首页
社区
课程
招聘
[旧帖] [己解决]关于CCDebuger大哥《OllyDBG 入门系列(七)汇编功能》有些不懂的地方 0.00雪花
发表于: 2008-5-15 11:02 4537

[旧帖] [己解决]关于CCDebuger大哥《OllyDBG 入门系列(七)汇编功能》有些不懂的地方 0.00雪花

2008-5-15 11:02
4537
新手请各位别见笑

原文如下:

CreateFontIndirect的返回值就是字体的句柄。
对于这个函数我们需要的参数就是给它一个 LOGFONT 的字体结构指针,我们只要在要修改程序的空白处建一个标准的9号(小五)宋体的 LOGFONT 字体结构,再把指针给 CreateFontIndirectA 就可以了。

SendMessageA:

LRESULT SendMessage(
HWND hWnd, // handle of destination window
UINT Msg, // message to send
WPARAM wParam, // first message parameter
LPARAM lParam // second message parameter
);
上面的第一个参数是窗口句柄,我们知道 CreateWindowExA 返回的就是窗口句柄,我们可以直接拿来用。第二个消息参数我们这里是设置字体,选WM_SETFONT,这个值是 30H。第三个参数是字体句柄,可以由上面的 CreateFontIndirectA 获得。第四个参数我们不需要,留空。现在我们准备开始写代码,首先我们要在程序中建一个标准9号宋体的 LOGFONT,以便于我们调用。对于 LOGFONT,我们再来看一下定义:

typedef struct tagLOGFONT { // lf
LONG lfHeight;
LONG lfWidth;
LONG lfEscapement;
LONG lfOrientation;
LONG lfWeight;
BYTE lfItalic;
BYTE lfUnderline;
BYTE lfStrikeOut;
BYTE lfCharSet;
BYTE lfOutPrecision;
BYTE lfClipPrecision;
BYTE lfQuality;
BYTE lfPitchAndFamily;
TCHAR lfFaceName[LF_FACESIZE];
} LOGFONT;

这样我们的标准9号宋体的 LOGFONT 值应该是32字节16进制就像这样:F4FFFFFF000000000000000000000000900100000000008600000000CBCECCE5

不懂的地方以用红色勾出
1.为什么这个值是 30H,怎么得到的?

2.LOGFONT 值应该是32字节,怎么算出来的,“TCHAR lfFaceName[LF_FACESIZE];” 中的LF_FACESIZE又是怎么知道的?

3.最不明白的就是16进制就像这样:F4FFFFFF000000000000000000000000900100000000008600000000CBCECCE5是怎么算出来的?

从论坛上找一找,没的找到相关的问题,所出发此贴,还请各位多多理解菜鸟们的无知

[课程]Android-CTF解题方法汇总!

收藏
免费 0
支持
分享
最新回复 (3)
雪    币: 2384
活跃值: (766)
能力值: (RANK:410 )
在线值:
发帖
回帖
粉丝
2
1、在Windows开发中,微软为开发者提供的SDK开发包中定义者各种各种的类型ID值应用在不同的地方,这些ID值一般都可以在微软的SDK开发包文档中搜索到。其中SDK开发包中定义了各种消息的ID值,而30h的消息ID值被定义为WM_SETFONT的消息ID,就目前来说,这个消息ID值代表WM_SETFONT消息在所有的微软SDK编程中是固定的(除非以后微软变更消息ID值)。

2、LOGFONT结构在微软的SDK开发包中也有定义,他的大小由结构成员类型和多少来计算(不过,这个CC兄貌似说错了大小,LOGFONT结构的大小应该是60个字节大小)。如下面是SDK开发包中的LOGFONT结构的定义
typedef struct tagLOGFONT { // lf  
   LONG lfHeight;           // 0
   LONG lfWidth;            // 4
   LONG lfEscapement;  // 8
   LONG lfOrientation;   // 12
   LONG lfWeight;         // 16
   BYTE lfItalic;             // 20
   BYTE lfUnderline;       // 21
   BYTE lfStrikeOut;       // 22
   BYTE lfCharSet;         // 23
   BYTE lfOutPrecision; // 24
   BYTE lfClipPrecision;  // 25
   BYTE lfQuality;           // 26
   BYTE lfPitchAndFamily; // 27
   TCHAR lfFaceName[LF_FACESIZE];   // 28 + LF_FACESIZE(32) = 60个字节大小(LF_FACESIZE被微软SDK开发包中定义为32大小)
} LOGFONT;

第三、这个是编程中用来填充LOGFONT结构中的数据,这些数据值在SDK开发包中也有定义,你上面的数据转成编程就是代表下面的属性值。
F4FFFFFF       lfHeight
00000000     lfWidth
00000000     lfEscapement
00000000     lfOrientation
90010000     lfWeight
00                 lfItalic
00                 lfUnderline
00                 lfStrikeOut
86                 lfCharSet
00                 lfOutPrecision
00                 lfClipPrecision
00                 lfQuality
00                 lfPitchAndFamily
CB CE CC E5 lfFaceName    (这个ASCII码是'宋体'字符的ASCII码,也就是说在这个结构中使用宋体字体)


