首页
社区
课程
招聘
文件的句柄为0代表什么意思?
发表于: 2004-9-17 22:51 6081

文件的句柄为0代表什么意思?

2004-9-17 22:51
6081
看了一段脱壳后的反汇编代码,发现文件的句柄为0。
这到底代表了什么意思啊?

00425304           push  00000000   ; 文件句柄为0
00425306           lea   eax, dword ptr [ebp-04]
00425309           push  eax
0042530A           push  0000001E
0042530C           push  0042BB84
00425311           mov   eax, dword ptr [0042BB7C]
00425316           push  eax
00425317           Call  kernel32.ReadFile
0042531C           mov   eax, dword ptr [0042BB84]
00425321           cmp   eax, 04034B50
00425326           je    00425333     --->
00425328           cmp   eax, 50000000
0042532D           je    00425333     --->
0042532F           xor   ebx, ebx    ; unpacked file会经过这里   
00425331           jmp   00425335     ---> 错误处理的流程

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!

收藏
免费 1
支持
分享
最新回复 (2)
雪    币: 339
活跃值: (1510)
能力值: ( LV13,RANK:970 )
在线值:
发帖
回帖
粉丝
2
函数问题应该查查MSDN才是啊.,你那个0,也不是文件句柄

If hFile was created with FILE_FLAG_OVERLAPPED and lpOverlapped is NULL, the function can incorrectly report that the read operation is complete.
If hFile was opened with FILE_FLAG_OVERLAPPED and lpOverlapped is not NULL, the read operation starts at the offset specified in the OVERLAPPED structure and ReadFile may return before the read operation has been completed. In this case, ReadFile returns FALSE and the GetLastError function returns ERROR_IO_PENDING. This allows the calling process to continue while the read operation finishes. The event specified in the OVERLAPPED structure is set to the signaled state upon completion of the read operation.

If hFile was not opened with FILE_FLAG_OVERLAPPED and lpOverlapped is NULL, the read operation starts at the current file position and ReadFile does not return until the operation has been completed.
If hFile is not opened with FILE_FLAG_OVERLAPPED and lpOverlapped is not NULL, the read operation starts at the offset specified in the OVERLAPPED structure. ReadFile does not return until the read operation has been completed.
2004-9-18 01:37
0
雪    币: 1540
活跃值: (2807)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
居然会把这东西看反了。

最初由 nbw 发布
函数问题应该查查MSDN才是啊.,你那个0,也不是文件句柄

If hFile was created with FILE_FLAG_OVERLAPPED and lpOverlapped is NULL, the function can incorrectly report that the read operation is complete.
If hFile was opened with FILE_FLAG_OVERLAPPED and lpOverlapped is not NULL, the read operation starts at the offset specified in the OVERLAPPED structure and ReadFile may return before the read operation has been completed. In this case, ReadFile returns FALSE and the GetLastError function returns ERROR_IO_PENDING. This allows the calling process to continue while the read operation finishes. The event specified in the OVERLAPPED structure is set to the signaled state upon completion of the read operation.

........
2004-9-18 07:58
0
游客
登录 | 注册 方可回帖
返回
//