首页
社区
课程
招聘
[求助]我想用程序定位一个Call的首地址不知道怎么做 请教了
发表于: 2009-2-27 14:42 4125

[求助]我想用程序定位一个Call的首地址不知道怎么做 请教了

2009-2-27 14:42
4125
这是 调用Call的代码段
00442DA0    8B5424 14       mov     edx, dword ptr ss:[esp+14]
00442DA4    8B01            mov     eax, dword ptr ds:[ecx]
00442DA6    6A 00           push    0				     
00442DA8    52              push    edx				     
00442DA9    8B5424 18       mov     edx, dword ptr ss:[esp+18]
00442DAD    52              push    edx                             
00442DAE    8B5424 18       mov     edx, dword ptr ss:[esp+18]
00442DB2    52              push    edx				    
00442DB3    8B5424 18       mov     edx, dword ptr ss:[esp+18]
00442DB7    52              push    edx				    
00442DB8    8B5424 18       mov     edx, dword ptr ss:[esp+18]
00442DBC    52              push    edx				     
00442DBD    FF90 00010000   call    dword ptr ds:[eax+100]           ; tty3d.00444300
00442DC3    C2 1400         retn    14



这是call内部代码段
00444300    B8 7C280000     mov     eax, 287C
00444305    E8 06021200     call    00564510
0044430A    A1 2C646900     mov     eax, dword ptr [69642C]
0044430F    33C4            xor     eax, esp
00444311    56              push    esi
00444312    898424 7C280000 mov     dword ptr [esp+287C], eax
00444319    8BF1            mov     esi, ecx
0044431B    8A86 30010000   mov     al, byte ptr [esi+130]
00444321    57              push    edi
00444322    8BBC24 9C280000 mov     edi, dword ptr [esp+289C]
00444329    84C0            test    al, al
0044432B    8B8424 88280000 mov     eax, dword ptr [esp+2888]
00444332    75 38           jnz     short 0044436C
00444334    68 61010000     push    161
00444339    68 78B26000     push    0060B278                         ; ASCII "D:\Work\PRJ_V82\TTY\TTY3D\src\TTY3DChaPlayer.cpp"
0044433E    68 CCAB6000     push    0060ABCC
00444343    50              push    eax
00444344    8D8C24 90000000 lea     ecx, dword ptr [esp+90]
0044434B    68 80AF6000     push    0060AF80                         ; ASCII "740,ERR_CODELINE,%d,%s,%s,%d"
00444350    51              push    ecx
00444351    FF15 20766000   call    dword ptr [607620]               ; MSVCR71.sprintf
00444357    8D9424 98000000 lea     edx, dword ptr [esp+98]
0044435E    52              push    edx
0044435F    E8 9CBA0600     call    004AFE00
00444364    83C4 1C         add     esp, 1C
00444367    E9 87050000     jmp     004448F3
0044436C    83C0 B9         add     eax, -47
0044436F    83F8 03         cmp     eax, 3
00444372    0F87 7B050000   ja      004448F3
00444378    53              push    ebx
00444379    FF2485 0C494400 jmp     dword ptr [eax*4+44490C]
00444380    8A8424 90280000 mov     al, byte ptr [esp+2890]
00444387    6A 00           push    0
00444389    6A 00           push    0
0044438B    6A 02           push    2
0044438D    8D4C24 18       lea     ecx, dword ptr [esp+18]
00444391    51              push    ecx
00444392    B9 B0D56900     mov     ecx, 0069D5B0
00444397    C64424 1C 47    mov     byte ptr [esp+1C], 47
0044439C    884424 1D       mov     byte ptr [esp+1D], al
004443A0    E8 3B560000     call    004499E0
004443A5    E9 48050000     jmp     004448F2
004443AA    8B9C24 90280000 mov     ebx, dword ptr [esp+2890]
004443B1    8BBC24 94280000 mov     edi, dword ptr [esp+2894]
004443B8    8D43 FC         lea     eax, dword ptr [ebx-4]
004443BB    83F8 04         cmp     eax, 4
004443BE    77 7C           ja      short 0044443C
004443C0    FF2485 1C494400 jmp     dword ptr [eax*4+44491C]
004443C7    6A 01           push    1
004443C9    6A 00           push    0
