-
-
[已经解决]OD反汇编引擎 立即数的解释问题
-
发表于: 2008-11-8 12:23 4769
-
int Assemble(char *cmd,ulong ip,t_asmmodel *model,int attempt,int constsize,char *errtext);
Parameters:
cmd - pointer to zero terminated ASCII command;
pi - address of the first byte of generated binary command in memory;
model - pointer to the structure that receives machine code and mask, see detailed description below;
attempt - index of alternative encoding of the command. Call Assemble with attempt=0,1,2... to obtain all possible versions of the command. Stop this sequence when Assemble reports error;
constsize - requested size of address constant and immediate data. Call Assemble with constsize=0,1,2,3 to obtain all possible encodings of the version selected by attempt;
errtext - pointer to text buffer of length at least TEXTLEN bytes that receives description of detected error.
t_asmmodel: structure that receives assembled code.
typedef struct t_asmmodel { // Model to search for assembler command
char code[MAXCMDSIZE]; // Binary code
char mask[MAXCMDSIZE]; // Mask for binary code (0: bit ignored)
int length; // Length of code, bytes (0: empty)
int jmpsize; // Offset size if relative jump
int jmpoffset; // Offset relative to IP
int jmppos; // Position of jump offset in command
} t_asmmodel;
Members:
int Assemble(char *cmd,ulong ip,t_asmmodel *model,int attempt,int constsize,char *errtext);
把ASCII 的代码 比如 "push eax"这类转化成对应的机器码.....
都正常, 就是转化 "push 256" 或者 "STC" 这样的带立即数或者符合的都说不支持......
使用过这个函数的朋友指点下........
已解决:
int attempt,int constsize 置0即可.....为什么...不大懂.... 等E文不错的朋友说说
Parameters:
cmd - pointer to zero terminated ASCII command;
pi - address of the first byte of generated binary command in memory;
model - pointer to the structure that receives machine code and mask, see detailed description below;
attempt - index of alternative encoding of the command. Call Assemble with attempt=0,1,2... to obtain all possible versions of the command. Stop this sequence when Assemble reports error;
constsize - requested size of address constant and immediate data. Call Assemble with constsize=0,1,2,3 to obtain all possible encodings of the version selected by attempt;
errtext - pointer to text buffer of length at least TEXTLEN bytes that receives description of detected error.
t_asmmodel: structure that receives assembled code.
typedef struct t_asmmodel { // Model to search for assembler command
char code[MAXCMDSIZE]; // Binary code
char mask[MAXCMDSIZE]; // Mask for binary code (0: bit ignored)
int length; // Length of code, bytes (0: empty)
int jmpsize; // Offset size if relative jump
int jmpoffset; // Offset relative to IP
int jmppos; // Position of jump offset in command
} t_asmmodel;
Members:
int Assemble(char *cmd,ulong ip,t_asmmodel *model,int attempt,int constsize,char *errtext);
把ASCII 的代码 比如 "push eax"这类转化成对应的机器码.....
都正常, 就是转化 "push 256" 或者 "STC" 这样的带立即数或者符合的都说不支持......
使用过这个函数的朋友指点下........
已解决:
int attempt,int constsize 置0即可.....为什么...不大懂.... 等E文不错的朋友说说
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
赞赏
他的文章
- [讨论]今天论坛好像有一段时间打不开了? 2605
- [求助]OD 注释和字符串混一块去了 4630
- [已经解决]OD反汇编引擎 立即数的解释问题 4770
- [求助]ODScriot 中的 ASM 和 直接OD操作区别 4209
- [求助]HOOK中使用循环。。。。。 5878
看原图
赞赏
雪币:
留言: