问题如下:
1、为什么我的od里未知命令是???,我看别人上传的图片是汇编代码,该怎么设置呢
2、运行到jmp far ecx ,ecx值为1时就跑不下去了,该怎么弄
还有就是用od附加正在运行的程序,就所有的进程都挂起了,用ce时,程序就报错关闭了,用金山游侠3就可以搜索内存
补充: peid差出来是 Microsoft Visual C++ 6.0 DLL [Debug]
调试时的代码
10002263 . /E9 81050000 jmp DataLink.100027E9
10002268 > |C745 FC FFFFF>mov dword ptr [ebp-4], -1
1000226F > |68 9F220010 push DataLink.1000229F
10002274 . |64:FF35 00000>push dword ptr fs:[0]
1000227B . |EB 10 jmp short DataLink.1000228D
1000227D |E9 db E9
1000227E |64:8925 00000>mov dword ptr fs:[0], esp
10002285 |FFFF ??? ; 未知命令//这边不能调试了
10002287 . |E9 68020000 jmp DataLink.100024F4
1000228C |E9 db E9
1000228D > |B8 00000000 mov eax, 0
10002292 . |8D05 42250010 lea eax, dword ptr [10002542]
10002298 . |894424 04 mov dword ptr [esp+4], eax
1000229C .^|EB E0 jmp short DataLink.1000227E
1000229E |E9 db E9
dll里看见的的代码
0000227B EB 10 jmp short 0000228D
0000227D - E9 64892500 jmp 0025ABE6
00002282 0000 add byte ptr [eax], al
00002284 00FF add bh, bh
00002286 FFE9 jmp far ecx //ecx 值:1
00002288 68 020000E9 push E9000002
0000228D B8 00000000 mov eax, 0
00002292 8D05 42250010 lea eax, dword ptr [10002542]
00002298 894424 04 mov dword ptr [esp+4], eax
0000229C ^ EB E0 jmp short 0000227E
0000229E - E9 817D0C00 jmp 000CA024
寄存器的值
EAX 02772542 DataLink.02772542
ECX 00000001
EDX 00000A28
EBX 00000000
ESP 0013F83C
EBP 0013FA08
ESI 01B704B7 Thing.01B704B7
EDI 0013FB28
EIP 02772285 DataLink.02772285
C 0 ES 0023 32位 0(FFFFFFFF)
P 1 CS 001B 32位 0(FFFFFFFF)
A 0 SS 0023 32位 0(FFFFFFFF)
Z 1 DS 0023 32位 0(FFFFFFFF)
S 0 FS 003B 32位 7FFDF000(FFF)
T 0 GS 0000 NULL
D 0
O 0 LastErr ERROR_SUCCESS (00000000)
EFL 00210246 (NO,NB,E,BE,NS,PE,GE,LE)
ST0 empty -??? FFFF 228622A6 22E72B07
ST1 empty -??? FFFF 00000000 00000000
ST2 empty -NAN FFFF FFFFFFFF FFFFFFFF
ST3 empty -??? FFFF 00000000 00000000
ST4 empty -??? FFFF 00000000 00000000
ST5 empty 34222.000000000000000
ST6 empty 39424.289872553199530
ST7 empty 35.376315556734766690
3 2 1 0 E S P U O Z D I
FST 0120 Cond 0 0 0 1 Err 0 0 1 0 0 0 0 0 (LT)
FCW 027F Prec NEAR,53 掩码 1 1 1 1 1 1
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课