004443CB    57              push    edi
004443CC    8BCE            mov     ecx, esi
004443CE    EB 50           jmp     short 00444420
004443D0    8B16            mov     edx, dword ptr [esi]
004443D2    8BCE            mov     ecx, esi
004443D4    FF52 20         call    dword ptr [edx+20]
004443D7    8B40 0C         mov     eax, dword ptr [eax+C]
004443DA    57              push    edi
004443DB    8BC8            mov     ecx, eax
004443DD    E8 8E500E00     call    00529470
004443E2    85C0            test    eax, eax
004443E4    74 56           je      short 0044443C
004443E6    8B48 54         mov     ecx, dword ptr [eax+54]
004443E9    85C9            test    ecx, ecx
004443EB    74 4F           je      short 0044443C
004443ED    8BC1            mov     eax, ecx
004443EF    8B48 10         mov     ecx, dword ptr [eax+10]
004443F2    6A 00           push    0
004443F4    50              push    eax
004443F5    51              push    ecx
004443F6    8BCE            mov     ecx, esi
004443F8    EB 26           jmp     short 00444420
004443FA    8B06            mov     eax, dword ptr [esi]
004443FC    8BCE            mov     ecx, esi
004443FE    FF50 20         call    dword ptr [eax+20]
00444401    8B40 0C         mov     eax, dword ptr [eax+C]
00444404    57              push    edi
00444405    8BC8            mov     ecx, eax
00444407    E8 64500E00     call    00529470
0044440C    85C0            test    eax, eax
0044440E    74 2C           je      short 0044443C
00444410    8B76 54         mov     esi, dword ptr [esi+54]
00444413    85F6            test    esi, esi
00444415    74 25           je      short 0044443C
00444417    8B4E 10         mov     ecx, dword ptr [esi+10]
0044441A    6A 00           push    0
0044441C    56              push    esi
0044441D    51              push    ecx
0044441E    8BC8            mov     ecx, eax
00444420    E8 BBC60C00     call    00510AE0
00444425    85C0            test    eax, eax
00444427    74 13           je      short 0044443C
00444429    8B0D 84216B00   mov     ecx, dword ptr [6B2184]
0044442F    8B11            mov     edx, dword ptr [ecx]
00444431    6A 00           push    0
00444433    50              push    eax
00444434    FF52 38         call    dword ptr [edx+38]
00444437    E9 B6040000     jmp     004448F2
0044443C    8B8424 9C280000 mov     eax, dword ptr [esp+289C]
00444443    8B8C24 98280000 mov     ecx, dword ptr [esp+2898]
0044444A    50              push    eax
0044444B    51              push    ecx
0044444C    57              push    edi
0044444D    53              push    ebx
0044444E    8D4C24 48       lea     ecx, dword ptr [esp+48]
00444452    E8 B9EBFFFF     call    00443010
00444457    6A 00           push    0
00444459    6A 00           push    0
0044445B    6A 08           push    8
0044445D    8D5424 44       lea     edx, dword ptr [esp+44]
00444461    52              push    edx
00444462    B9 B0D56900     mov     ecx, 0069D5B0
00444467    E8 74550000     call    004499E0
0044446C    E9 81040000     jmp     004448F2
00444471    8BBC24 90280000 mov     edi, dword ptr [esp+2890]
00444478    6A 00           push    0
0044447A    6A 00           push    0
0044447C    6A 03           push    3
0044447E    8D4424 18       lea     eax, dword ptr [esp+18]
00444482    50              push    eax
00444483    B9 B0D56900     mov     ecx, 0069D5B0
00444488    C64424 1C 49    mov     byte ptr [esp+1C], 49
0044448D    66:897C24 1D    mov     word ptr [esp+1D], di
00444492    E8 49550000     call    004499E0
00444497    8B16            mov     edx, dword ptr [esi]
