一个简单的窗口程序如下:
int WINAPI WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance,
PSTR szCmdLine, int iCmdShow)
{
static TCHAR szAppName[] = TEXT ("chap231") ;
HWND hwnd ;
MSG msg ;
WNDCLASS wndclass ;
wndclass.style = CS_HREDRAW | CS_VREDRAW ;
wndclass.lpfnWndProc = WndProc ;
wndclass.cbClsExtra = 0 ;
wndclass.cbWndExtra = 0 ;
wndclass.hInstance = hInstance ;
wndclass.hIcon = LoadIcon (NULL, IDI_APPLICATION);
wndclass.hCursor = LoadCursor (NULL, IDC_ARROW) ;
wndclass.hbrBackground = (HBRUSH) GetStockObject (WHITE_BRUSH) ;
wndclass.lpszMenuName = NULL ;
wndclass.lpszClassName = szAppName ;
if (!RegisterClass (&wndclass))
return 0 ;
.............
return msg.wParam ;
}
对应的反汇编代码:
:00401000 83EC44 sub esp, 00000044
:00401003 56 push esi
:00401004 8B74244C mov esi, dword ptr [esp+4C]
:00401008 68007F0000 push 00007F00
:0040100D 6A00 push 00000000
:0040100F C744242803000000 mov [esp+28], 00000003
:00401017 C744242C20114000 mov [esp+2C], 00401120
:0040101F C744243000000000 mov [esp+30], 00000000
:00401027 C744243400000000 mov [esp+34], 00000000
:0040102F 89742438 mov dword ptr [esp+38], esi
* Reference To: USER32.LoadIconA, Ord:019Eh
|
:00401033 FF15B4404000 Call dword ptr [004040B4]
:00401039 68007F0000 push 00007F00
:0040103E 6A00 push 00000000
:00401040 8944243C mov dword ptr [esp+3C], eax
* Reference To: USER32.LoadCursorA, Ord:019Ah
|
:00401044 FF15B8404000 Call dword ptr [004040B8]
:0040104A 6A00 push 00000000
:0040104C 8944243C mov dword ptr [esp+3C], eax
* Reference To: GDI32.GetStockObject, Ord:015Fh
|
:00401050 FF1500404000 Call dword ptr [00404000]
:00401056 C744244000000000 mov [esp+40], 00000000
* Possible StringData Ref from Data Obj ->"chap231"
|
:0040105E C744244430504000 mov [esp+44], 00405030
:00401066 8944243C mov dword ptr [esp+3C], eax
:0040106A 8D442420 lea eax, dword ptr [esp+20] ;*****
:0040106E 50 push eax
* Reference To: USER32.RegisterClassA, Ord:01F2h
|
:0040106F FF15BC404000 Call dword ptr [004040BC]
问题如下:
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
