42带参数的函数

《42带参数的函数》由会员上传分享，免费在线阅读，更多相关内容在工程资料-天天文库。

1、零起点跟我学逆向C+4啊冲QQ群1096887594.2带参数的函数源代码#includeintadd(intx,inty){returnx+y;}intmain(){inta;a=add(l,2);printf(n%du,a);return0;反汇编头部略。。。10:inta;11:a=add(1,2);0040D748push20040D74Apush10040D74Ccall@ILT+10(show)(0040100f)0040D751addesp,80040D754movdwordptrLebp-4J,eax12:printf(n%dH

2、,a);0040D757moveax,dwordptrfebp-4]0040D75Apushcax0040D75BpushoffsetstringH%d"(00422fb0)0040D760callprintf(00401060)0040D765addesp,813:return0;0040D768xorcax,cax尾部略。。。自定义国数1:#include2:3:intadd(intx,inty)4：{0040D6F0pushcbp0040D6F1movebp.esp0040D6F3subesp,40h0040D6F6pushebx0040D6

3、F7pushesi0040D6F8pushedi0040D6F9leaedi,[ebp-40h]0040D6FCmovecxJOh0040D70Imoveax,OCCCCCCCCh0040D706repstosdwordptr[edi]5:returnx+y;0040D708moveax,dwordptr[ebp+8]0040D70BA-addeax,dwordptr[ebp+OChJO.J0040D70Epopedi0040D70Fpopcsi0040D710popebx0040D711movesp,ebp0040D713popebp0040D714ret我们看到E

4、BP+8是X,EBP+C是Y,将数值和加后放入EAX里返回。然后主函数调用0040D754movdwordptr[ebp-4J,eax将返冋值存放到主函数的变量里，这就是带参数的函数执行流程。再用IDA看下RELEASE版aNld;int_cdeclmain(intargc,constchar关*argu,constchar关关enup)_mainprocnearpush2push1callSUb_401000addesp,8pusheaxpushoffsetunk_407830callsub_401030_addesp,8xoreax,eaxretn_mainendp

5、看下00401000处sub_401O00procneararg_0=arg_4=dworddwordptr4ptr8moueax,[ejsp+arg_4]mouecx,[esp*arg_0]addeax,ecxretnsub_401080endp我们看到在主函数传递参数的吋候是先右侧参数2,再传参数1，而在IDA下显示的arg_4则是先被PUSH进來的参数2,arg_O则是后被PUSH进來的参数1。为了更加明确的显示，我们再调用0D看下子函数的代码。4吾爱破解・lest皂xe・(LCG・主线程，模块・相测叵

6、文件㈢查看⑼调试插件2)选项CD窗口㈤帮助凹工具设置api断

7、暂停a^lx]卄叮Ml引罰IUI创创l

8、e

9、m

10、t

11、w地址1HEX数据仮汇编00401000r$8B442408moueax,dwordptrss:[esp+8]00401004■8B4C2404mouecx,dwordptrss:[esp+4]00401008■03C1addeax,ecx0040100A■•C3■retn0040100B90nop0040100C90nop004010OD90nop004010OE90nop0040100F90nop00401010r$6A02200401012■6A01100401014■E8E7FFFFFFcalltest.004

12、81000004010191■83C408addesp,80040101C■50eax0040101D■6830704000test.0040703000401022■E809000000calltest.0040103000401027■83C408addesp,80040102A■33C0xoreax,eax0040102C■■C3当执行到00401000时看ESP堆栈地址擞值I注释$==>■08401019$700000001$-800000002

13、$*c00401115分析：当前ESP地址就是返回上级函数地址，ESP+4是第1个参