源码：

.386

.model flat,stdcall

option casemap:none

include    windows.inc

include    user32.inc

includelib user32.lib

include    kernel32.inc

includelib kernel32.lib

include    comdlg32.inc

includelib comdlg32.lib

.data

lpszHexArr               db  '0123456789ABCDEF',0

.code

_WinMain proc

    local @bufTemp1:byte

push edi

    xor bx,bx

    mov bl,al

    movzx edi,bx

mov bl,byte ptr lpszHexArr[edi]

mov byte ptr @bufTemp1[0],bl

xor bx,bx

mov bl,dl

movzx edi,bx

mov bl,byte ptr lpszHexArr[edi]

mov byte ptr @bufTemp1[1],bl

mov bl,20h

mov byte ptr @bufTemp1[2],bl

mov bl,0

mov byte ptr @bufTemp1[3],bl

pop edi

_WinMain endp

start :

call _WinMain

invoke ExitProcess,NULL

end start

ida逆向

这个地方为什么加上0x403000

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课