我知道test做的是“隐含”的“与”操作,并设置相关标志位。当是在看一些代码时会看见
test eax,eax '就是test的两个操作数是一样的
je XXXXXXXX
之类的语句,这是什么意思?做什么用的?
比如下面的代码:
7347748B E8 B5FFFFFF call rtcTrimBstr
73477445 > 55 push ebp
73477446 8BEC mov ebp, esp
73477448 FF75 08 push dword ptr [ebp+8]
7347744B 8D45 08 lea eax, dword ptr [ebp+8]
7347744E 50 push eax
7347744F E8 72000000 call 734774C6
734774C6 56 push esi
734774C7 8B7424 0C mov esi, dword ptr [esp+C]
734774CB 85F6
test esi, esi
734774CD 75 1B jnz short 734774EA
734774CF 33C0 xor eax, eax
734774D1 85C0
test eax, eax
734774D3 74 39 je short 7347750E
734774D5 66:8B0E mov cx, word ptr [esi]
734774D8 66:83F9 20 cmp cx, 20
734774DC 74 07 je short 734774E5
734774DE 66:81F9 0030 cmp cx, 3000
734774E3 75 0C jnz short 734774F1
734774E5 46 inc esi
734774E6 46 inc esi
734774E7 48 dec eax
734774E8 ^ EB EB jmp short 734774D5
734774EA 8B46 FC mov eax, dword ptr [esi-4]
734774ED D1E8 shr eax, 1
734774EF ^ EB E0 jmp short 734774D1
734774F1 85C0
test eax, eax
734774F3 74 19 je short 7347750E
734774F5 8D4C46 FE lea ecx, dword ptr [esi+eax*2-2]
734774F9 66:8B11 mov dx, word ptr [ecx]
734774FC 66:83FA 20 cmp dx, 20
73477500 74 07 je short 73477509
73477502 66:81FA 0030 cmp dx, 3000
73477507 75 05 jnz short 7347750E
73477509 49 dec ecx
7347750A 49 dec ecx
7347750B 48 dec eax
7347750C ^ EB EB jmp short 734774F9
7347750E 50 push eax
7347750F 56 push esi
73477510 FF15 081A3973 call dword ptr [<&OLEAUT32.#4>] ; OLEAUT32.SysAllocStringLen
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课