00444499    57              push    edi
0044449A    8BCE            mov     ecx, esi
0044449C    FF52 54         call    dword ptr [edx+54]
0044449F    E9 4E040000     jmp     004448F2
004444A4    8A46 08         mov     al, byte ptr [esi+8]
004444A7    84C0            test    al, al
004444A9    0F85 43040000   jnz     004448F2
004444AF    8B9C24 90280000 mov     ebx, dword ptr [esp+2890]
004444B6    83FB 04         cmp     ebx, 4
004444B9    74 0C           je      short 004444C7
004444BB    6A 00           push    0
004444BD    B9 E0D06900     mov     ecx, 0069D0E0
004444C2    E8 29680900     call    004DACF0
004444C7    83FB 02         cmp     ebx, 2
004444CA    55              push    ebp
004444CB    0F85 65030000   jnz     00444836
004444D1    33C0            xor     eax, eax
004444D3    894424 24       mov     dword ptr [esp+24], eax
004444D7    894424 28       mov     dword ptr [esp+28], eax
004444DB    894424 2C       mov     dword ptr [esp+2C], eax
004444DF    894424 30       mov     dword ptr [esp+30], eax
004444E3    E8 18910C00     call    0050D600
004444E8    8B9C24 98280000 mov     ebx, dword ptr [esp+2898]
004444EF    6A 17           push    17
004444F1    53              push    ebx
004444F2    B9 9C786B00     mov     ecx, 006B789C
004444F7    894424 44       mov     dword ptr [esp+44], eax
004444FB    E8 10490E00     call    00528E10
00444500    8BE8            mov     ebp, eax
00444502    8D45 FF         lea     eax, dword ptr [ebp-1]
00444505    83F8 08         cmp     eax, 8
00444508    0F87 59010000   ja      00444667
0044450E    FF2485 30494400 jmp     dword ptr [eax*4+444930]
00444515    8B16            mov     edx, dword ptr [esi]
00444517    8BCE            mov     ecx, esi
00444519    FF52 18         call    dword ptr [edx+18]
0044451C    8BD8            mov     ebx, eax
0044451E    E9 4B010000     jmp     0044466E
00444523    53              push    ebx
00444524    8BCE            mov     ecx, esi
00444526    E8 75A80C00     call    0050EDA0
0044452B    8BD8            mov     ebx, eax
0044452D    85DB            test    ebx, ebx
0044452F    895C24 10       mov     dword ptr [esp+10], ebx
00444533    0F84 FC000000   je      00444635
00444539    83FD 08         cmp     ebp, 8
0044453C    75 1D           jnz     short 0044455B
0044453E    8BCE            mov     ecx, esi
00444540    E8 5BA70C00     call    0050ECA0
00444545    85C0            test    eax, eax
00444547    0F84 CA000000   je      00444617
0044454D    8BCE            mov     ecx, esi
0044454F    E8 4CA70C00     call    0050ECA0
00444554    8BD8            mov     ebx, eax
00444556    E9 13010000     jmp     0044466E
0044455B    83FD 09         cmp     ebp, 9
0044455E    0F85 B3000000   jnz     00444617
00444564    8BCE            mov     ecx, esi
00444566    E8 35A70C00     call    0050ECA0
0044456B    85C0            test    eax, eax
0044456D    0F84 A4000000   je      00444617
00444573    8B06            mov     eax, dword ptr [esi]
00444575    8BCE            mov     ecx, esi
00444577    FF50 20         call    dword ptr [eax+20]
0044457A    8B8C24 9C280000 mov     ecx, dword ptr [esp+289C]
00444581    8B40 0C         mov     eax, dword ptr [eax+C]
00444584    51              push    ecx
00444585    8BC8            mov     ecx, eax
00444587    E8 E44E0E00     call    00529470
0044458C    8BF8            mov     edi, eax
0044458E    85FF            test    edi, edi
00444590    74 6A           je      short 004445FC
00444592    33D2            xor     edx, edx
00444594    895424 14       mov     dword ptr [esp+14], edx
