[求助]菜鸟问题----程序算法，望指教-软件逆向-看雪-安全社区|安全招聘|kanxue.com

[求助]菜鸟问题----程序算法，望指教

发表于: 2005-2-5 11:22 4276

[求助]菜鸟问题----程序算法，望指教

wxjyr123

活跃值

2005-2-5 11:22

4276

请高手指点，给以详细解释！！！

51001575  |. 8BF1          MOV ESI,ECX
51001577  |. 891424       MOV DWORD PTR SS:[ESP],EDX
5100157A  |. 8BE8          MOV EBP,EAX
5100157C  |. 8B5D 00       MOV EBX,DWORD PTR SS:[EBP]
5100157F  |. 8B0424       MOV EAX,DWORD PTR SS:[ESP]
51001582  |. 8B10          MOV EDX,DWORD PTR DS:[EAX]
51001584  |. 8916          MOV DWORD PTR DS:[ESI],EDX
51001586  |. 8B50 04       MOV EDX,DWORD PTR DS:[EAX+4]
51001589  |. 8956 04       MOV DWORD PTR DS:[ESI+4],EDX
5100158C  |> 8B3B          /MOV EDI,DWORD PTR DS:[EBX]
5100158E  |. 8B43 08       |MOV EAX,DWORD PTR DS:[EBX+8]
51001591  |. 8BD0          |MOV EDX,EAX
51001593  |. 0353 0C       |ADD EDX,DWORD PTR DS:[EBX+C]
51001596  |. 3B16          |CMP EDX,DWORD PTR DS:[ESI]
51001598    75 14       JNZ SHORT ZHR3D_22.510015AE
5100159A  |. 8BC3          |MOV EAX,EBX
5100159C  |. E8 B7FFFFFF |CALL ZHR3D_22.51001558
510015A1  |. 8B43 08       |MOV EAX,DWORD PTR DS:[EBX+8]
510015A4  |. 8906          |MOV DWORD PTR DS:[ESI],EAX
510015A6  |. 8B43 0C       |MOV EAX,DWORD PTR DS:[EBX+C]
510015A9  |. 0146 04       |ADD DWORD PTR DS:[ESI+4],EAX
510015AC  |. EB 16       |JMP SHORT ZHR3D_22.510015C4
510015AE  |> 8B16          |MOV EDX,DWORD PTR DS:[ESI]
510015B0  |. 0356 04       |ADD EDX,DWORD PTR DS:[ESI+4]
510015B3  |. 3BC2          |CMP EAX,EDX
510015B5  |. 75 0D       |JNZ SHORT ZHR3D_22.510015C4
510015B7  |. 8BC3          |MOV EAX,EBX
510015B9  |. E8 9AFFFFFF |CALL ZHR3D_22.51001558
510015BE  |. 8B43 0C       |MOV EAX,DWORD PTR DS:[EBX+C]
510015C1  |. 0146 04       |ADD DWORD PTR DS:[ESI+4],EAX
510015C4  |> 8BDF          |MOV EBX,EDI
510015C6  |. 3BEB          |CMP EBP,EBX
510015C8  |.^75 C2       \JNZ SHORT ZHR3D_22.5100158C
510015CA  |. 8BD6          MOV EDX,ESI
510015CC  |. 8BC5          MOV EAX,EBP
510015CE  |. E8 55FFFFFF CALL ZHR3D_22.51001528
510015D3  |. 84C0          TEST AL,AL
510015D5  |. 75 04       JNZ SHORT ZHR3D_22.510015DB
510015D7  |. 33C0          XOR EAX,EAX
510015D9  |. 8906          MOV DWORD PTR DS:[ESI],EAX
510015DB  |> 5A          POP EDX
510015DC  |. 5D          POP EBP
510015DD  |. 5F          POP EDI
510015DE  |. 5E          POP ESI
510015DF  |. 5B          POP EBX
510015E0  \. C3          RETN
510015E1    8D40 00       LEA EAX,DWORD PTR DS:[EAX]
510015E4  /$ 53          PUSH EBX
510015E5  |. 56          PUSH ESI
510015E6  |. 57          PUSH EDI
510015E7  |. 55          PUSH EBP
510015E8  |. 83C4 F8       ADD ESP,-8
510015EB  |. 8BD8          MOV EBX,EAX
510015ED  |. 8BFB          MOV EDI,EBX
510015EF  |> 8B32          /MOV ESI,DWORD PTR DS:[EDX]
