资源描述：
《花指令编写手册-花指令B》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。
1、>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>1。VC++5.0PUSHEBPMOVEBP,ESPPUSH-1push515448PUSH6021A8MOVEAX,DWORDPTRFS:[0]PUSHEAXMOVDWORDPTRFS:[0],ESPADDESP,-6CPUSHEBXPUSHESIPUSHEDIjmp跳转到程序原来的入口点>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>2
2、。c++pushebpmovebp,esppush-1push111111push222222moveax,fs:[0]pusheaxmovfs:[0],esppopeaxmovfs:[0],eaxpopeaxpopeaxpopeaxpopeaxmovebp,eaxjmp跳转到程序原来的入口点>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>3。跳转somewhere:nop/"胡乱"跳转的开始...jmp下一个jmp的地址/在附近随意跳jmp...
3、/...jmp原入口的地址/跳到原始oep--------------------------------------------------新入口:pushebpmovebp,espincecxpushedxnoppopedxdececxpopebpincecxloopsomewhere/跳转到上面那段代码地址去！jmpsomewhere>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>4。MicrosoftVisualC++6.0pushebpm
4、ovebp,espPUSH-1PUSH0PUSH0MOVEAX,DWORDPTRFS:[0]PUSHEAXMOVDWORDPTRFS:[0],ESPSUBESP,68PUSHEBXPUSHESIPUSHEDIPOPEAXPOPEAXPOPEAXADDESP,68POPEAXMOVDWORDPTRFS:[0],EAXPOPEAXPOPEAXPOPEAXPOPEAXMOVEBP,EAXJMP原入口>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>5。在m
5、ovebp,eax后面加上PUSHEAXPOPEAX>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>6.pushebpmovebp,espaddesp,-0Caddesp,0Cmoveax,403D7Dpusheaxretn>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>pushebpmovebp,esppush-1push00411222push00411544moveax,dword
6、ptrfs:[0]pusheaxmovdwordptrfs:[0],espaddesp,-6Cpushebxpushesipushediaddbyteptrds:[eax],aljo入口jno入口call下一地址>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>7.pushebpnopnopmovebp,espincecxnoppushedxnopnoppopedxnoppopebpincecxloop任意地址nopnop———————————————nopnopjmp下一个
7、jmp的地址/在附近随意跳nopjmp下一个jmp的地址/在附近随意跳nopjmp下一个jmp的地址/在附近随意跳jmp入口>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>PUSHEBPMOVEBP,ESPnopnopPUSH-1nopnoppush515448nopnopPUSH6021A8nopnopMOVEAX,DWORDPTRFS:[0]PUSHEAXMOVDWORDPTRFS:[0],ESPnopnopMOVEAX,DWORDPTRFS:[1]PUSHEAXMOVDWO
8、RDPTRFS:[1],ESPnopnopMOVEAX,DWORDPTRFS:[2]PUSHEAXMOVDWORDPTRFS:[2],ESPnopnopmoveax,fs:[0]pusheaxmovfs:[0],espnopnopincecxpusheaxpopeaxpushedxnoppopedxdececxpopebpincecxnopnopADDESP,-6CPUSHEBXPUSHESIPUS