00444598    895424 18       mov     dword ptr [esp+18], edx
0044459C    895424 1C       mov     dword ptr [esp+1C], edx
004445A0    8BCF            mov     ecx, edi
004445A2    895424 20       mov     dword ptr [esp+20], edx
004445A6    E8 A5A60C00     call    0050EC50
004445AB    8BC8            mov     ecx, eax
004445AD    E8 AEF60D00     call    00523C60
004445B2    D95C24 14       fstp    dword ptr [esp+14]
004445B6    8BCF            mov     ecx, edi
004445B8    E8 93A60C00     call    0050EC50
004445BD    8BC8            mov     ecx, eax
004445BF    E8 BCF60D00     call    00523C80
004445C4    D95C24 18       fstp    dword ptr [esp+18]
004445C8    8BCF            mov     ecx, edi
004445CA    E8 81A60C00     call    0050EC50
004445CF    8BC8            mov     ecx, eax
004445D1    E8 BAF60D00     call    00523C90
004445D6    894424 1C       mov     dword ptr [esp+1C], eax
004445DA    8D4424 24       lea     eax, dword ptr [esp+24]
004445DE    50              push    eax
004445DF    8D4C24 18       lea     ecx, dword ptr [esp+18]
004445E3    51              push    ecx
004445E4    895424 28       mov     dword ptr [esp+28], edx
004445E8    8B13            mov     edx, dword ptr [ebx]
004445EA    56              push    esi
004445EB    52              push    edx
004445EC    E8 3F030E00     call    00524930
004445F1    83C4 10         add     esp, 10
004445F4    33DB            xor     ebx, ebx
004445F6    8D7C24 24       lea     edi, dword ptr [esp+24]
004445FA    EB 72           jmp     short 0044466E
004445FC    8B0B            mov     ecx, dword ptr [ebx]
004445FE    8D4424 24       lea     eax, dword ptr [esp+24]
00444602    50              push    eax
00444603    6A 00           push    0
00444605    56              push    esi
00444606    51              push    ecx
00444607    E8 24030E00     call    00524930
0044460C    83C4 10         add     esp, 10
0044460F    33DB            xor     ebx, ebx
00444611    8D7C24 24       lea     edi, dword ptr [esp+24]
00444615    EB 57           jmp     short 0044466E
00444617    8B4424 10       mov     eax, dword ptr [esp+10]
0044461B    8B08            mov     ecx, dword ptr [eax]
0044461D    8D5424 24       lea     edx, dword ptr [esp+24]
00444621    52              push    edx
00444622    33DB            xor     ebx, ebx
00444624    53              push    ebx
00444625    56              push    esi
00444626    51              push    ecx
00444627    E8 04030E00     call    00524930
0044462C    83C4 10         add     esp, 10
0044462F    8D7C24 24       lea     edi, dword ptr [esp+24]
00444633    EB 39           jmp     short 0044466E
00444635    68 EA010000     push    1EA
0044463A    68 78B26000     push    0060B278                         ; ASCII "D:\Work\PRJ_V82\TTY\TTY3D\src\TTY3DChaPlayer.cpp"
0044463F    68 CCAB6000     push    0060ABCC
00444644    8D9424 94000000 lea     edx, dword ptr [esp+94]
0044464B    68 B0AB6000     push    0060ABB0                         ; ASCII "740,ERR_CODELINE,%s,%s,%d"
00444650    52              push    edx
00444651    FF15 20766000   call    dword ptr [607620]               ; MSVCR71.sprintf
00444657    8D8424 9C000000 lea     eax, dword ptr [esp+9C]
0044465E    50              push    eax
0044465F    E8 9CB70600     call    004AFE00
00444664    83C4 18         add     esp, 18
00444667    8B9C24 9C280000 mov     ebx, dword ptr [esp+289C]
0044466E    A0 38DD6A00     mov     al, byte ptr [6ADD38]
00444673    84C0            test    al, al
00444675    74 15           je      short 0044468C
00444677    8B06            mov     eax, dword ptr [esi]
