如果在控制台下编写一个简单的程序，使用IDA很容易就可以将其反汇编出来。且结构清晰,很容易就可还原成C++代码.
如
#include "stdafx.h"
int main(int argc, char* argv[])
{
printf("Hello World!\n");
int a,b;
a= 0;b=0;
for(int i=0;i<8;i++)
{
a = i;
b = b + a;
}
char charb[255];
sprintf(charb,"b = %d\n",b);
printf(charb);
printf("Hello World End!\n");
return 0;
}
; Segment type: Pure code
; Segment permissions: Read/Execute
_text segment para public 'CODE' use32
assume cs:_text
;org 401000h
assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing
; int __cdecl main(int argc,const char **argv,const char *envp)
_main proc near
var_100= byte ptr -100h
argc= dword ptr 4
argv= dword ptr 8
envp= dword ptr 0Ch
sub esp, 100h
push offset s_HelloWorld ; "Hello World!\n"
call _printf
add esp, 4
xor ecx, ecx
xor eax, eax
loc_401017:
add ecx, eax
inc eax
cmp eax, 8
jl short loc_401017
push ecx
lea eax, [esp+104h+var_100]
push offset s_BD ; "b = %d\n"
push eax ; char *
call _sprintf
add esp, 0Ch
lea ecx, [esp+100h+var_100]
push ecx ; char *
call _printf
add esp, 4
push offset s_HelloWorldEnd ; "Hello World End!\n"
call _printf
xor eax, eax
add esp, 104h
retn
_main endp
但如果这个程序是包含有类的，则IDA好像无能为力。现在C++程序，99%皆是用类来编写，如何反汇编它们呢？
如：
#include "stdafx.h"
int testfun(int a)
{
int test = a;
test++;
return test;
}
class A{
public:
A(int a,int b){m_a = a;m_b = b;}
int Geta()const{return m_a;}
int Getb()const{return m_b;}
int funadd()
{
return (m_a + m_b);
}
int funsub()
{
return (m_a - m_b);
}
private :
int m_a;
int m_b;
};
int main(int argc, char* argv[])
{
printf("Hello World!\n");
int bb = testfun(3);
char buf[255];
sprintf(buf,"%d\n",bb);
printf(buf);
int a,b,ad,sub;
A samA(15,3);
a = samA.Geta();
b = samA.Getb();
ad = samA.funadd();
sub = samA.funsub();
sprintf(buf,"a= %d,b=%d,add=%d,sub=%d \n",a,b,ad,sub);
printf(buf);
printf("Hello World End\n");
return 0;
}
反汇编后成了如下形式，任何有关类的迹象都找不到，用OD也是，只有在VC环境下进入debug跟踪才能看到类中各函数的地址。不知道各位高手是如何跟踪到类中的？
; int __cdecl main(int argc,const char **argv,const char *envp)
_main proc near
var_100= byte ptr -100h
argc= dword ptr 4
argv= dword ptr 8
envp= dword ptr 0Ch
sub esp, 100h
push offset s_HelloWorld ; "Hello World!\n"
call _printf
push 3
call sub_401000
add esp, 8
push eax
lea eax, [esp+104h+var_100]
push offset s_D ; "%d\n"
push eax ; char *
call _sprintf
add esp, 0Ch
lea ecx, [esp+100h+var_100]
push ecx ; char *
call _printf
add esp, 4
lea edx, [esp+100h+var_100]
push 0Ch
push 12h
push 3
push 0Fh
push offset s_ADBDAddDSubD ; "a= %d,b=%d,add=%d,sub=%d \n"
push edx ; char *
call _sprintf
add esp, 18h
lea eax, [esp+100h+var_100]
push eax ; char *
call _printf
add esp, 4
push offset s_HelloWorldEnd ; "Hello World End\n"
call _printf
xor eax, eax
add esp, 104h
retn
_main endp
如上所示,直接就成了
push 0Ch
push 12h
push 3
push 0Fh,找不到更多的有用信息.
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
