就是截入后,如何分析他其中所表示的含义?如何区判断..
为什么同样一个汇编语言,为什么在不同地方表示的含义不一样,如何去进行分析?
举个例子
004048E4 55 PUSH EBP
004048E5 8BEC MOV EBP,ESP
004048E7 53 PUSH EBX ; WLAM.005AD764
004048E8 56 PUSH ESI
004048E9 57 PUSH EDI
004048EA A1 40265B00 MOV EAX,DWORD PTR DS:[5B2640]
004048EF 85C0 TEST EAX,EAX
004048F1 74 4B JE SHORT WLAM.0040493E
004048F3 8B30 MOV ESI,DWORD PTR DS:[EAX]
004048F5 33DB XOR EBX,EBX
004048F7 8B78 04 MOV EDI,DWORD PTR DS:[EAX+4]
004048FA 33D2 XOR EDX,EDX
004048FC 55 PUSH EBP
004048FD 68 2A494000 PUSH WLAM.0040492A
00404902 64:FF32 PUSH DWORD PTR FS:[EDX]
00404905 64:8922 MOV DWORD PTR FS:[EDX],ESP
00404908 3BF3 CMP ESI,EBX
0040490A 7E 14 JLE SHORT WLAM.00404920
0040490C 8B04DF MOV EAX,DWORD PTR DS:[EDI+EBX*8]
0040490F 43 INC EBX
00404910 891D 44265B00 MOV DWORD PTR DS:[5B2644],EBX
00404916 85C0 TEST EAX,EAX
00404918 74 02 JE SHORT WLAM.0040491C
0040491A FFD0 CALL EAX
0040491C 3BF3 CMP ESI,EBX
0040491E ^ 7F EC JG SHORT WLAM.0040490C
00404920 33C0 XOR EAX,EAX
00404922 5A POP EDX
00404923 59 POP ECX
00404924 59 POP ECX
00404925 64:8910 MOV DWORD PTR FS:[EAX],EDX
00404928 EB 14 JMP SHORT WLAM.0040493E
0040492A ^ E9 59F9FFFF JMP WLAM.00404288
0040492F E8 50FFFFFF CALL WLAM.00404884
00404934 E8 27FDFFFF CALL WLAM.00404660
00404939 E8 76FDFFFF CALL WLAM.004046B4
0040493E 5F POP EDI
0040493F 5E POP ESI
00404940 5B POP EBX
00404941 5D POP EBP
00404942 C3 RETN
这断代码,分别表示的是什么含义.另外想问下,如何进行一个文件的整个工作流程那?谢谢
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!