00444679    6A 00           push    0
0044467B    6A 00           push    0
0044467D    6A 00           push    0
0044467F    6A 00           push    0
00444681    6A 00           push    0
00444683    6A 00           push    0
00444685    6A 00           push    0
00444687    8BCE            mov     ecx, esi
00444689    FF50 34         call    dword ptr [eax+34]
0044468C    8B8424 A0280000 mov     eax, dword ptr [esp+28A0]
00444693    8BAC24 98280000 mov     ebp, dword ptr [esp+2898]
0044469A    8B16            mov     edx, dword ptr [esi]
0044469C    57              push    edi
0044469D    50              push    eax
0044469E    53              push    ebx
0044469F    55              push    ebp
004446A0    8BCE            mov     ecx, esi
004446A2    FF92 A8000000   call    dword ptr [edx+A8]
004446A8    85C0            test    eax, eax
004446AA    0F8E AF000000   jle     0044475F
004446B0    3D 8E000000     cmp     eax, 8E
004446B5    0F84 A4000000   je      0044475F
004446BB    8B0D 84216B00   mov     ecx, dword ptr [6B2184]
004446C1    8B11            mov     edx, dword ptr [ecx]
004446C3    6A 00           push    0
004446C5    50              push    eax
004446C6    FF52 38         call    dword ptr [edx+38]
004446C9    E9 23020000     jmp     004448F1
004446CE    85FF            test    edi, edi
004446D0  ^ 75 95           jnz     short 00444667
004446D2    8B8C24 A0280000 mov     ecx, dword ptr [esp+28A0]
004446D9    51              push    ecx
004446DA    8B0D 84216B00   mov     ecx, dword ptr [6B2184]
004446E0    53              push    ebx
004446E1    55              push    ebp
004446E2    E8 E9420100     call    004589D0
004446E7    E9 05020000     jmp     004448F1
004446EC    83FD 02         cmp     ebp, 2
004446EF    75 3E           jnz     short 0044472F
004446F1    8B16            mov     edx, dword ptr [esi]
004446F3    8BCE            mov     ecx, esi
004446F5    FF52 20         call    dword ptr [edx+20]
004446F8    8B40 0C         mov     eax, dword ptr [eax+C]
004446FB    8B9C24 9C280000 mov     ebx, dword ptr [esp+289C]
00444702    53              push    ebx
00444703    8BC8            mov     ecx, eax
00444705    E8 664D0E00     call    00529470
0044470A    85C0            test    eax, eax
0044470C    74 13           je      short 00444721
0044470E    8B16            mov     edx, dword ptr [esi]
00444710    50              push    eax
00444711    8BCE            mov     ecx, esi
00444713    FF92 D4000000   call    dword ptr [edx+D4]
00444719    84C0            test    al, al
0044471B  ^ 0F85 4DFFFFFF   jnz     0044466E
00444721    8B06            mov     eax, dword ptr [esi]
00444723    8BCE            mov     ecx, esi
00444725    FF50 18         call    dword ptr [eax+18]
00444728    8BD8            mov     ebx, eax
0044472A  ^ E9 3FFFFFFF     jmp     0044466E
0044472F    8B9C24 9C280000 mov     ebx, dword ptr [esp+289C]
00444736    85DB            test    ebx, ebx
00444738  ^ 0F85 30FFFFFF   jnz     0044466E
0044473E    8B8C24 A0280000 mov     ecx, dword ptr [esp+28A0]
00444745    8B9424 98280000 mov     edx, dword ptr [esp+2898]
0044474C    51              push    ecx
0044474D    8B0D 84216B00   mov     ecx, dword ptr [6B2184]
00444753    52              push    edx
00444754    55              push    ebp
00444755    E8 76420100     call    004589D0
0044475A    E9 92010000     jmp     004448F1
0044475F    8B4424 3C       mov     eax, dword ptr [esp+3C]
00444763    33C9            xor     ecx, ecx
00444765    894C24 14       mov     dword ptr [esp+14], ecx
00444769    8986 C0020000   mov     dword ptr [esi+2C0], eax
