edx vs udemy

more information. In the C language version, the while (FAC * FAC For instructions, seeMoV edX, s_facMoV eax, FACLea edX, [edX + eax * 4 + 4]; (FAC + 2) * (FAC + 2) = s_fac * 4 * FAC + 4MoV s_fac, EDXAdd FAC, 2; FAC + = 2The basic principle is that if s_fac is the square of the FAC, a mathematical formula (FAC + 2) is used for finding (FAC + 2) ^ 2) ^ 2 = FAC ^

choose search> all reference text strings and click: Of course, it is more convenient to use the above super string reference + plug-in. However, our goal is to be familiar with some ollydbg operations. I will try to use the built-in functions of ollydbg with less plug-ins. Now, in another dialog box, right-click it, select the "Search Text" menu item, and enter "Wrong serial, try again !" The start WORD "wrong" (note that the search content is case-sensitive) to find one: Right-click the str

, which is read in Do_page_fault and combined with exception table to modify the method, No time for in-depth study, interested can continue to see. The Copy_from_user code is as follows: Static unsigned long __copy_user_intel (void __user *to, const void *from, unsigned long size) {int d0, D1; __asm__ __volatile__ (". Align 2,0x90\n" "1:MOVL (% 4),%%eax\n" "Cmpl $67, %0\n "" Jbe 3f\n "" 2:movl (% 4),%%eax\n "". Align 2,0x90\n "" 3: MOVL 0 (% 4),%%eax\n "" 4:MOVL 4 (% 4),%%

$0x200, % edx 0x00c: addl % edx, % ebx 0x00e: je dest 0x013: rmmovl % ebx, 0 (% edx) 0x019: dest: halt In our SEQ processor, an instruction is executed in one clock cycle (that is, two high-level time intervals. At the start of the clock cycle 3 (AT), a high-level entry, address 0x00c loaded into the program counter PC. In this way, the MCU (Master memory con

00427754 8F05 89284100 pop dword ptr ds: [0x412889]; [889] = ecx 0042775A 60 pushad 0042775B 61 popad 0042775C 51 push ecx 0042775D 8F05 CD294100 pop dword ptr ds: [0x4129CD]; [9cd] = ecx 00427763 FF35 CD294100 push dword ptr ds: [0x4129CD] 00427769 8915 E1284100 mov dword ptr ds: [0x4128E1], edx 0042776F FF35 E1284100 push dword ptr ds: [0x4128E1] 00427775 56 push esi 00427776 BE 11294100 mov esi, vcmfc database 1.00412911 0042777B 8BD6 mov

NTGODMOD.004030B4 00403265 98384000 PUSH ntgodmod.00403898; ASCII "Usage:" 0040326A 8d55 E4 LEA edx,dword PTR ss:[ebp-1c] 0040326D 33c0 XOR Eax,eax 0040326F E8 f8f0ffff Call ntgodmod.0040236c 00403274 8b45 E4 MOV eax,dword PTR ss:[ebp-1c] 00403277 8d55 E8 LEA edx,dword PTR ss:[ebp-18] 0040327A E8 11f4ffff Call ntgodmod.00402690 0040327F FF75 E8 PUSH DWORD PTR ss:[ebp-18] 00403282 A8384000 PUSH ntgodmod.004

, GameSetu.00406D60 ASCII "KRegEx.exe"0040692A mov eax, GameSetu.00406D74 ASCII "UIHost.exe"00406934 mov eax, GameSetu.00406D88 ASCII "TrojDie. kxp"0040693E mov eax, GameSetu.00406D9C ASCII "FrogAgent.exe"00406948 mov eax, GameSetu.00406DB4 ASCII "logo=.exe"00406952 mov eax, GameSetu.00406DC8 ASCII "Logo_1.exe"0040695C mov eax, GameSetu.00406DDC ASCII "Rundl132.exe"00406966 mov eax, GameSetu.00406DF4 ASCII "regedit.exe"00406970 mov eax, GameSetu.00406E08 ASCII "msconfig.exe"0040697A mov eax, Gam

Author: serious snowAfter a user clicks log on to the game, the server sends a piece of data to the local device: The selected part is the random key sent from the server to the Local Machine (it is not known that the key combination is inappropriate because it will be encrypted as data ).... The rest are some data packet features and offset sizes...Then this key is used for a series of processing .... The following authentication information is sent to the server: The data in the selected part

] = ECx 0042775a 60 pushad 0042775b 61 popad 0042775c 51 push ECx 0042775d 8f05 cd294100 pop dword ptr ds: [0x4129cd]; [9cd] = ECx 00427763 ff35 cd294100 push dword ptr ds: [0x4129cd] 00427769 8915 e1284100 mov dword ptr ds: [0x4128e1], EDX 0042776f ff35 e1284100 push dword ptr ds: [0x4128e1] 00427775 56 push ESI 00427776 be 11294100 mov ESI, vcmfc database 1.00412911 0042777b 8bd6 mov edX, ESI 0042777d 5E

Reference: http://blog.csdn.net/eagler_hzh/article/details/6550841 In fact, the function to be extracted is the void Xid _cpu_detect (void) in x264 \ common \ CPU. C. The source file int x264_cpu_cpuid_test( void );void x264_cpu_cpuid( uint32_t op, uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx );void x264_cpu_xgetbv( uint32_t op, uint32_t *eax, uint32_t *edx );uint32_t x264_cpu_detect( void ){

= 80 h Driver Number: 0001.0014 b408 mov ah, 08; Ah = 8 read drive Parameters: 0001.0016 CD13 INT 13: 0001.0018 7305 JNB 001f; cf = 0 (successful conversion): 0001.001a b9ffff mov CX, FFFF; Cx = FFFF: 0001.001d 8af1 mov DH, Cl; DH = FF * Referenced by a (u) nconditional or (c) onditional jump at address:|: 0001.0018 (c)|: 0001.001f 660fb6c6 movzx eax, DH; maximum head DH extended to exa: 0001.0023 40 Inc ax; AX = AX + 1. Ax is the maximum number of magnetic heads + 1. It starts from 0, so ax is

;}}Else{Float F = (float) SQRT (x * x + y * Y + z * z );If (F! = 0.0f){F = 1.0f/F;X * = f; y * = f; z * = F;}}} // Calculate the cross multiplication using two vectors and save the result to this vector.Void vector: Cross (const vector * pu, const vector * PV){If (g_busesse2){_ ASM{MoV eax, Pu;MoV edX, PV; Movups xmm0, [eax]Movups xmm1, [edX]Movaps xmm2, xmm0Movaps xmm3, xmm1 Shufps xmm0, xmm0, 0xc9Shufps x