// 最后,下面提供微软SDK开发包对LOGFONT结构每个成员的属性说明,前面的数据都是根据微软SDK开发包说明的属性进行填充的。

The LOGFONT structure defines the attributes of a font.

typedef struct tagLOGFONT { // lf  
   LONG lfHeight;
   LONG lfWidth;
   LONG lfEscapement;
   LONG lfOrientation;
   LONG lfWeight;
   BYTE lfItalic;
   BYTE lfUnderline;
   BYTE lfStrikeOut;
   BYTE lfCharSet;
   BYTE lfOutPrecision;
   BYTE lfClipPrecision;
   BYTE lfQuality;
   BYTE lfPitchAndFamily;
   TCHAR lfFaceName[LF_FACESIZE];
} LOGFONT;

Members

lfHeight

Specifies the height, in logical units, of the font's character cell or character. The character height value (also known as the em height) is the character cell height value minus the internal-leading value. The font mapper interprets the value specified in lfHeight in the following manner:

Value        Meaning
> 0        The font mapper transforms this value into device units and matches it against the cell height of the available fonts.
0        The font mapper uses a default height value when it searches for a match.
< 0        The font mapper transforms this value into device units and matches its absolute value against the character height of the available fonts.

For all height comparisons, the font mapper looks for the largest font that does not exceed the requested size.
This mapping occurs when the font is used for the first time.
For the MM_TEXT mapping mode, you can use the following formula to specify a height for a font with a given point size:

lfHeight = -MulDiv(PointSize, GetDeviceCaps(hDC, LOGPIXELSY), 72);
  

lfWidth

Specifies the average width, in logical units, of characters in the font. If lfWidth is zero, the aspect ratio of the device is matched against the digitization aspect ratio of the available fonts to find the closest match, determined by the absolute value of the difference.

lfEscapement

Specifies the angle, in tenths of degrees, between the escapement vector and the x-axis of the device. The escapement vector is parallel to the base line of a row of text.

Windows NT:

When the graphics mode is set to GM_ADVANCED, you can specify the escapement angle of the string independently of the orientation angle of the string's characters.
When the graphics mode is set to GM_COMPATIBLE, lfEscapement specifies both the escapement and orientation. You should set lfEscapement and lfOrientation to the same value.

Windows 95:

The lfEscapement member specifies both the escapement and orientation. You should set lfEscapement and lfOrientation to the same value.

lfOrientation

Specifies the angle, in tenths of degrees, between each character's base line and the x-axis of the device.

lfWeight

Specifies the weight of the font in the range 0 through 1000. For example, 400 is normal and 700 is bold. If this value is zero, a default weight is used.
The following values are defined for convenience:

Value        Weight
FW_DONTCARE        0
FW_THIN        100
FW_EXTRALIGHT        200
FW_ULTRALIGHT        200
FW_LIGHT        300
FW_NORMAL        400
FW_REGULAR        400
FW_MEDIUM        500
FW_SEMIBOLD        600
FW_DEMIBOLD        600
FW_BOLD        700
FW_EXTRABOLD        800
FW_ULTRABOLD        800
FW_HEAVY        900
FW_BLACK        900

lfItalic

Specifies an italic font if set to TRUE.

lfUnderline

Specifies an underlined font if set to TRUE.

lfStrikeOut

Specifies a strikeout font if set to TRUE.

lfCharSet

Specifies the character set. The following values are predefined:

ANSI_CHARSET
DEFAULT_CHARSET
SYMBOL_CHARSET
SHIFTJIS_CHARSET
GB2312_CHARSET
HANGEUL_CHARSET
CHINESEBIG5_CHARSET
OEM_CHARSET

Windows 95 only:

JOHAB_CHARSET
HEBREW_CHARSET
ARABIC_CHARSET
GREEK_CHARSET
TURKISH_CHARSET
THAI_CHARSET
EASTEUROPE_CHARSET
RUSSIAN_CHARSET
MAC_CHARSET
BALTIC_CHARSET

The OEM_CHARSET value specifies a character set that is operating-system dependent.
You can use the DEFAULT_CHARSET value to allow the name and size of a font to fully describe the logical font. If the specified font name does not exist, a font from any character set can be substituted for the specified font, so you should use DEFAULT_CHARSET sparingly to avoid unexpected results.
Fonts with other character sets may exist in the operating system. If an application uses a font with an unknown character set, it should not attempt to translate or interpret strings that are rendered with that font.