0044476F    8B46 2C         mov     eax, dword ptr [esi+2C]
00444772    83F8 01         cmp     eax, 1
00444775    894C24 18       mov     dword ptr [esp+18], ecx
00444779    894C24 1C       mov     dword ptr [esp+1C], ecx
0044477D    89AE BC020000   mov     dword ptr [esi+2BC], ebp
00444783    894C24 20       mov     dword ptr [esp+20], ecx
00444787    74 04           je      short 0044478D
00444789    85C0            test    eax, eax
0044478B    75 5B           jnz     short 004447E8
0044478D    8B16            mov     edx, dword ptr [esi]
0044478F    6A 00           push    0
00444791    6A 00           push    0
00444793    6A 00           push    0
00444795    6A 00           push    0
00444797    6A 00           push    0
00444799    6A 00           push    0
0044479B    6A 00           push    0
0044479D    8BCE            mov     ecx, esi
0044479F    FF52 34         call    dword ptr [edx+34]
004447A2    8B06            mov     eax, dword ptr [esi]
004447A4    6A 01           push    1
004447A6    8BCE            mov     ecx, esi
004447A8    FF90 70010000   call    dword ptr [eax+170]
004447AE    8BCE            mov     ecx, esi
004447B0    E8 9BA40C00     call    0050EC50
004447B5    8BC8            mov     ecx, eax
004447B7    E8 A4F40D00     call    00523C60
004447BC    D95C24 14       fstp    dword ptr [esp+14]
004447C0    8BCE            mov     ecx, esi
004447C2    E8 89A40C00     call    0050EC50
004447C7    8BC8            mov     ecx, eax
004447C9    E8 B2F40D00     call    00523C80
004447CE    D95C24 18       fstp    dword ptr [esp+18]
004447D2    8BCE            mov     ecx, esi
004447D4    E8 77A40C00     call    0050EC50
004447D9    8BC8            mov     ecx, eax
004447DB    E8 B0F40D00     call    00523C90
004447E0    894424 1C       mov     dword ptr [esp+1C], eax
004447E4    895424 20       mov     dword ptr [esp+20], edx
004447E8    8BCE            mov     ecx, esi
004447EA    E8 61A40C00     call    0050EC50
004447EF    33C9            xor     ecx, ecx
004447F1    66:8B48 30      mov     cx, word ptr [eax+30]
004447F5    8B8424 A0280000 mov     eax, dword ptr [esp+28A0]
004447FC    8D5424 14       lea     edx, dword ptr [esp+14]
00444800    51              push    ecx
00444801    52              push    edx
00444802    57              push    edi
00444803    50              push    eax
00444804    53              push    ebx
00444805    55              push    ebp
00444806    6A 02           push    2
00444808    8D4C24 78       lea     ecx, dword ptr [esp+78]
0044480C    E8 1FFAFFFF     call    00444230
00444811    6A 00           push    0
00444813    6A 00           push    0
00444815    6A 2A           push    2A
00444817    8D4C24 68       lea     ecx, dword ptr [esp+68]
0044481B    51              push    ecx
0044481C    B9 B0D56900     mov     ecx, 0069D5B0
00444821    E8 BA510000     call    004499E0
00444826    8B0D 84216B00   mov     ecx, dword ptr [6B2184]
0044482C    E8 FF180100     call    00456130
00444831    E9 BB000000     jmp     004448F1
00444836    8B9424 A0280000 mov     edx, dword ptr [esp+28A0]
0044483D    8B8424 9C280000 mov     eax, dword ptr [esp+289C]
00444844    8BAC24 98280000 mov     ebp, dword ptr [esp+2898]
0044484B    57              push    edi
0044484C    52              push    edx
0044484D    50              push    eax
0044484E    55              push    ebp
0044484F    53              push    ebx
00444850    8D4E 70         lea     ecx, dword ptr [esi+70]
00444853    E8 18E6FFFF     call    00442E70
00444858    84C0            test    al, al
