-
-
未解决
[求助]如何成功的用IDA转换一小段汇编成C++
-
-
未解决 [求助]如何成功的用IDA转换一小段汇编成C++
昨天看了一篇帖子《使用ida对任意一段机器码进行反汇编》
地址是:https://blog.csdn.net/m0_37921080/article/details/83785806
我想用记事本写了一段C++代码,然后用winhex打开,选取所有保存为exe文件;
C++代码很简单,如下:
#include <iosteam.h>
using namespace std;
void main()
{
int a,b;
int c=a+b;
cout<<c<<endl;
}
对winhex的操作是正确的,如下表:
然后用IDA打开新生成的1.exe(不知道是不是要特殊的编译器比如VC++生成EXE)
转换为Code代码
创建函数
seg000:00000000 sub_10000 proc near
seg000:00000000 000 and ebp, [ecx+6Eh]
seg000:00000003 000 arpl [ebp+esi*2+64h], bp
seg000:00000007 000 and gs:[ecx+ebp*2], bh
seg000:0000000B 000 outsd
seg000:0000000C 000 jnb short near ptr 82h
seg000:0000000E db 65h
seg000:0000000E 000 popa
seg000:00000010 -20 insd
seg000:00000011 db 2Eh
seg000:00000011 -20 push 750A0D3Eh
seg000:00000017 -1C jnb short near ptr 82h
seg000:00000019 -1C outsb
seg000:0000001A -1C and [bp+61h], ch
seg000:0000001E -1C insd
seg000:0000001F db 65h
seg000:0000001F -1C jnb short near ptr 92h
seg000:00000022 -1C popa
seg000:00000023 -3C arpl [ebp+20h], sp
seg000:00000026 -3C jnb short near ptr 9Ch
seg000:00000028 -3C cmp ecx, fs:760A0D0Ah
seg000:0000002F -3C outsd
seg000:00000030 -3C imul esp, [eax+6Dh], 286E6961h
seg000:00000038 -3C sub ds:0A0D7B0Ah, ecx
seg000:0000003E -3C and [eax], ah
seg000:00000040 -3C and [ecx+6Eh], ch
seg000:00000043 -3C jz short near ptr loc_10064+1
seg000:00000045 -3C popa
seg000:00000046 -5C sub al, 62h ; 'b'
seg000:00000048 -5C cmp ecx, ds:2020200Ah
seg000:0000004E -5C imul ebp, [esi+74h], 613D6320h
seg000:00000055 -5C sub esp, [edx+3Bh]
seg000:00000058 -5C or eax, 2020200Ah
seg000:0000005D -5C arpl [edi+75h], bp
seg000:00000060 -5C jz short near ptr 9Eh
seg000:00000062 -5C cmp al, 63h ; 'c'
seg000:00000064
seg000:00000064 loc_10064: ; CODE XREF: sub_10000+43j
seg000:00000064 -5C cmp al, 3Ch ; '<'
seg000:00000066 -5C outs dx, byte ptr gs:[esi]
seg000:00000068 db 64h
seg000:00000068 -5C insb
seg000:00000068 sub_10000 endp ; sp-analysis failed
seg000:00000068
seg000:00000068 ; ---------------------------------------------------------------------------
seg000:0000006A db 3Bh ; ;
seg000:0000006B db 0Dh
seg000:0000006C db 0Ah
seg000:0000006D db 7Dh ; }
seg000:0000006D seg000 ends
seg000:0000006D
seg000:0000006D
seg000:0000006D end
然后按F5
但是出现了问题,提示:
Default calling convention is not set, decompilation may be incorrect!
