masm32编译的exe，使用dumppe反汇编之后，看不到data段的数据？;asm文件如下：
.386
.model flat,stdcall
option casemap:none
include windows.inc
include kernel32.inc
include user32.inc
include comctl32.inc
include gdi32.inc
include comdlg32.inc
includelib kernel32.lib
includelib user32.lib
includelib gdi32.lib
includelib comctl32.lib
includelib comdlg32.lib
.data
MessageBoxCap db "test",0
;MessageBoxBody db "伟大的test",0
MessageBoxBody db 'Hello, world',0dh,0ah,'lee'
.code
start:
invoke MessageBox,NULL,addr MessageBoxBody, addr MessageBoxCap,MB_YESNO
invoke ExitProcess,NULL
end start
dumppe -disasm a2.exe结果如下： f:\masm32\a2.exe (hex) (dec)
.EXE size (bytes) 490 1168
Minimum load size (bytes) 450 1104
Overlay number 0 0
Initial CS:IP 0000:0000
Initial SS:SP 0000:00B8 184
Minimum allocation (para) 0 0
Maximum allocation (para) FFFF 65535
Header size (para) 4 4
Relocation table offset 40 64
Relocation entries 0 0
Portable Executable starts at b0
Signature 00004550 (PE)
Machine 014C (Intel 386)
Sections 0003
Time Date Stamp 4999BE12 Mon Feb 16 14:27:14 2009
Symbol Table 00000000
Number of Symbols 00000000
Optional header size 00E0
Characteristics 010F
Relocation information stripped
Executable Image
Line numbers stripped
Local symbols stripped
32 bit word machine
Magic 010B
Linker Version 5.12
Size of Code 00000200
Size of Initialized Data 00000400
Size of Uninitialized Data 00000000
Address of Entry Point 00001000
Base of Code 00001000
Base of Data 00002000
Image Base 00400000
Section Alignment 00001000
File Alignment 00000200
Operating System Version 4.00
Image Version 0.00
Subsystem Version 4.00
reserved 00000000
Image Size 00004000
Header Size 00000400
Checksum 00000000
Subsystem 0002 (Windows)
DLL Characteristics 0000
Size Of Stack Reserve 00100000
Size Of Stack Commit 00001000
Size Of Heap Reserve 00100000
Size Of Heap Commit 00001000
Loader Flags 00000000
Number of Directories 00000010
Directory Name VirtAddr VirtSize
-------------------------------------- -------- --------
Export 00000000 00000000
Import 00002010 0000003C
Resource 00000000 00000000
Exception 00000000 00000000
Security 00000000 00000000
Base Relocation 00000000 00000000
Debug 00000000 00000000
Decription/Architecture 00000000 00000000
Machine Value (MIPS GP) 00000000 00000000
Thread Storage 00000000 00000000
Load Configuration 00000000 00000000
Bound Import 00000000 00000000
Import Address Table 00002000 00000010
Delay Import 00000000 00000000
COM Runtime Descriptor 00000000 00000000
(reserved) 00000000 00000000
Section Table
-------------
01 .text Virtual Address 00001000
Virtual Size 00000030
Raw Data Offset 00000400
Raw Data Size 00000200
Relocation Offset 00000000
Relocation Count 0000
Line Number Offset 00000000
Line Number Count 0000
Characteristics 60000020
Code
Executable
Readable
02 .rdata Virtual Address 00002000
Virtual Size 00000092
Raw Data Offset 00000600
Raw Data Size 00000200
Relocation Offset 00000000
Relocation Count 0000
Line Number Offset 00000000
Line Number Count 0000
Characteristics 40000040
Initialized Data
Readable
03 .data Virtual Address 00003000
Virtual Size 00000016
Raw Data Offset 00000800
Raw Data Size 00000200
Relocation Offset 00000000
Relocation Count 0000
Line Number Offset 00000000
Line Number Count 0000
Characteristics C0000040
Initialized Data
Readable
Writeable
Imp Addr Hint Import Name from kernel32.dll - Not Bound
-------- ---- ---------------------------------------------------------------
00002000 9B ExitProcess
Imp Addr Hint Import Name from user32.dll - Not Bound
-------- ---- ---------------------------------------------------------------
00002008 1B1 MessageBoxA
IAT Entry
00000000: 0000205C 00000000 - 00002078 00000000
Disassembly
00401000 start:
00401000 6A04 push 4
00401002 6800304000 push 403000h
00401007 6805304000 push 403005h
0040100C 6A00 push 0
0040100E E80C000000 call fn_0040101F
00401013 6A00 push 0
00401015 E800000000 call fn_0040101A
0040101A fn_0040101A:
0040101A E905000000 jmp loc_00401024
0040101F fn_0040101F:
0040101F E906000000 jmp loc_0040102A
00401024 loc_00401024:
00401024 FF2500204000 jmp dword ptr [ExitProcess]
0040102A loc_0040102A:
0040102A FF2508204000 jmp dword ptr [MessageBoxA]
从反汇编的结果来看，怎么看不到'Hello, world'和'lee' 呢？
谢谢先
[课程]Android-CTF解题方法汇总！
