反汇编代码如下
* Referenced by a CALL at Addresses:
|:004F330A , :004F3393 , :004F64D5 , :004F769E , :004F7D48
|:004F7DCD
|
:004D3B70 56 push esi
:004D3B71 8B742408 mov esi, dword ptr [esp+08]
:004D3B75 85F6 test esi, esi
:004D3B77 0F8C9B000000 jl 004D3C18
:004D3B7D 83FE04 cmp esi, 00000004
:004D3B80 0F8D92000000 jnl 004D3C18
:004D3B86 8B8CB148030000 mov ecx, dword ptr [ecx+4*esi+00000348]
:004D3B8D 85C9 test ecx, ecx
:004D3B8F 0F8483000000 je 004D3C18
:004D3B95 53 push ebx
:004D3B96 8B5C2410 mov ebx, dword ptr [esp+10]
:004D3B9A 53 push ebx
:004D3B9B E8F034FCFF call 00497090
:004D3BA0 A1F8727F00 mov eax, dword ptr [007F72F8]
:004D3BA5 85C0 test eax, eax
:004D3BA7 746E je 004D3C17
:004D3BA9 83FE03 cmp esi, 00000003
:004D3BAC 7534 jne 004D3BE2
:004D3BAE 84DB test bl, bl
:004D3BB0 B8E8F85400 mov eax, 0054F8E8
:004D3BB5 7505 jne 004D3BBC
:004D3BB7 B8D8F85400 mov eax, 0054F8D8
这句的ESP值用程序怎样取得
:004D3B71 8B742408 mov esi, dword ptr [esp+08]
而 dword ptr [esp+08] 的值又该是多少?
凡是调用ESP的地方都弄不明白,是从哪来儿来的数据,堆栈的大小,地址都不知道怎样来的,知道的详细说一下,谢谢
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)