0055E14B |. 50 push eax
0055E14C |. 8B4424 08 mov eax, dword ptr [esp+8]
0055E150 |. 52 push edx
0055E151 |. 50 push eax
0055E152 |. 6A 00 push 0
0055E154 |. 51 push ecx
0055E155 |. E8 56BCFDFF call 00539DB0
上面那段代码是在函数外的,在函数外的时候,共push了5个值入栈,然后进了00539db0后,却没有看到pop的代码,那00539db0是不是就没有使用这些参数啊?还是通过别的方式来使用啊?????下面是00539DB0的代码.
00539DB0 /$ E8 1B2DF7FF call 004ACAD0
00539DB5 |. 85C0 test eax, eax
00539DB7 |. 0F84 92000000 je 00539E4F
00539DBD |. 56 push esi
00539DBE |. E8 BD1FFFFF call 0052BD80
00539DC3 |. 8B5424 08 mov edx, dword ptr [esp+8]
00539DC7 |. 8B35 FC235F00 mov esi, dword ptr [<&USER32.GetKeyState>] ; USER32.GetKeyState
00539DCD |. 33C9 xor ecx, ecx
00539DCF |. 3BD0 cmp edx, eax
00539DD1 |. 8B5424 0C mov edx, dword ptr [esp+C]
00539DD5 |. 8B4424 10 mov eax, dword ptr [esp+10]
00539DD9 |. 0F94C1 sete cl
00539DDC |. 8915 50046800 mov dword ptr [680450], edx
00539DE2 |. 8B5424 18 mov edx, dword ptr [esp+18]
00539DE6 |. 6A 11 push 11 ; /Key = VK_CONTROL
00539DE8 |. A3 54046800 mov dword ptr [680454], eax ; |
00539DED |. 8915 5C046800 mov dword ptr [68045C], edx ; |
00539DF3 |. C705 60046800>mov dword ptr [680460], 11 ; |
00539DFD |. 890D 4C046800 mov dword ptr [68044C], ecx ; |
00539E03 |. 8B4C24 18 mov ecx, dword ptr [esp+18] ; |
00539E07 |. 890D 58046800 mov dword ptr [680458], ecx ; |
00539E0D |. FFD6 call esi ; \GetKeyState
00539E0F |. 6A 10 push 10 ; /Key = VK_SHIFT
00539E11 |. 66:A3 6404680>mov word ptr [680464], ax ; |
00539E17 |. C705 68046800>mov dword ptr [680468], 10 ; |
00539E21 |. FFD6 call esi ; \GetKeyState
00539E23 |. 6A 12 push 12 ; /Key = VK_MENU
00539E25 |. 66:A3 6C04680>mov word ptr [68046C], ax ; |
00539E2B |. C705 70046800>mov dword ptr [680470], 12 ; |
00539E35 |. FFD6 call esi ; \GetKeyState
00539E37 |. 68 4C046800 push 0068044C
00539E3C |. 66:A3 7404680>mov word ptr [680474], ax
00539E42 |. E8 F9FEFFFF call 00539D40
00539E47 |. 8BC8 mov ecx, eax
00539E49 |. E8 A2F4FFFF call 005392F0
00539E4E |. 5E pop esi
00539E4F \> C3 retn
[课程]Linux pwn 探索篇！
