0088BA36 8BF2 mov esi, edx ; 52pojie.00870000
0088BA38 2B71 10 sub esi, dword ptr [ecx+10]
0088BA3B 74 7A je short 0088BAB7
0088BA3D 8971 10 mov dword ptr [ecx+10], esi
0088BA40 8DB5 55FDFFFF lea esi, dword ptr [ebp-2AB]
0088BA46 8B36 mov esi, dword ptr [esi]
0088BA48 8D5E FC lea ebx, dword ptr [esi-4]
0088BA4B 8B01 mov eax, dword ptr [ecx]
0088BA4D 83F8 01 cmp eax, 1
0088BA50 74 0A je short 0088BA5C
0088BA52 8BFA mov edi, edx //基址赋于edi
0088BA54 0379 08 add edi, dword ptr [ecx+8]
0088BA57 8B49 10 mov ecx, dword ptr [ecx+10]
0088BA5A EB 08 jmp short 0088BA64
edx=00870000 (52pojie.00870000), ASCII "MZP"
esi=0088A0FB (52pojie.0088A0FB)
第一问怎样知道edx是基址的？
0088BA66 8A07 mov al, byte ptr [edi] //重定位开始
0088BA68 47 inc edi
0088BA69 0BC0 or eax, eax
0088BA6B 74 20 je short 0088BA8D
0088BA6D 3C EF cmp al, 0EF
0088BA6F 77 06 ja short 0088BA77
0088BA71 03D8 add ebx, eax
0088BA73 010B add dword ptr [ebx], ecx
0088BA75 ^ EB ED jmp short 0088BA64
0088BA77 24 0F and al, 0F
0088BA79 C1E0 10 shl eax, 10
edi=00886000是重定位开始
2.怎样判断edi=00886000是重定位开始呢？
00886000
0088BA8D 33DB xor ebx, ebx //重定位结束
0088BA8F 87FE xchg esi, edi
0088BA91 8B06 mov eax, dword ptr [esi]
0088BA93 83F8 00 cmp eax, 0
0088BA96 74 1F je short 0088BAB7
0088BA98 AD lods dword ptr [esi]
0088BA99 0BC0 or eax, eax
0088BA9B 74 08 je short 0088BAA5
0088BA9D 03D8 add ebx, eax
0088BA9F 66:010C1F add word ptr [edi+ebx], cx
0088BAA3 ^ EB F3 jmp short 0088BA98
32.怎样判断edi=00886B57是重定位结束呢？
请高手指点一下。谢谢！
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
