-
-
[原创]栈回溯
-
发表于:
2015-1-3 11:49
5162
-
include 'win32ax.inc'
use32
entry start
start:
invoke getmodule,"ntdll.dll"
invoke getproc,eax,"RtlWalkFrameChain"
mov dword [walk],eax
invoke walk,fuck,100,0
mov dword[stackcount],eax
mov ecx,eax
xor edx,edx
loop_print:
;print:mov eax,dword [fuck+edx*4]
inc edx
loop loop_print
section '.data' data readable writeable
stackcount dd 00
walk dd 00
fuck db 100 dup 00
section '.idata' import data readable
library kernel,'KERNEL32.DLL'
import kernel,getmodule,'GetModuleHandleA',\
getproc,'GetProcAddress'
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