FFFFFFFF: positive sp value has been found
网上查阅的资料,好像是堆栈不平衡,但是我看这段代码,只在
seg000:00000010 -20 insd
seg000:00000011 db 2Eh
seg000:00000011 -20 push 750A0D3Eh
这里传入了参数,由于对逆向的涉入不深,我尝试全改为如下形式,达到堆栈的类似平衡:
seg000:00000000 sub_10000 proc near
seg000:00000000 000 and ebp, [ecx+6Eh]
seg000:00000003 000 arpl [ebp+esi*2+64h], bp
seg000:00000007 000 and gs:[ecx+ebp*2], bh
seg000:0000000B 000 outsd
seg000:0000000C 000 jnb short near ptr 82h
seg000:0000000E db 65h
seg000:0000000E 000 popa
seg000:00000010 000 insd
seg000:00000011 db 2Eh
seg000:00000011 000 push 750A0D3Eh
seg000:00000017 020 jnb short near ptr 82h
seg000:00000019 020 outsb
seg000:0000001A 020 and [bp+61h], ch
seg000:0000001E 020 insd
seg000:0000001F db 65h
seg000:0000001F 020 jnb short near ptr 92h
seg000:00000022 020 popa
seg000:00000023 000 arpl [ebp+20h], sp
seg000:00000026 020 jnb short near ptr 9Ch
seg000:00000028 020 cmp ecx, fs:760A0D0Ah
seg000:0000002F 020 outsd
seg000:00000030 020 imul esp, [eax+6Dh], 286E6961h
seg000:00000038 020 sub ds:0A0D7B0Ah, ecx
seg000:0000003E 020 and [eax], ah
seg000:00000040 020 and [ecx+6Eh], ch
seg000:00000043 020 jz short near ptr loc_10064+1
seg000:00000045 020 popa
seg000:00000046 020 sub al, 62h ; 'b'
seg000:00000048 000 cmp ecx, ds:2020200Ah
seg000:0000004E 000 imul ebp, [esi+74h], 613D6320h
seg000:00000055 000 sub esp, [edx+3Bh]
seg000:00000058 000 or eax, 2020200Ah
seg000:0000005D 000 arpl [edi+75h], bp
seg000:00000060 000 jz short near ptr 9Eh
seg000:00000062 000 cmp al, 63h ; 'c'
seg000:00000064
seg000:00000064 loc_10064: ; CODE XREF: sub_10000+43j
seg000:00000064 000 cmp al, 3Ch ; '<'
seg000:00000066 000 outs dx, byte ptr gs:[esi]
seg000:00000068 db 64h
seg000:00000068 000 insb
seg000:00000068 sub_10000 endp ; sp-analysis failed
seg000:00000068
seg000:00000068 ; ---------------------------------------------------------------------------
seg000:0000006A unk_1006A db 3Bh ; ;
seg000:0000006B db 0Dh
seg000:0000006C db 0Ah
seg000:0000006D db 7Dh ; }
seg000:0000006D seg000 ends
seg000:0000006D
seg000:0000006D
seg000:0000006D end
目的是达到了F5自动转换为C++代码,但是代码是这样的:
void __usercall sub_10000(int a1<ecx>, char a2<bh>, int a3<ebp>, int _ESI<esi>, __int16 a5, __int16 a6, int a7, int a8, __int16 a9, int a10, int a11)
{
int v16; // ecx@1
int v17; // ebp@1
int v19; // ST08_4@1
int v20; // ST14_4@1
int v23; // ST00_4@1
unsigned __int8 v24; // zf@1
__int16 v28; // ST04_2@2
int v29; // ST18_4@2
_EBP = *(_DWORD *)(a1 + 110) & a3;
__asm { arpl [ebp+esi*2+64h], bp }
*MK_FP(__GS__, a1 + 2 * _EBP) = a2 & *MK_FP(__GS__, a1 + 2 * _EBP);
__asm { outsd }
_DX = a5;
_ESI = a11;
__asm
{
insd
outsb
}
*(_BYTE _ss *)(a9 + 97) &= HIBYTE(a6);
__asm { insd }
v16 = v19;
v17 = v20;
_ESI = 1963593022;
__asm { arpl [ebp+20h], sp }
*(_WORD *)(v17 + 32) = _T0;
__asm { outsd }
va0d7b0a -= v16;
*(_BYTE *)v23 &= BYTE1(v23);
v24 = (BYTE1(v16) & *(_BYTE *)(v19 + 110)) == 0;
*(_BYTE *)(v16 + 110) &= BYTE1(v16);
JUMPOUT(v24, *(unsigned int *)((char *)&loc_10064 + 1));
_DX = v28;
_EDI = v29;
_ESI = 1963593022;
_BP = 25376 * v750a0db2;
__asm
{
arpl [edi+75h], bp
outs dx, byte ptr gs:[esi]
insb
}
JUMPOUT(unk_1006A);
}
完全不是本来的样子,所以这里问问大家,如何达到类似源码的效果,谢谢大伙了,端午快乐!
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)
最后于 2019-6-9 15:08
被小木鱼编辑
,原因: