看了论坛里同样的帖子,还是没有解决这个问题。
请看用 ida pro 5.2 下面反编译片段:
.text:006AFAFC __EH_prolog proc near ; CODE XREF: sub_401000+5p
.text:006AFAFC ; sub_40107C+5p ...
.text:006AFAFC 000 push 0FFFFFFFFh
.text:006AFAFE 004 push eax
.text:006AFAFF 008 mov eax, large fs:0
.text:006AFB05 008 push eax
.text:006AFB06 00C mov eax, [esp+0Ch]
.text:006AFB0A 00C mov large fs:0, esp
.text:006AFB11 00C mov [esp+0Ch], ebp
.text:006AFB15 00C lea ebp, [esp+0Ch]
.text:006AFB19 00C push eax
.text:006AFB1A 010 retn
.text:006AFB1A __EH_prolog endp ; sp-analysis failed
调用函数两个片段:
片段(一)
.text:004010B1 sub_4010B1 proc near ; CODE XREF: sub_401060+3p
.text:004010B1 ; sub_4D10E2+255p ...
.text:004010B1
.text:004010B1 var_10 = dword ptr -10h
.text:004010B1 var_C = dword ptr -0Ch
.text:004010B1 var_4 = dword ptr -4
.text:004010B1
.text:004010B1 000 mov eax, offset sub_6F4778
.text:004010B6 000 call __EH_prolog
.text:004010BB 010 push ecx
.text:004010BC 014 push esi
.text:004010BD 018 mov esi, ecx
.text:004010BF 018 mov [ebp+var_10], esi
.text:004010C2 018 and [ebp+var_4], 0
.text:004010C6 018 lea ecx, [esi+7Ch]
.text:004010C9 018 call sub_6E3B50
.text:004010CE 018 lea ecx, [esi+68h]
.text:004010D1 018 mov [ebp+var_4], 1
.text:004010D8 018 call sub_401788
.text:004010DD 018 or [ebp+var_4], 0FFFFFFFFh
.text:004010E1 018 mov ecx, esi
.text:004010E3 018 call sub_6CF57F
.text:004010E8 018 mov ecx, [ebp+var_C]
.text:004010EB 018 pop esi
.text:004010EC 014 mov large fs:0, ecx
.text:004010F3 014 leave
.text:004010F4 000 retn
.text:004010F4 sub_4010B1 endp
片段(二)
.text:00401110 sub_401110 proc near ; DATA XREF: .rdata:0071BB04o
.text:00401110
.text:00401110 var_130 = qword ptr -130h
.text:00401110 String = dword ptr -118h
.text:00401110 var_18 = byte ptr -18h
.text:00401110 var_14 = byte ptr -14h
.text:00401110 var_10 = byte ptr -10h
.text:00401110 var_C = dword ptr -0Ch
.text:00401110 var_4 = dword ptr -4
.text:00401110
.text:00401110 000 mov eax, offset sub_6F47A4
.text:00401115 000 call __EH_prolog
.text:0040111A 010 sub esp, 10Ch
.text:00401120 11C push ebx
.text:00401121 120 push esi
.text:00401122 124 push edi
.text:00401123 128 mov esi, ecx
.text:00401125 128 call sub_5CC4BA
。。。。
.text:00401320 128 mov ecx, [ebp+var_C]
.text:00401323 128 push 1
.text:00401325 12C pop eax
.text:00401326 128 pop edi
.text:00401327 124 pop esi
.text:00401328 120 pop ebx
.text:00401329 11C mov large fs:0, ecx
.text:00401330 11C leave
.text:00401331 -08 retn
.text:00401331 sub_401110 endp ; sp-analysis failed
只要出现 sub esp, 10Ch 就解析出错!请问各位高手,有没有办法解决?
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课