一个DLL有4个函数。Add() Sub() Mul() Div()
00971000 >/$ 8B4424 08 MOV EAX, DWORD PTR [ESP+8]
00971004 |. 8B4C24 04 MOV ECX, DWORD PTR [ESP+4]
00971008 |. 03C1 ADD EAX, ECX
0097100A |. A3 44339700 MOV DWORD PTR [g_nResult], EAX
0097100F \. C2 0800 RETN 8
00971012 CC INT3
00971013 CC INT3
00971014 CC INT3
00971015 CC INT3
00971016 CC INT3
00971017 CC INT3
00971018 CC INT3
00971019 CC INT3
0097101A CC INT3
0097101B CC INT3
0097101C CC INT3
0097101D CC INT3
0097101E CC INT3
0097101F CC INT3
00971020 >/$ 8B4424 04 MOV EAX, DWORD PTR [ESP+4]
00971024 |. 2B4424 08 SUB EAX, DWORD PTR [ESP+8]
00971028 |. A3 44339700 MOV DWORD PTR [g_nResult], EAX
0097102D \. C2 0800 RETN 8
00971030 >/$ 8B4424 04 MOV EAX, DWORD PTR [ESP+4]
00971034 |. 0FAF4424 08 IMUL EAX, DWORD PTR [ESP+8]
00971039 |. A3 44339700 MOV DWORD PTR [g_nResult], EAX
0097103E \. C2 0800 RETN 8
00971041 CC INT3
00971042 CC INT3
00971043 CC INT3
00971044 CC INT3
00971045 CC INT3
00971046 CC INT3
00971047 CC INT3
00971048 CC INT3
00971049 CC INT3
0097104A CC INT3
0097104B CC INT3
0097104C CC INT3
0097104D CC INT3
0097104E CC INT3
0097104F CC INT3
00971050 >/$ 8B4424 04 MOV EAX, DWORD PTR [ESP+4]
00971054 |. 99 CDQ
00971055 |. F77C24 08 IDIV DWORD PTR [ESP+8]
00971059 |. A3 44339700 MOV DWORD PTR [g_nResult], EAX
0097105E \. C3 RETN
为什么要在Add()和Mul()后填那么多CC呢?
[培训]《安卓高级研修班(网课)》月薪三万计划,掌握调试、分析还原ollvm、vmp的方法,定制art虚拟机自动化脱壳的方法