grcasm可以将选中的反汇编代码以裸体函数的形式保存至文件。目的是方便将裸体函数复制到VC里面直接编译，比较适合懒人。。
grcasm能做的事情：
1.对API的处理
void __declspec (naked) SUB_00706DC2()
{
__asm{
MOV DWORD PTR DS:[ESI], EDI
PUSH ESI
CALL DWORD PTR [GetVersionExA] ;kernel32.GetVersionExA
MOV ECX, DWORD PTR DS:[ESI+0x10]
}
}
2.对swtich table的处理
OD显示的反汇编代码
00411370 55 PUSH EBP
00411371 8BEC MOV EBP, ESP
00411373 81EC DC000000 SUB ESP, 0xDC
00411379 53 PUSH EBX
0041137A 56 PUSH ESI
0041137B 57 PUSH EDI
0041137C 8DBD 24FFFFFF LEA EDI, DWORD PTR SS:[EBP-0xDC]
00411382 B9 37000000 MOV ECX, 0x37
00411387 B8 CCCCCCCC MOV EAX, 0xCCCCCCCC
0041138C F3:AB REP STOS DWORD PTR ES:[EDI]
0041138E C745 F8 00000000 MOV DWORD PTR SS:[EBP-0x8], 0x0
00411395 C745 EC 00000000 MOV DWORD PTR SS:[EBP-0x14], 0x0
0041139C 8B45 F8 MOV EAX, DWORD PTR SS:[EBP-0x8]
0041139F 8985 24FFFFFF MOV DWORD PTR SS:[EBP-0xDC], EAX
004113A5 8B8D 24FFFFFF MOV ECX, DWORD PTR SS:[EBP-0xDC]
004113AB 83E9 01 SUB ECX, 0x1
004113AE 898D 24FFFFFF MOV DWORD PTR SS:[EBP-0xDC], ECX
004113B4 83BD 24FFFFFF 05 CMP DWORD PTR SS:[EBP-0xDC], 0x5
004113BB 77 41 JA SHORT testgrca.004113FE
004113BD 8B95 24FFFFFF MOV EDX, DWORD PTR SS:[EBP-0xDC]
004113C3 FF2495 08144100 JMP DWORD PTR DS:[EDX*4+0x411408]
004113CA C745 EC 00000000 MOV DWORD PTR SS:[EBP-0x14], 0x0
004113D1 EB 2B JMP SHORT testgrca.004113FE
004113D3 C745 EC 00000000 MOV DWORD PTR SS:[EBP-0x14], 0x0
004113DA EB 22 JMP SHORT testgrca.004113FE
004113DC C745 EC 00000000 MOV DWORD PTR SS:[EBP-0x14], 0x0
004113E3 EB 19 JMP SHORT testgrca.004113FE
004113E5 C745 EC 00000000 MOV DWORD PTR SS:[EBP-0x14], 0x0
004113EC EB 10 JMP SHORT testgrca.004113FE
004113EE C745 EC 00000000 MOV DWORD PTR SS:[EBP-0x14], 0x0
004113F5 EB 07 JMP SHORT testgrca.004113FE
004113F7 C745 EC 00000000 MOV DWORD PTR SS:[EBP-0x14], 0x0
004113FE 33C0 XOR EAX, EAX
00411400 5F POP EDI
00411401 5E POP ESI
00411402 5B POP EBX
00411403 8BE5 MOV ESP, EBP
00411405 5D POP EBP
00411406 C3 RETN
00411407 90 NOP
00411408 CA 1341 RETF 0x4113
0041140B 00D3 ADD BL, DL
0041140D 1341 00 ADC EAX, DWORD PTR DS:[ECX]
00411410 DC13 FCOM QWORD PTR DS:[EBX]
00411412 41 INC ECX
00411413 00E5 ADD CH, AH
00411415 1341 00 ADC EAX, DWORD PTR DS:[ECX]
