4D 5A 50 00 02 00 00 00 04 00 0F 00 FF FF 00 00
B8 00 00 00 00 00 00 00 40 00 1A 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00
BA 10 00 0E 1F B4 09 CD 21 B8 01 4C CD 21 90 90 //从这行开始是DOS Stub
54 68 69 73 20 70 72 6F 67 72 61 6D 20 6D 75 73 // This program mus
74 20 62 65 20 72 75 6E 20 75 6E 64 65 72 20 57
69 6E 33 32 0D 0A 24 37 00 00 00 00 00 00 00 00 // 24就是'$'
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
------------------------------------------------------------------------------------------------------
我很早就有这个想法,但是直到今天还是没解决这个问题。很多人连我自己都认为我在干一件很蠢的事情,但是这个问题不解决就一直压在我心里,真不好受啊?
上面那个是Delphi编译出的默认头部,我用Debug 1.exe再用U命令查看到
0B8D:0000 BA1000 MOV DX,0010
0B8D:0003 0E PUSH CS
0B8D:0004 1F POP DS
0B8D:0005 B409 MOV AH,09
0B8D:0007 CD21 INT 21
0B8D:0009 B8014C MOV AX,4C01
0B8D:000C CD21 INT 21
Dos Stub中真正有价值的命令就这几条,但是问题是运行此命令的硬件(寄存器、内存等)环境怎么提取出来,在DOS MZ Head块的那些信息好像帮不上我。我是XP时代接触电脑的,请各位高手帮帮我!
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)