0044485A    0F85 91000000   jnz     004448F1
00444860    83FB 04         cmp     ebx, 4
00444863    74 1E           je      short 00444883
00444865    A0 38DD6A00     mov     al, byte ptr [6ADD38]
0044486A    84C0            test    al, al
0044486C    74 15           je      short 00444883
0044486E    8B16            mov     edx, dword ptr [esi]
00444870    6A 00           push    0
00444872    6A 00           push    0
00444874    6A 00           push    0
00444876    6A 00           push    0
00444878    6A 00           push    0
0044487A    6A 00           push    0
0044487C    6A 00           push    0
0044487E    8BCE            mov     ecx, esi
00444880    FF52 34         call    dword ptr [edx+34]
00444883    8B8424 A0280000 mov     eax, dword ptr [esp+28A0]
0044488A    8B8C24 9C280000 mov     ecx, dword ptr [esp+289C]
00444891    57              push    edi
00444892    50              push    eax
00444893    51              push    ecx
00444894    55              push    ebp
00444895    53              push    ebx
00444896    8D4C24 58       lea     ecx, dword ptr [esp+58]
0044489A    E8 31F9FFFF     call    004441D0
0044489F    6A 00           push    0
004448A1    6A 00           push    0
004448A3    6A 18           push    18
004448A5    8D5424 50       lea     edx, dword ptr [esp+50]
004448A9    52              push    edx
004448AA    B9 B0D56900     mov     ecx, 0069D5B0
004448AF    E8 2C510000     call    004499E0
004448B4    83FB 04         cmp     ebx, 4
004448B7    75 38           jnz     short 004448F1
004448B9    8B47 0C         mov     eax, dword ptr [edi+C]
004448BC    8B4F 08         mov     ecx, dword ptr [edi+8]
004448BF    8B57 04         mov     edx, dword ptr [edi+4]
004448C2    6A 00           push    0
004448C4    50              push    eax
004448C5    8B07            mov     eax, dword ptr [edi]
004448C7    51              push    ecx
004448C8    52              push    edx
004448C9    8B16            mov     edx, dword ptr [esi]
004448CB    50              push    eax
004448CC    6A 01           push    1
004448CE    55              push    ebp
004448CF    8BCE            mov     ecx, esi
004448D1    FF52 18         call    dword ptr [edx+18]
004448D4    50              push    eax
004448D5    8D4C24 44       lea     ecx, dword ptr [esp+44]
004448D9    E8 92F8FFFF     call    00444170
004448DE    8D4424 24       lea     eax, dword ptr [esp+24]
004448E2    6A 18           push    18
004448E4    50              push    eax
004448E5    E8 E6AC0300     call    0047F5D0
004448EA    8BC8            mov     ecx, eax
004448EC    E8 BFBB0300     call    004804B0
004448F1    5D              pop     ebp
004448F2    5B              pop     ebx
004448F3    8B8C24 80280000 mov     ecx, dword ptr [esp+2880]
004448FA    5F              pop     edi
004448FB    5E              pop     esi
004448FC    33CC            xor     ecx, esp
004448FE    E8 F2FA1100     call    005643F5
00444903    81C4 7C280000   add     esp, 287C
00444909    C2 1800         retn    18



[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课

收藏
免费 0
支持
分享
最新回复 (4)
雪    币: 144
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
2
没明白楼主的意思~你说的首地址指什么?是包含call这一段的首地址?~
2009-2-27 15:20
0
雪    币: 1491
活跃值: (985)
能力值: (RANK:860 )
在线值:
发帖
回帖
粉丝
3
我也没有看明白。。。
2009-2-27 20:23
0
雪    币: 2110
活跃值: (21)
能力值: (RANK:260 )
在线值:
发帖
回帖
粉丝
4
这是一个虚函数调用,找到对象的虚表,其中放的就是虚函数的指针了。
2009-3-1 18:58
0
雪    币: 231
活跃值: (45)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
qdk
5
补充一下
CWnd::FromHandlePermanent(HWND) ->CWnd* ->vptr ->vftable
2009-3-2 01:27
0
游客
登录 | 注册 方可回帖
返回
//