00411418 EE OUT DX, AL
00411419 1341 00 ADC EAX, DWORD PTR DS:[ECX]
0041141C F713 NOT DWORD PTR DS:[EBX]
0041141E 41 INC ECX
0041141F 00CC ADD AH, CL
grcasm生成的裸体函数
void __declspec (naked) SUB_00411370()
{
__asm{
PUSH EBP
MOV EBP, ESP
SUB ESP, 0X000000DC
PUSH EBX
PUSH ESI
PUSH EDI
LEA EDI, DWORD PTR SS:[EBP-0xDC]
MOV ECX, 0X00000037
MOV EAX, 0XCCCCCCCC
REP STOS DWORD PTR ES:[EDI]
MOV DWORD PTR SS:[EBP-0x8], 0x0
MOV DWORD PTR SS:[EBP-0x14], 0x0
MOV EAX, DWORD PTR SS:[EBP-0x8]
MOV DWORD PTR SS:[EBP-0xDC], EAX
MOV ECX, DWORD PTR SS:[EBP-0xDC]
SUB ECX, 0X00000001
MOV DWORD PTR SS:[EBP-0xDC], ECX
CMP DWORD PTR SS:[EBP-0xDC], 0X00000005
JA LABEL_00000000
MOV EDX, DWORD PTR SS:[EBP-0xDC]
CMP EDX, 0X00000000
JE SWITCH_CASE_00000000_00000000
CMP EDX, 0X00000001
JE SWITCH_CASE_00000000_00000001
CMP EDX, 0X00000002
JE SWITCH_CASE_00000000_00000002
CMP EDX, 0X00000003
JE SWITCH_CASE_00000000_00000003
CMP EDX, 0X00000004
JE SWITCH_CASE_00000000_00000004
CMP EDX, 0X00000005
JE SWITCH_CASE_00000000_00000005
SWITCH_CASE_00000000_00000000:
MOV DWORD PTR SS:[EBP-0x14], 0x0
JMP LABEL_00000001
SWITCH_CASE_00000000_00000001:
MOV DWORD PTR SS:[EBP-0x14], 0x0
JMP LABEL_00000002
SWITCH_CASE_00000000_00000002:
MOV DWORD PTR SS:[EBP-0x14], 0x0
JMP LABEL_00000003
SWITCH_CASE_00000000_00000003:
MOV DWORD PTR SS:[EBP-0x14], 0x0
JMP LABEL_00000004
SWITCH_CASE_00000000_00000004:
MOV DWORD PTR SS:[EBP-0x14], 0x0
JMP LABEL_00000005
SWITCH_CASE_00000000_00000005:
MOV DWORD PTR SS:[EBP-0x14], 0x0
LABEL_00000000:
LABEL_00000001:
LABEL_00000002:
LABEL_00000003:
LABEL_00000004:
LABEL_00000005:
XOR EAX, EAX
POP EDI
POP ESI
POP EBX
MOV ESP, EBP
POP EBP
RETN
}
}
3.对call的处理，递归处理每一个call，将每一个call以裸体函数的形式保存至文本
4.对内存数据的处理，可以以字节，字，双字的形式（十六进制）将选中的内存或者代码保存至文本
grcasm不能做的事情：
1.反汇编中存在内存地址的时候
void __declspec (naked) SUB_00412714()
{
__asm{
LEA EBX, DWORD PTR SS:[EBP-0x404]
XOR ECX, ECX
LEA ESP, DWORD PTR SS:[ESP]
MOV DL, BYTE PTR DS:[ECX+0x415D8C] //此处只能以硬编码形式保存
MOV BYTE PTR SS:[EBP+ECX-0x404], DL
INC ECX
TEST DL, DL
}
}
目前grcasm将文本默认存储至C盘，在源代码里面大家可以自己修改。
最后祝大家新年快乐！
grcasm_bin.zip
grcasm_sourcecode.zip
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
thanks