510015F1  |. 8B43 08       |MOV EAX,DWORD PTR DS:[EBX+8]
510015F4  |. 3BF0          |CMP ESI,EAX
510015F6  |. 72 6C       |JB SHORT ZHR3D_22.51001664
510015F8  |. 8BCE          |MOV ECX,ESI
510015FA  |. 034A 04       |ADD ECX,DWORD PTR DS:[EDX+4]
510015FD  |. 8BE8          |MOV EBP,EAX
510015FF  |. 036B 0C       |ADD EBP,DWORD PTR DS:[EBX+C]
51001602  |. 3BCD          |CMP ECX,EBP
51001604  |. 77 5E       |JA SHORT ZHR3D_22.51001664
51001606  |. 3BF0          |CMP ESI,EAX
51001608  |. 75 1B       |JNZ SHORT ZHR3D_22.51001625
5100160A  |. 8B42 04       |MOV EAX,DWORD PTR DS:[EDX+4]
5100160D  |. 0143 08       |ADD DWORD PTR DS:[EBX+8],EAX
51001610  |. 8B42 04       |MOV EAX,DWORD PTR DS:[EDX+4]
51001613  |. 2943 0C       |SUB DWORD PTR DS:[EBX+C],EAX
51001616  |. 837B 0C 00    |CMP DWORD PTR DS:[EBX+C],0
5100161A  |. 75 44       |JNZ SHORT ZHR3D_22.51001660
5100161C  |. 8BC3          |MOV EAX,EBX
5100161E  |. E8 35FFFFFF |CALL ZHR3D_22.51001558
51001623  |. EB 3B       |JMP SHORT ZHR3D_22.51001660
51001625  |> 8B0A          |MOV ECX,DWORD PTR DS:[EDX]
51001627  |. 8B72 04       |MOV ESI,DWORD PTR DS:[EDX+4]
5100162A  |. 03CE          |ADD ECX,ESI
5100162C  |. 8BF8          |MOV EDI,EAX
5100162E  |. 037B 0C       |ADD EDI,DWORD PTR DS:[EBX+C]
51001631  |. 3BCF          |CMP ECX,EDI
51001633  |. 75 05       |JNZ SHORT ZHR3D_22.5100163A
51001635  |. 2973 0C       |SUB DWORD PTR DS:[EBX+C],ESI
51001638  |. EB 26       |JMP SHORT ZHR3D_22.51001660
5100163A  |> 8B0A          |MOV ECX,DWORD PTR DS:[EDX]
5100163C  |. 034A 04       |ADD ECX,DWORD PTR DS:[EDX+4]
5100163F  |. 890C24       |MOV DWORD PTR SS:[ESP],ECX
51001642  |. 2BF9          |SUB EDI,ECX
51001644  |. 897C24 04    |MOV DWORD PTR SS:[ESP+4],EDI
51001648  |. 8B12          |MOV EDX,DWORD PTR DS:[EDX]
5100164A  |. 2BD0          |SUB EDX,EAX
5100164C  |. 8953 0C       |MOV DWORD PTR DS:[EBX+C],EDX
5100164F  |. 8BD4          |MOV EDX,ESP
51001651  |. 8BC3          |MOV EAX,EBX
51001653  |. E8 D0FEFFFF |CALL ZHR3D_22.51001528
51001658  |. 84C0          |TEST AL,AL
5100165A  |. 75 04       |JNZ SHORT ZHR3D_22.51001660
5100165C  |. 33C0          |XOR EAX,EAX
5100165E  |. EB 0C       |JMP SHORT ZHR3D_22.5100166C
51001660  |> B0 01       |MOV AL,1
51001662  |. EB 08       |JMP SHORT ZHR3D_22.5100166C
51001664  |> 8B1B          |MOV EBX,DWORD PTR DS:[EBX]
51001666  |. 3BFB          |CMP EDI,EBX
51001668  |.^75 85       \JNZ SHORT ZHR3D_22.510015EF
5100166A  |. 33C0          XOR EAX,EAX
5100166C  |> 59          POP ECX
5100166D  |. 5A          POP EDX
5100166E  |. 5D          POP EBP
5100166F  |. 5F          POP EDI
51001670  |. 5E          POP ESI
51001671  |. 5B          POP EBX
51001672  \. C3          RETN
