反汇编我已经改得很完美了,就和OD出来的一样,就是汇编引擎弄不好,老是用了长指令的格式
81 05 E0 5A 47 00 01 00 00 00 11 22 33 44 55 66 Size of command = 10 bytes
==========================================
0xff,0xE0,0x55,0x8B,0xEC,0x51,0x51,0x53,0x56,0x57,
0x64,0x8B,0x35,0x00,0x00,0x00,0x00,0x89,0x75,0xFC,
0xC7,0x45,0xF8,0xF4,0x25,0x42,0x00,0x6A,0x00,0xFF,
0x75,0x0C,0xFF,0x75,0xF8,0xFF,0x75,0x08,0xE8,0x76,
0x1F,0x01,0x00,0x8B,0x45,0x0C,0x8B,0x40,0x04,0x83,
0xE0,0xFD,0x8B,0x4D,0x0C,0x89,0x41,0x04,0x64,0x8B,
0x3D,0x00,0x00,0x00,0x00
下面是上面的数据的反汇编:
00410000 FFE0 jmp eax ;2 byte
00410002 55 push ebp ;1 byte
00410003 8BEC mov ebp,esp ;2 byte
00410005 51 push ecx ;1 byte
00410006 51 push ecx ;1 byte
00410007 53 push ebx ;1 byte
00410008 56 push esi ;1 byte
00410009 57 push edi ;1 byte
0041000a 64:8B35 00000000 mov esi,fs:[0] ;7 byte
00410011 8975 FC mov [ebp-4],esi ;3 byte
00410014 C745 F8 F425D200 mov dword ptr [ebp-8],0xD225F4 ;7 byte
0041001b 6A 00 push 0 ;2 byte
0041001d FF75 0C push dword ptr [ebp+0xC] ;3 byte
00410020 FF75 F8 push dword ptr [ebp-8] ;3 byte
00410023 FF75 08 push dword ptr [ebp+8] ;3 byte
00410026 E8 761F0100 call 0x421FA1 ;5 byte
0041002b 8B45 0C mov eax,[ebp+0xC] ;3 byte
0041002e 8B40 04 mov eax,[eax+4] ;3 byte
00410031 83E0 FD and eax,-3 ;3 byte
00410034 8B4D 0C mov ecx,[ebp+0xC] ;3 byte
00410037 8941 04 mov [ecx+4],eax ;3 byte
0041003a 64:8B3D 00000000 mov edi,fs:[0] ;7 byte
=========================================
5 E8 1F140000 call 0x45187C jmpconst=45187C
==========================================
2 75 72 jnz short 0xD504A374 jmpconst=D504A374
==========================================
Assembler:
汇编:ADD [DWORD 475AE0],1:
32位立即数: 10 81 05 E0 5A 47 00 01 00 00 00
==========================================
8位立即数: 7 83 05 E0 5A 47 00 01
==========================================
汇编 push 7f;
2 6A 7F
mov eax,dword ptr [40E000];这一句本来汇编出来的是 A1 00 E0 04 00
6 8B 05 00 E0 40 00
请按任意键继续. . .