edi 845

A repeated instruction is a set of instructions for operating the data buffer. The data buffer is usually a byte array, which can be a single word or double word. (Intel 'calls these commands string commands) The most common data buffer operation commands are movsx, CMPs, stosx, and scasx. X can be B or W, and D represents byte, word, and dual-word, respectively. These commands are valid for any form of data. In these operations, the ESI and EDI reg

Let's first look at the static compilation result of a simple code: #include "stdafx.h"int _tmain(int argc, _TCHAR* argv[]){01041380 55 push ebp 01041381 8B EC mov ebp,esp 01041383 81 EC C0 00 00 00 sub esp,0C0h 01041389 53 push ebx 0104138A 56 push esi 0104138B 57 push edi 0104138C 8D BD 40 FF FF FF lea

Since the initial value of the dynamic array in Delphi is not always 0, setlength is used before each use of a one-dimensional array, and then fillchar is generally used for clearing, however, if the array is more than dozens of MB, the efficiency of fillchar is very low. For this reason, I specifically wrote some optimization code for clearing the array or memory. Code highlighting produced by Actipro CodeHighlighter (freeware)http://www.CodeHighlighter.com/-->1. Use the MMX command to optimiz

Cracking Device Monitor Author: rockhwndTime: 2004.8.10Web: http://blog.csdn.net/rockhwnd When device Monitor starts, it reads a file named license. DM in its directory and determines whether the file has been registered based on the content. The code for reading the file and analyzing the file content isC:/program files/common files/HHD software/device Monitor/silk. dll fileSo the createfile breakpoint : 67f917af ff15d041f967 call dword ptr [67f941d0] // createfile open the file: 67f917b5 8bf8

INT3 017f:1003d211 7c24 JL 1003d237 (NO JUMP) 017f:1003d213 0801 OR [ecx],al 017f:1003d215 0f8581010000 jnz NEAR 1003d39c 017f:1003d21b Pusha 017f:1003d21c be00a00210 MOV esi,1002a000 "R eip eip-1", "D EIP", the 017f:1003d210 place to 80H: 017f:1003d210 807c240801 CMP BYTE [esp+08],01 017f:1003d215 0f8581010000 jnz NEAR 1003d39c 017f:1003d21b Pusha 017f:1003d21c be00a00210 MOV esi,1002a000 017f:1003d221 8DBE0070FDFF LEA edi,[esi+fffd7000]

are eax,ebx,ecx,edx,edi,esi. These registers can be used arbitrarily in most directives. However, some instructions restrict the use of some of these registers for some purpose, such as the Division directive IDIVL the dividend in the EAX register, the edx register must be 0, and the divisor can be any register. The quotient of the calculated result is stored in the EAX register (covering the divisor), and the remainder is stored in the edx register.

First hang up the code,The original function author for the unknown Foreigner, the source for the MASM32 development package, here to express thanks. Chinese comments Modified added by Lao Liu: 486 model flat, stdcall option Casemap:none. codeopt ION prologue:none OPTION epilogue:none align 4StrLen proc item:dword mov eax, [esp+4]; Gets the parameter item, which is the string pointer Lea edx, [eax+3]; edx= pointer +3 push EBP; back up EBP EDI push

to load the program. There will be many loops in the shell program. When dealing with loops, you can only let the program run forward, basically not let it jump back, you need to think out of the loop. Do not use Peid to query entries. You can track entries in one step to improve the capability of manual entry searching.Load the program with OD.Confirm an entry warning, and the Od prompts the program to shell. If you choose not to continue the analysis.Stop here0040D001 60 pushad first remember

ancestor classes do not have a processing method that corresponds to this message number, call DefaultHandlerend;procedureGetdynamethod;{function Getdynamethod (vmt:tclass; selector:smallint): Pointer; }Asm{-EAX VMT of Class}{SI dynamic Method index}{{ZF = 0 if found}{trashes:eax, ECX}PUSH EDIXCHG Eax,esi//Exchange eax and ESI values, after which the VMT entry address in ESI, EAX is the message number, i.e. the code of the corresponding dynamic methodJMP @ @haveVMT@ @outerLoop:MOV Esi,[esi]@ @h