This parameter is important in the font mapping process. To ensure consistent results, specify a specific character set. If you specify a typeface name in the lfFaceName member, make sure that the lfCharSet value matches the character set of the typeface specified in lfFaceName.

lfOutPrecision

Specifies the output precision. The output precision defines how closely the output must match the requested font's height, width, character orientation, escapement, pitch, and font type. It can be one of the following values:

Value        Meaning
OUT_CHARACTER_PRECIS        Not used.
OUT_DEFAULT_PRECIS        Specifies the default font mapper behavior.
OUT_DEVICE_PRECIS        Instructs the font mapper to choose a Device font when the system contains multiple fonts with the same name.
OUT_OUTLINE_PRECIS        Windows NT: This value instructs the font mapper to choose from TrueType and other outline-based fonts.Windows 95: This value is not used.
OUT_RASTER_PRECIS        Instructs the font mapper to choose a raster font when the system contains multiple fonts with the same name.
OUT_STRING_PRECIS        This value is not used by the font mapper, but it is returned when raster fonts are enumerated.
OUT_STROKE_PRECIS        Windows NT: This value is not used by the font mapper, but it is returned when TrueType, other outline-based fonts, and vector fonts are enumerated. Windows 95: This value is used to map vector fonts, and is returned when TrueType or vector fonts are enumerated.
OUT_TT_ONLY_PRECIS        Instructs the font mapper to choose from only TrueType fonts. If there are no TrueType fonts installed in the system, the font mapper returns to default behavior.
OUT_TT_PRECIS        Instructs the font mapper to choose a TrueType font when the system contains multiple fonts with the same name.

Applications can use the OUT_DEVICE_PRECIS, OUT_RASTER_PRECIS, and OUT_TT_PRECIS values to control how the font mapper chooses a font when the operating system contains more than one font with a given name. For example, if an operating system contains a font named Symbol in raster and TrueType form, specifying OUT_TT_PRECIS forces the font mapper to choose the TrueType version. Specifying OUT_TT_ONLY_PRECIS forces the font mapper to choose a TrueType font, even if it must substitute a TrueType font of another name.

lfClipPrecision

Specifies the clipping precision. The clipping precision defines how to clip characters that are partially outside the clipping region. It can be one or more of the following values:

Value        Meaning
CLIP_DEFAULT_PRECIS        Specifies default clipping behavior.
CLIP_CHARACTER_PRECIS        Not used.
CLIP_STROKE_PRECIS        Not used by the font mapper, but is returned when raster, vector, or TrueType fonts are enumerated.Windows NT: For compatibility, this value is always returned when enumerating fonts.
CLIP_MASK        Not used.
CLIP_EMBEDDED        You must specify this flag to use an embedded read-only font.
CLIP_LH_ANGLES        When this value is used, the rotation for all fonts depends on whether the orientation of the coordinate system is left-handed or right-handed. If not used, device fonts always rotate counterclockwise, but the rotation of other fonts is dependent on the orientation of the coordinate system.For more information about the orientation of coordinate systems, see the description of the nOrientation parameter
CLIP_TT_ALWAYS        Not used.

lfQuality

Specifies the output quality. The output quality defines how carefully the graphics device interface (GDI) must attempt to match the logical-font attributes to those of an actual physical font. It can be one of the following values:

Value        Meaning
DEFAULT_QUALITY        Appearance of the font does not matter.
DRAFT_QUALITY        Appearance of the font is less important than when PROOF_QUALITY is used. For GDI raster fonts, scaling is enabled, which means that more font sizes are available, but the quality may be lower. Bold, italic, underline, and strikeout fonts are synthesized if necessary.
PROOF_QUALITY        Character quality of the font is more important than exact matching of the logical-font attributes. For GDI raster fonts, scaling is disabled and the font closest in size is chosen. Although the chosen font size may not be mapped exactly when PROOF_QUALITY is used, the quality of the font is high and there is no distortion of appearance. Bold, italic, underline, and strikeout fonts are synthesized if necessary.

lfPitchAndFamily

Specifies the pitch and family of the font. The two low-order bits specify the pitch of the font and can be one of the following values:

DEFAULT_PITCH
FIXED_PITCH
VARIABLE_PITCH
Bits 4 through 7 of the member specify the font family and can be one of the following values:
FF_DECORATIVE
FF_DONTCARE
FF_MODERN
FF_ROMAN
FF_SCRIPT
FF_SWISS
The proper value can be obtained by using the Boolean OR operator to join one pitch constant with one family constant.

Font families describe the look of a font in a general way. They are intended for specifying fonts when the exact typeface desired is not available. The values for font families are as follows:

Value        Meaning
FF_DECORATIVE        Novelty fonts. Old English is an example.
FF_DONTCARE        Don't care or don't know.
FF_MODERN        Fonts with constant stroke width (monospace), with or without serifs. Monospace fonts are usually modern. Pica, Elite, and CourierNew?are examples.
FF_ROMAN        Fonts with variable stroke width (proportional) and with serifs. MS?Serif is an example.
FF_SCRIPT        Fonts designed to look like handwriting. Script and Cursive are examples.
FF_SWISS        Fonts with variable stroke width (proportional) and without serifs. MS?Sans Serif is an example.

lfFaceName

A null-terminated string that specifies the typeface name of the font. The length of this string must not exceed 32 characters, including the null terminator. The EnumFontFamilies function can be used to enumerate the typeface names of all currently available fonts. If lfFaceName is an empty string, GDI uses the first font that matches the other specified attributes.
2008-5-15 11:58
0
雪    币: 350
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
俺也跟着看明白了.谢谢版主的详细解答.
2008-5-15 14:19
0
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
4
感谢版主提供的详细资料,辛苦了。

问题已解决。
2008-5-15 14:32
0
游客
登录 | 注册 方可回帖
返回
//