逆向15 50 p0027課件天草三人行唯一軟件安全培訓(xùn)

OD專1cmp$VERSION,"1.47"http://比較是否大于1.47jaaddx,0Faddeax,add[401000],"，在OllyDbg執(zhí)行“自[Animateinto]操作申請(qǐng)你能讀/寫/執(zhí)行.alloc1000AN aneip相當(dāng)OllyDbg按Ctrl+AAND目的操作數(shù),源操作andx,0Fandeax,ASK中cmp$RESULT,0jecancel_pressedASM中asmeipmoveaxecxmoveax,ecxATOIstr[,base=16.]返回結(jié)果放到$RESULTitoa"F" //字符串"F"轉(zhuǎn)成了整型,結(jié)果會(huì)等于F BCbcbcxBPbpbpxD地址,條件d401000"ECX==1401000ecx1BPHWCBPHWS在指定地址，設(shè)置硬件斷點(diǎn)。有三種模式："r"-,"w"-寫入或者"x"-執(zhí)行bphws401000xBPL地址,表達(dá)式DBPRMbprm401000FF//一個(gè)字節(jié) 地址,大小 CMPcmpeip,CMTDECdecDIVdivx,0FDMDMA地址DPE文件名,<DumpProcesswithEntrypoint>EOBEOE按<ExceptionSTep按變量必須已經(jīng)在中。插到字符串中時(shí)，要放在用大括號(hào){}中。結(jié)果保存在保留變量$RESULT中Setsthe eval"x的值是{x}"http://執(zhí)行后$RESULT為"x的值 varxmovxymoveax0DEADBEEFmovecxxmovecxeaxpushFIND將等于findeip6A00E8Call，其的第一個(gè)參數(shù)0push0)findeip,#6A??E8#//查找一個(gè)帶參數(shù)的CallFINDOP地址findop401000,#61#//findnextfindop401000,#6A??#//findnextPUSHofC EAX,33 find401007,# //$RESULTfinddop40100733#//$RESULT40100CFINDMEMwhat[,StartAddr]findmem#6A00E8#//findaPUSH0followedbysomekindofcall 地址釋放由ALLOC申請(qǐng)的內(nèi)存.GCMT "info"canbeMEMORYBASE,MEMORYSIZEorMEMORYOWNER(ifyouwantotherinfointhefutureversions lSetsthe $RESULTvariable(0ifdatanotfound).GMEMIaddr,MEMORYBASE//Afterthis$RESULTistheaddresstothememorybaseoftheGMI地址,信息GN<GetgnGOgoGPA函數(shù)名,動(dòng)態(tài)庫(kù)<GetProcedure在設(shè)置API函數(shù)斷點(diǎn)時(shí)，這個(gè)指令非常有效。GPIGetsprocessinformation,oneof HANDLEx,y,classReturnsthehandleofchildwindowofspecifiedclassatpointx,yrememberinhexvalues).INC變量incConvertsanintegertoReturnsthestringinthe JAJAEJB<JumpifJBEjbeSOME_LABELJE<JumpifJMPJNE<JumpifNotjneKEYvkcode[,shift[,keykey20,1LBL地址,字符串LENstrmsg$RESULTloadDmfiletomemLMistheoppositeoftheDMLOG源操作數(shù)如果源操作數(shù)是一個(gè)字符串常量，則原樣記錄。log"oworld"http://記錄為" varxlogx//記錄為"x MOV目的操作數(shù),源操作提醒：十六進(jìn)制序列的位長(zhǎng)只能是偶數(shù)，比如2,4,6,8等等。movy," moveax,ecxmov!CF,1mov[403000]," MSG消息MSG"暫停MUL目的操作數(shù),源操作mulx,0FOPCODEOPCODEsetsthe$RESULTvariabletotheopcodebytes,$RESULT_1variabletomnemonicopcode(i.e."MOVECX,EAX")addrisincreasedbythelengthoftheopcode(disassemblecommand).Withthisfunctionyoucanstepforwardthroughcode.ORorx,0Foreax,Getasmcommandlineaddressjustbeforespecifiedaddress.Attention:Willnotgiverealexecutedcommandeipbeforethejump.REFaddrRepeat"REFaddr"until$RESULT=0togetnextrefslog$RESULTlog$RESULT_1log$RESULT_2jnecontinueREPL地址,查找字符串,替換字符串,長(zhǎng) repleip,#??00#,#??01#, 行" oSCMPdest,SHLshlx,8//xisSHRshrx,8//xisSubstractssrcfromdestandstoresresultindestsubx,0Fsubeax,sub[401000],Ddeip40100A"http://當(dāng)eip40100ADTraceoverdeip40100A"http://當(dāng)eip40100AXORxorx,0Fxoreax,xor[401000],Writet