834 edi

by axis 2007-03-28 http://www.ph4nt0m.org Simplified Chinese Windows Universal Jump Address: (2K/XP/2K3) 0X7FFA45F3 jmp ecx \xff\xe1 0x7ffa4967 jmp EBP \xff\xe5 0X7FFA4A1B jmp ebx \xff\xe3 0x7ffa6773 push Ebx,retn \x53\xc3 (0x7ffa6772 is pop edx) 0x7ffd1769--0x7ffd1779 jmp eax \xff\xe0 0x7ffc01b0 Pop Esi,retn \x5e\xc3 0X7FFA54CF 0x7ffaf780 jmp edx \xff\xe2 7ffa1571 POP EAX 7ffa1572 BF 58c058c2 MOV edi,c258c058 7ffa1577 POP EAX 7ffa1578 C3 RETN KR

in the operation, such as Movl $foo,%eax equivalent to Intel's mov eax, word ptr foo Long jumps and calls are different in format, att for ljmp $section, $offset, while Intel is JMP Section:offset The main difference is these, the other details are many, here is a concrete example to illustrate #cpuid. S Sample Program . Section. Data Output . ASCII "The processor vendor ID is ' xxxxxxxxxxxx '/n ' . section. Text . globl _start _start: MOVL $,%eax Cpuid MOVL $output,%

ptr [ebp-4]14.013b1059 Add Eax,esi15.013b105b Add Eax,edx16.013B105D mov edx,dword ptr [__imp_std::endl (13B204CH)]17.013b1063 Add Ecx,eax//The top 3 Add instructions add Ebx,ecx,edx,edi to ECX, that is, the ECX is the cumulative result Visible compiler generated code is the best code, eliminate the intermediate variable i, reduce the number of cycles, eliminate the CPU can not be disorderly execution of the factors. BTW: One might have a question: i

loadRetDllentry ENDP To convert the value in Edx:eax to a decimal output form string, which is familiar, as in the previous example!OUTEDXEAX proc \; For example: edx=0,eax=01234567h, the converted string is:Uses ebx esi edi,lpstring; -> ' 19088743 ', 0mov edi,lpstring; point to address where results are storedMOV esi,lpstring mov ecx,10; convert to Decimal. While eax!=0 | | Edx!=0Push EAXMOV Eax,edxXOR

1 parameter passing (default calling convention) Use VC6.0 to create a new empty console application, create a new source file Main.c, write the following code, pay attention to debug compile, do not use release, lest the code by VC optimization, disassembly does not correspond. int addint (int a, int b) { int c = a+b; return c; } int main () { int x = AddInt (1, 3); return 0; } In the main function into the braces down, press F5 run, the program is broken, then press the combination of

this limit//run: Run.exe automatically compiles pm16.c and pm32.c and then generates an IMG and calls Bochs to run the program// Hint: Please first compile run.c file with yc09, generate Run.exe Program//After modify PM16.C and pm32.c code, can run Run.exe view effect directly, click Enter again compile run//author: Miao//Time: 2010-2-8 #define Ycbit 32//Tell the compiler to compile the program in 32-bit format #define ycorg 0x0//This value generates an address base offset for variable function

=65eb2270 edi=072fa3c8eip=66201739 esp=072fa3a4 ebp=072fa3b4 iopl=0 nv up ei pl nz na pe nccs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200206MSHTML!CImgElement::CImgElement:66201739 8bff mov edi,edi0:009> kvn # ChildEBP RetAddr Args to Child 00 072fa3a0 66201718 0000003d 06a08000 662016f0 MSHTML!CImgElement::CImgElement (FPO: [Non-Fpo])01 072fa

|. 50 push eax004011DA |. 8B4424 3C mov eax, dword ptr [esp + 3C]004011DE |. 6A 02 push 2004011E0 |. 8B48 04 mov ecx, dword ptr [eax + 4]004011E3 |. 8D4C0C 40 lea ecx, dword ptr [esp + ecx + 40]004011E7 |. E8 54020000 call 004011EC> |> B9 0A000000 mov ecx, 0A004011F1 |. 8BF5 mov esi, ebp; The ebp here points to the data we just read from the key file.004011F3 |. 8DBC24 C80000> lea edi, dword ptr [esp + C8]; buffer004011FA |. F3: A5 rep movs dword ptr

This vulnerability is manifested in MSVidCtl. dll (xpsp2: 6.5.2600.2180, vista: 6.5.6000.16386). MSVidCtl. dll is the system standard component. The cause of the vulnerability is that the persistent byte array (VT_UI1 | VT_ARRAY) is incorrectly read. Attackers can construct special files to trigger this vulnerability, which leads to arbitrary code execution with the current process permission. The following is an analysis of the vulnerability code:Take MSVidCtl. dll of 6.5.2600.2180 as an exampl

process. For different versions of NT systems, the kpcr structure is quite stable. We can even obtain the ETHREAD pointer of the current thread from the memory [0ffdff124h. 3. Replace the token of the current process with the system token. Because the token offset in eprocess is not fixed, you need to first find the offset value and then replace it. Ntoskrnl.exe exports the psreferenceprimarytoken function, which contains the operation to get the token from eprocess. We need to extract the offs