几种程序的反汇编代码入口特征

最新推荐文章于 2023-05-29 21:18:44 发布

kaylc

最新推荐文章于 2023-05-29 21:18:44 发布

阅读量3k

点赞数

文章标签：汇编 byte delphi c basic 2010

本文通过具体的汇编指令示例，对比了Borland Delphi、Microsoft Visual C++、Microsoft Visual Basic、Borland C++及通用汇编语言在实现相同功能时的不同表现形式。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

一.Borland Delphi 6.0 - 7.0
004029BC > $ 55            　   PUSH EBP
004029BD   . 8BEC          　   MOV EBP,ESP
004029BF   . 83C4 F0       　 ADD ESP,-10
004029C2   . 53            　　  PUSH EBX
004029C3   . B8 84294000    MOV EAX,keymaker.00402984
004029C8   . E8 0BF4FFFF     CALL keymaker.00401DD8
004029CD   . 68 242A4000   PUSH keymaker.00402A24
004029D2   . 6A 00              PUSH 0
004029D4   . 6A 00              PUSH 0
004029D6   . E8 C9F4FFFF    CALL keymaker.00401EA4
004029DB   . 8BD8              MOV EBX,EAX
004029DD   . E8 E2F4FFFF    CALL <JMP.&kernel32.GetLastError>
004029E2   . 3D B7000000   CMP EAX,0B7

二.Microsoft Visual C++ 6.0
00401B70 >/$ 55                   PUSH EBP
00401B71 |. 8BEC                 MOV EBP,ESP
00401B73 |. 6A FF                PUSH -1
00401B75 |. 68 08254000     PUSH crackme.00402508
00401B7A |. 68 F61C4000     PUSH <JMP.&MSVCRT._except_handler3>
00401B7F |. 64:A1 0000000 MOV EAX,DWORD PTR FS:[0]
00401B85 |. 50                     PUSH EAX
00401B86 |. 64:8925 00000   MOV DWORD PTR FS:[0],ESP
00401B8D |. 83EC 68            SUB ESP,68
00401B90 |. 53                     PUSH EBX
00401B91 |. 56                     PUSH ESI
00401B92 |. 57                     PUSH EDI
00401B93 |. 8965 E8             MOV [LOCAL.6],ESP
00401B96 |. 33DB                 XOR EBX,EBX
00401B98 |. 895D FC             MOV [LOCAL.1],EBX
00401B9B |. 6A 02                PUSH 2
00401B9D |. FF15 98214000 CALL DWORD PTR DS:[<&MSVCRT.__set_app_ty>

三.Microsoft Visual Basic 5.0 / 6.0
004013EC > $ 68 A4244000   PUSH Crack.004024A4
004013F1   . E8 F0FFFFFF      CALL <JMP.&MSVBVM60.ThunRTMain>
004013F6   . 0000                ADD BYTE PTR DS:[EAX],AL
004013F8   . 0000                ADD BYTE PTR DS:[EAX],AL
004013FA   . 0000                ADD BYTE PTR DS:[EAX],AL
004013FC   . 3000                XOR BYTE PTR DS:[EAX],AL
004013FE   . 0000                ADD BYTE PTR DS:[EAX],AL

四.Borland C++ 1999
00401408 > $ /EB 10              JMP SHORT Unpacked.0040141A
0040140A     |66                     DB 66
0040140B     |62                     DB 62
0040140C     |3A                     DB 3A
0040140D     |43                     DB 43
0040140E     |2B                     DB 2B
0040140F     |2B                     DB 2B
00401410     |48                     DB 48
00401411     |4F                     DB 4F
00401412     |4F                     DB 4F
00401413     |4B                     DB 4B
00401414     |90                     NOP
00401415     |E9                     DB E9
00401416     |98F04900          DD OFFSET Unpacked.___CPPdebugHook
0040141A   > /A1 8BF04900    MOV EAX,DWORD PTR DS:[49F08B]
0040141F   . C1E0 02             SHL EAX,2
00401422   . A3 8FF04900      MOV DWORD PTR DS:[49F08F],EAX
00401427   . 52                     PUSH EDX
00401428   . 6A 00                PUSH 0
0040142A   . E8 E9CD0900     CALL <JMP.&KERNEL32.GetModuleHandleA>
0040142F   . 8BD0                 MOV EDX,EAX
00401431   . E8 4E200900     CALL Unpacked.00493484
00401436   . 5A                     POP EDX

五.汇编
00401025 >/$ 6A F6              PUSH -0A
00401027 |. E8 A0000000     CALL <JMP.&kernel32.GetStdHandle>
0040102C |. A3 00304000     MOV DWORD PTR DS:[403000],EAX
00401031 |. 6A F5                PUSH -0B
00401033 |. E8 94000000     CALL <JMP.&kernel32.GetStdHandle>
00401038 |. A3 04304000     MOV DWORD PTR DS:[403004],EAX
0040103D |. 6A 01               PUSH 1
0040103F |. 68 00104000     PUSH EchoLine.00401000
00401044 |. E8 8F000000     CALL <JMP.&kernel32.SetConsoleCtrlHandle>
00401049 |. 6A 07               PUSH 7
0040104B |. FF35 00304000 PUSH DWORD PTR DS:[403000]

转自：http://www.cnblogs.com/effective/archive/2010/06/22/1762862.html