834 edi

I remember writing a HOOK API article (C/C ++ HOOK API (in-depth analysis of the principle-loadlibrarya). The main principle of this article is to construct a code byte, modify the first 16 bytes of the loadlibrarya function, and then jump to the custom function. When you call a normal function, unhook it again. In this way, when you call a function again, the unhook and hook operations appear too frequent. Moreover, the hook and unhook were designed as thiscall at the time. Therefore, maintaini

// Http://stackoverflow.com/questions/1715224/very-fast-memcpy-for-image-processing CourtesyWilliam Chan and Google. 30-70% faster than memcpy in Microsoft Visual Studio 2005. void X_aligned_memcpy_sse2(void* dest, const void* src, const unsigned long size_t){ __asm { mov esi, src; //src pointer mov edi, dest; //dest pointer mov ebx, size_t; //ebx is our counter shr ebx, 7; //divide by 128 (8 * 128bit registers) loop_copy:

{2002.8.5 kingron} {Source: Source string} {Sub: Sub string} {Return: Count} {Ex: strsubcount ('abccdcd', 'bc') = 2} Function strsubcount (const source, Sub: string): integer; VaR Buf: string; I: integer; Len: integer; Begin Result: = 0; Buf: = source; I: = pos (sub, Buf ); Len: = length (sub ); While I Begin INC (result ); Delete (BUF, 1, I + len-1 ); I: = pos (sub, Buf ); End; End; {strsubcount} {The following function returns the position after the specified position of substr in S}{Example:

KiInterruptTemplate .. That's it... The KiInterruptTemplate code is in ntoskrnl/ke/i386/Traps. s .... . Func KiInterruptTemplate_ KiInterruptTemplate: /* Enter interrupt trap */INT_PROLOG kit_a, kit_t, DoPushFakeErrorCode _ KiInterruptTemplate2ndDispatch:/* Dummy code, will be replaced by the address of the KINTERRUPT */Mov edi, 0 _ KiInterruptTemplateObject:/* The jump instruction address will be replaced with the actual address of the function to b

corresponding to the main function is as follows 123456789101112131415161718192021222324252627282930313233343536 7: int main()8: {00401020 push ebp // ebp初始为0018FF84h压栈，压栈后esp = 0018FF48h - 4 = 0018FF44h00401021 mov ebp,esp // ebp保存栈顶0，ebp=esp=0018FF44h00401023 sub esp,48h // esp -= 48h开辟了一段栈空间，留待后面保存局部变量，此时esp=0018FF44h-48h=0018FEFCh00401026 push ebx 00401027 push esi00401028 push edi // ebx、esi和

program, and no other auxiliary components. To control the register of passed parameters, you can extract the generic gadgets in the program initialization function.Enter Objdump–d./vul to observe the _libc_csu_init () function.There are two accessories available:Accessories 14005f0: 4c 89 ea mov %R13,%RDX 4005f3: 4c 89 f6 mov %R14,%RSI 4005f6: 44 89 ff mov %R15d,%EDI 4005f9: 41 ff 14 dc

: 0803DD09 xor eax, ebp. Text: 0803DD0B mov [ebp + 108 h + var_4], eax. Text: 0803DD11 push 4Ch. Text: 0803DD13 mov eax, offset loc_8184A54. Text: 0803DD18 call _ EH_prolog3_catch // set up an SE handler. Text: 0803DD1D mov eax, [ebp + 108 h + arg_C]. Text: 0803DD23 mov edi, [ebp + 108 h + arg_0]. Text: 0803DD29 mov ebx, [ebp + 108 h + arg_4]. Text: 0803DD2F mov [ebp + 108 h + var_130], edi. Text: 0803DD32

: 00412AC6 test cl, cl. Text: 00412AC8 jz short loc_412B06. Text: 00412AC8. Text: 00412ACA lea ecx, [esp + 8 + var_4]. Text: 00412ACE lea edx, [esp + 8 + arg_0]. Text: 00412AD2 push ecx. Text: 00412AD3 push edx. Text: 00412AD4 push eax. Text: 00412AD5 call sub_4444C0.. Text: 004444C0 sub esp, 5Ch. Text: 004444C3 push ebx. Text: 004444C4 push ebp. Text: 004444C5 push esi. Text: 004444C6 push edi. Text: 004444C7 mov

Debug versionESP stack top pointerEBP holds stack pointer Empty program: Int main () { 00411360 push ebp, press into EBP 00411361 mov ebp,esp; EBP = ESP, keep esp, wait for function call to resume, ESP is definitely used in a function call. 00411363 Sub esp,0c0h; esp-=0c0h (192); Leave temporary storage for the function ; put the values in other pointers or registers into the stack to use them in the function. 00411369 push ebx; Press into EBX 0041136A push esi, press into ESI 0041136B pu

, ESI73D311B9 FF50 60 call dword ptr ds: [EAX + 60]; PreTranslateMessage (Message preprocessing)73D311BC 85C0 test eax, EAX73D311BE 75 0E jnz short MFC42.73D311CE73D311C0 57 push edi; message preprocessing returns FALSE73D311C1 FF15 ACB6DC73 call dword ptr ds: [73D311C7 57 PUSH EDI73D311C8 FF15 30B6DC73 call dword ptr ds: [;73D311CE 6A 01 PUSH 1; return TRUE73D311D0 58 POP EAX73D311D1 5F POP EDI73D311D2 5E POP ESI73D311D3 C3 RETN Tip:A. OD after the p

