gs:[188h]
fffff803`ab26a173 0f0d8b90000000 prefetchw [rbx+90h]
fffff803`ab26a17a 0fb6bb32020000 movzx edi,byte ptr [rbx+232h]
fffff803`ab26a181 40887da8 mov byte ptr [rbp-58h],dil
fffff803`ab26a185 c6833202000000 mov byte ptr [rbx+232h],0
fffff803`ab26a18c 4c8b9390000000 mov r10,qword ptr [rbx+90h]
fffff803`ab26a193 4c8995b8000000 mov qword ptr [rbp+0B8h],r10
fffff803`ab26a19a 4c8d1d3d010000 lea r11,[nt!KiSystemServiceStart (fffff803`ab26a2de)]
fffff803`ab26a1a1 41ffe3 jmp r11
nt!ZwReadFile:
fffff803`ab26c0c0 488bc4 mov rax,rsp
fffff803`ab26c0c3 fa cli
fffff803`ab26c0c4 4883ec10 sub rsp,10h
fffff803`ab26c0c8 50 push rax
fffff803`ab26c0c9 9c pushfq
fffff803`ab26c0ca 6a10 push 10h
fffff803`ab26c0cc 488d055d350000 lea rax,[nt!KiServiceLinkage (fffff803`ab26f630)]
fffff803`ab26c0d3 50 push rax
fffff803`ab26c0d4 b804000000 mov eax,4
fffff803`ab26c0d9 e962e0ffff jmp nt!KiServiceInternal (fffff803`ab26a140)
|
|
|
|