51001673    90          NOP
51001674  /$ 53          PUSH EBX
51001675  |. 56          PUSH ESI
51001676  |. 57          PUSH EDI
51001677  |. 8BDA          MOV EBX,EDX
51001679  |. 8BF0          MOV ESI,EAX
5100167B  |. 81FE 00001000  CMP ESI,100000
51001681  |. 7D 07       JGE SHORT ZHR3D_22.5100168A
51001683  |. BE 00001000 MOV ESI,100000
51001688  |. EB 0C       JMP SHORT ZHR3D_22.51001696
5100168A  |> 81C6 FFFF0000  ADD ESI,0FFFF
51001690  |. 81E6 0000FFFF  AND ESI,FFFF0000
51001696  |> 8973 04       MOV DWORD PTR DS:[EBX+4],ESI
51001699  |. 6A 01       PUSH 1                                  ; /Protect = PAGE_NOACCESS
5100169B  |. 68 00200000 PUSH 2000                               ; |AllocationType = MEM_RESERVE
510016A0  |. 56          PUSH ESI                               ; |Size
510016A1  |. 6A 00       PUSH 0                                  ; |Address = NULL
510016A3  |. E8 F8FDFFFF CALL <JMP.&kernel32.VirtualAlloc>       ; \VirtualAlloc
510016A8  |. 8BF8          MOV EDI,EAX
510016AA  |. 893B          MOV DWORD PTR DS:[EBX],EDI
510016AC  |. 85FF          TEST EDI,EDI
510016AE  |. 74 23       JE SHORT ZHR3D_22.510016D3
510016B0  |. 8BD3          MOV EDX,EBX
510016B2  |. B8 E8451D51 MOV EAX,ZHR3D_22.511D45E8
510016B7  |. E8 6CFEFFFF CALL ZHR3D_22.51001528
510016BC  |. 84C0          TEST AL,AL
510016BE  |. 75 13       JNZ SHORT ZHR3D_22.510016D3
510016C0  |. 68 00800000 PUSH 8000                               ; /FreeType = MEM_RELEASE
510016C5  |. 6A 00       PUSH 0                                  ; |Size = 0
510016C7  |. 8B03          MOV EAX,DWORD PTR DS:[EBX]             ; |
510016C9  |. 50          PUSH EAX                               ; |Address
510016CA  |. E8 D9FDFFFF CALL <JMP.&kernel32.VirtualFree>       ; \VirtualFree
510016CF  |. 33C0          XOR EAX,EAX
510016D1  |. 8903          MOV DWORD PTR DS:[EBX],EAX
510016D3  |> 5F          POP EDI
510016D4  |. 5E          POP ESI
510016D5  |. 5B          POP EBX
510016D6  \. C3          RETN

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

收藏・0

免费・0

支持

分享

最新回复 (4)
小虾雪币： 2384 活跃值： (766) 能力值： (RANK：410 ) 在线值：发帖 36 回帖 2248 粉丝 7 关注私信	小虾 10 2 楼晕，一点注释都没有，看到这么长的代码头都晕了。 2005-2-5 11:31 0
laoqian 雪币： 332 活跃值： (499) 能力值： ( LV9，RANK：330 ) 在线值：发帖 43 回帖 805 粉丝 33 关注私信	laoqian 8 3 楼我敢说高手再高也看不懂这个，不动态跟踪，没门啊，还是了 2005-2-5 12:16 0
zy79 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 29 粉丝 0 关注私信	zy79 4 楼 laoqian您好，能把你的flexlm共享一下吗？我的qq82990979 2005-2-5 12:45 0
laoqian 雪币： 332 活跃值： (499) 能力值： ( LV9，RANK：330 ) 在线值：发帖 43 回帖 805 粉丝 33 关注私信	laoqian 8 5 楼 flexlm sdk？ 2005-2-5 12:54 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

返回

wxjyr123

发帖

回帖

RANK

他的文章

看雪公众号

专注于PC、移动、智能设备安全研究及逆向工程的开发者社区