From [wenjuliu25]: HelloWorld disassembly Analysis Lab environment:Visual c ++ 6.0 Objective: To analyze the memory allocation of a simple c program during program execution using assembly language /******* Mymain. cpp *********/ 1: # include 2: int main () 3 :{ 4: int x = 1; 5: printf ("Hello Canney \ n "); 6: return0; 7 :} /******* Mymain. asm *********/ 1: # include 2: int main () 3 :{ 00410950 push ebp 00410951 mov ebp, esp 00410953 sub ESP, 44 h // ESP = esp-0x40, allocate stack space t

stack occupied by the pressed ParameterPush ESI // protect the peripheral memoryPush EDIPush ECxPush edXMoV eax, [esp + 11bch]Push eaxMoV ESI, [esp + 11bch]Push 11a9h // Replace the value with an overflow ValueLea ECx, [esp + 24 h]PushecxMoveax, [esp + 11bch]PusheaxCall Recv // Recv forwardingTest eax, eaxJle loc_2CMP eax, ESI // determine whether the packet is receivedJle loc_1Movedx, [esp + 11ach]Xoreax, eaxDec eaxCmpedx, 0x90909090 // compare the specified overflow address valueJneloc_2Movea

CPU switches from user mode to privileged mode, then jump to the kernel code to execute the exception handling program.In the "B INT" command, the value 0x80 is a parameter. In exception handling, the parameter determines how to handle the problem. In the Linux kernel, an int 0x80 exception is called a system call.The values of C eax and EBX registers are two parameters passed to the system call. The value of eax is the system call number, 1 indicates _ exit call, and EBX indicates the paramete

;//////////////////////////////; First get the relocation difference Call rebaseRebase:Pop EBP;Sub EBP, offset rebase;; Get the kernel32.dll's base address; By peb direct access; Place in here not routine; Because we need it afterAssume FS: nothing; MoV eax, FS: [30 h]; PTR _ TebMoV eax, [eax + 0ch]; PTR _ peb_ldr_dataMoV eax, [eax + 1ch]; list_entry ininitializationordermodulelist. flinkMoV eax, [eax]; flink's flinkMoV eax, [eax + 08 h]; The Kernel32's base addressMoV [EBP + dwbase], eax;MoV EC

about some personal opinions. Next, we will conduct some small tests and explain them in assembly language. You can do it together. (1) Char name [] and char * Name 1:2: void process()3: {00401020 push ebp00401021 mov ebp,esp00401023 sub esp,4Ch00401026 push ebx00401027 push esi00401028 push edi00401029 lea edi,[ebp-4Ch]0040102C mov ecx,13h00401031 mov eax,0C

the arguments of the constructor, and is initialized with 1, which omits a step, speeds up the operation, and achieves the same effect. Note: In the above assembly, Visual Studio compiler optimizations have been turned off, indicating that this approach has been used as a general method of Visual Studio, rather than as a vs-perceived optimization tool.Initialize 3:classtest ct3 = Ct1Classtest ct3 = ct1;//Copy Initialization00b09538 Lea Eax,[ct1]00b0953e push EAX00b0953f Lea ECX,[CT3]00b09545 ca

asCall before eip=0x00401363 (next eip=0x00401368)After call EIP=0X0040100A,ESP=0X0012FEF4Then the call ends, and the last RET instruction of the __CDECL convention function pops the top of the stack to the EIP pointereip=0x00401368 Esp=0x0012fef8Then add esp,0xc, here 0xc=12 that is 3 DWORD is the number of front push (pop to pop to a register, add directly modify the top position of the stack, reduce the stack size)To this, the stack and EIP revert to the state before the call.Then we go insi

: 8063A8B2 7573 jne nt! Dbgkpsetprocessdebugobject+0xd1 (8063a927) The first function: Dbgkpsetprocessdebugobject (note that EDI+0BCH is the location of the debugport, which says the position is 0XBC), and is set when the debugger attaches the process DebugPort[CPP]View Plaincopy Kd> # BCH Nt! Dbgkpsetprocessdebugobject Nt! DBGKPSETPROCESSDEBUGOBJECT+0X56: 8063A8AC 399fbc000000 cmp DWORD ptr [

this function: Exported FN (): Send-ord: 0013 HAssembly Code of address machine code: 71a21af4 55 push EBP // machine code to be hooked (1st methods): 71a21af5 8bec mov EBP, esp // machine code to be hooked (2nd methods): 71a21af7 83ec10 sub ESP, 00000010: 71a21afa 56 push ESI: 71a21afb 57 push EDI: 71a21afc 33ff xor edi, EDI: 71a21afe 813d1c20a371931ca271 cmp d

Actipro CodeHighlighter (freeware)http://www.CodeHighlighter.com/-->Public Static Vector3 Foo (vector3 V, Float Radius){Matrix;Matrix. createtranslation ( Ref V, Out A ); Matrix B=Matrix. createtranslation (v ); Matrix. Multiply (RefA,RefB,OutA ); Vector3 F1=B. forward; Vector3 F2;F2.x=B. m31;F2.y=B. M32;F2.z=B. M33; Vector3 F3;Vector3.add (RefF1,RefF2,OutF3 );Vector3.transform (RefF3,RefA,OutF1 );ReturnF1;} Test 2 is the focus of this Article. To facilitate the discussion, we div