-
-
[讨论]frame_dummy汇编问题
-
发表于: 2015-12-2 15:36 13670
-
.text:0000000000402CA0 frame_dummy proc near ; DATA XREF: .init_array:__frame_dummy_init_array_entryo
.text:0000000000402CA0 48 83 3D C0 55 2C 00 00 cmp cs:__JCR_LIST__, 0
.text:0000000000402CA8 74 1B jz short loc_402CC5
.text:0000000000402CAA B8 00 00 00 00 mov eax, 0
.text:0000000000402CAF 48 85 C0 test rax, rax
.text:0000000000402CB2 74 11 jz short loc_402CC5
.text:0000000000402CB4 55 push rbp
.text:0000000000402CB5 BF 68 82 6C 00 mov edi, offset __JCR_LIST__
.text:0000000000402CBA 48 89 E5 mov rbp, rsp
.text:0000000000402CBD FF D0 call rax
.text:0000000000402CBF 5D pop rbp
.text:0000000000402CC0 E9 7B FF FF FF jmp register_tm_clones
.text:0000000000402CC5 ; ---------------------------------------------------------------------------
.text:0000000000402CC5
.text:0000000000402CC5 loc_402CC5: ; CODE XREF: frame_dummy+8j
.text:0000000000402CC5 ; frame_dummy+12j
.text:0000000000402CC5 E9 76 FF FF FF jmp register_tm_clones
.text:0000000000402CC5 frame_dummy endp
上述是IDA下frame_dummy的反汇编,不理解红色的反汇编为什么是这样,为什么有两个jmp register_tm_clones,为什么不是直接jz直接条件跳转到第一个.text:0000000000402CC0 E9 7B FF FF FF jmp register_tm_clones,而却是多余了增加了一条.text:0000000000402CC5 E9 76 FF FF FF jmp register_tm_clones
或者是IDA反汇编的问题?
.text:0000000000402CA0 48 83 3D C0 55 2C 00 00 cmp cs:__JCR_LIST__, 0
.text:0000000000402CA8 74 1B jz short loc_402CC5
.text:0000000000402CAA B8 00 00 00 00 mov eax, 0
.text:0000000000402CAF 48 85 C0 test rax, rax
.text:0000000000402CB2 74 11 jz short loc_402CC5
.text:0000000000402CB4 55 push rbp
.text:0000000000402CB5 BF 68 82 6C 00 mov edi, offset __JCR_LIST__
.text:0000000000402CBA 48 89 E5 mov rbp, rsp
.text:0000000000402CBD FF D0 call rax
.text:0000000000402CBF 5D pop rbp
.text:0000000000402CC0 E9 7B FF FF FF jmp register_tm_clones
.text:0000000000402CC5 ; ---------------------------------------------------------------------------
.text:0000000000402CC5
.text:0000000000402CC5 loc_402CC5: ; CODE XREF: frame_dummy+8j
.text:0000000000402CC5 ; frame_dummy+12j
.text:0000000000402CC5 E9 76 FF FF FF jmp register_tm_clones
.text:0000000000402CC5 frame_dummy endp
上述是IDA下frame_dummy的反汇编,不理解红色的反汇编为什么是这样,为什么有两个jmp register_tm_clones,为什么不是直接jz直接条件跳转到第一个.text:0000000000402CC0 E9 7B FF FF FF jmp register_tm_clones,而却是多余了增加了一条.text:0000000000402CC5 E9 76 FF FF FF jmp register_tm_clones
或者是IDA反汇编的问题?
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
赞赏
他的文章
- [讨论]关于函数入口地址对齐问题 3982
- [求助]二进制重写后的main函数入口点问题 3921
- [讨论]frame_dummy汇编问题 13671
- [求助]linux 内核提权的问题 6772
看原图
赞赏
雪币:
留言: