gsx edi

MOV Esi,offset @s1MOV Edi,offset @s2MOV ecx,10CldRep Movsd1.Rep Movsd every ecx! =0 executes Movsd, then ecx=ecx-1 movsd move Ds:[si] to Es:[di], in 32-bit assembler can replace the Si,edi with ESI instead of Di 2. at the same time because in general exe DS = ES program starting position so another ESI = offset @s1 can find the variable s1, edi= offset @s2 can f

locate the memory segment Descriptor mov es, ax xor edi, edi mov edi, (up to ten +) //screen 10th, No. 0 column br> mov ah, 0ch //0000: Black bottom 1100: Red word mov al, ' G ' mov [es:edi],ax jmp $nbs P LenOfCode32 equ $-label_code32 =================================== The approximate meaning of this piece of code is:First in the 16-bit code segment

Assembly language: Movsb,movsw,movsdTransferred from: http://blog.csdn.net/zhenyongyuan123/article/details/8364011Currently, the 80386 series of processors provide several sets of instructions for handling byte, Word, and double-word values, although these directives become basic string directives, but their usage is not limited to character arrays.Instructions:MOVSB, MOVSW, Movsd Describe:Moves the string data, copying the data at the memory address addressed by the ESI register to the memory a

Paste the source code first#include Another example#include Another one.#include Disassembly analysis1:void Main () 2: {00401010 push ebp00401011 mov ebp,esp00401013 sub esp,68h00401016 p Ush ebx00401017 push esi00401018 push edi00401019 Lea EDI,[EBP-68H]0040101C mov ECX,1AH00401021 mov eax,0cccccccch00401026 rep stos dword ptr [Edi]3:int narray[5] = {1, 2, 3 , 4, 5};00401028 mov dword ptr [ebp-14h]

1111 //Program Description: Output multi-line content, the content is as follows2 /*3 *4 ***5 *****6 *******7 *****8 ***9 *Ten */ One#include A using namespacestd; - intMain () - { thecout " *"Endl; -cout " ***"Endl; -cout " *****"Endl; -cout "*******"Endl; +cout " *****"Endl; -cout " ***"Endl; +cout " *"Endl; ASystem"Pause"); at return 0; -}Debug version of Disassembly codeintMain () {00f55e70 push ebp //Enter function after first thing, save stack bottom pointer ebp, Exi

by http://tmdnet.nothave.com NtGodModex.exe http://www.xfocus.net/tools/200804/1272.html NtGodMode.exe 9.00 KB (9,216 bytes) UPX shell, directly with ollydbg shelling, the process slightly Ntgodmode~.exe mb (123,392 bytes) view with PE tool, Delphi write 00403220 > PUSH EBP 00403221 8BEC MOV Ebp,esp 00403223 B9 0d000000 MOV ecx,0d 00403228 6A PUSH 0 0040322A 6A PUSH 0 0040322C DEC ECX 0040322D ^ F9 jnz short ntgodmod.00403228 0040322F I PUSH ECX 00403230 PUSH EBX 00403231 PUSH ESI 00403232 PUS

))LSet L = bIp2long = L.valEnd Function It's good and powerful to copy mybytes type variables to MyLong type variables with LSet. Look at the generated assembly code: Copy Code code as follows: 00401A0E Lea eax, DWORD ptr [ebp-0x20]; Address of variable B 00401A11 push EAX 00401a12 Lea eax, DWORD ptr [ebp-0x14]; The address of the variable L 00401A15 push EAX 00401A16 Push 0x4 00401a18 call __vbacopybytes; JMP to Msvbvm60.__vbacopybytes Called is the __v

The usage of "[]" has been described in "FAQ" and is cited as follows: 1, push DWORD ptr [024c1100] pressure stack 024c1100 value of two words2, CMP eax,[ebp+14] eax-ebp+14 valid value, does not retain the value, mainly looks at the sign bit3, CMP byte ptr [eax],46 byte type eax-46, see sign bit4, Lea eax,[edx-02] edx-02 valid value (an address value) to EAX5, MOV ecx,[edx+08] edx+8 value as the address, this address points to the value of ECX I am going to add a few more examples of what I have

strings : 00401089 e80e010000 Call 0040119C : 0040108E 894618 mov dword ptr [esi+18], eax : 00401091 FF7604 push [esi+04]; =71a20000h : 00401094 68D909F5AD push adf509d9; Custom encoding for Wsasocketa strings : 00401099 e8fe000000 Call 0040119C : 0040109E 89461C mov dword ptr [esi+1c], eax : 004010a1 FF7604 push [esi+04]; =71a20000h : 004010a4 68a41a70c7 push c7701aa4; Bind string's Custom encoding : 004010a9 e8ee000000 Call 0040119C : 004010AE 894620 mov dword ptr [esi+20], eax : 004010b1

Push EDI 00401029 Lea Edi,[ebp-4ch] 0040102C mov ecx,13h 00401031 mov eax,0cccccccch 00401036 Rep stos dword ptr [edi] 4:int var1 = param1; 00401038 mov eax,dword ptr [ebp+8] 0040103B mov dword ptr [Ebp-4],eax; Note the order in which the VAR1,VAR2,VAR3 is pressed into the stack! 5:int var2 = param2; 0040103E mov ecx,dword ptr [ebp+0ch] 00401041 mov dw

. Data? hfile HANDLE? Sizereadwrite DWORD? . Code Start: mov eax, offset ring0proc mov [ourgate], Ax; Put the offset words shr eax, 16; into our descriptor mov [ourgate+6], ax Sidt Fword ptr IDTR mov ebx, DWORD ptr [idtr+2]; Load IDT Base Address add ebx, 8*3; Address of int 3 descriptor in EBX mov edi, offset savedgate mov esi, ebx Movsd; Save the old descriptor Movsd; Into Savedgate mov edi, ebx mov

=65eb2270 edi=072fa3c8eip=66201739 esp=072fa3a4 ebp=072fa3b4 iopl=0 nv up ei pl nz na pe nccs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00200206MSHTML!CImgElement::CImgElement:66201739 8bff mov edi,edi0:009> kvn # ChildEBP RetAddr Args to Child 00 072fa3a0 66201718 0000003d 06a08000 662016f0 MSHTML!CImgElement::CImgElement (FPO: [Non-Fpo])01 072fa

|. 50 push eax004011DA |. 8B4424 3C mov eax, dword ptr [esp + 3C]004011DE |. 6A 02 push 2004011E0 |. 8B48 04 mov ecx, dword ptr [eax + 4]004011E3 |. 8D4C0C 40 lea ecx, dword ptr [esp + ecx + 40]004011E7 |. E8 54020000 call 004011EC> |> B9 0A000000 mov ecx, 0A004011F1 |. 8BF5 mov esi, ebp; The ebp here points to the data we just read from the key file.004011F3 |. 8DBC24 C80000> lea edi, dword ptr [esp + C8]; buffer004011FA |. F3: A5 rep movs dword ptr

This vulnerability is manifested in MSVidCtl. dll (xpsp2: 6.5.2600.2180, vista: 6.5.6000.16386). MSVidCtl. dll is the system standard component. The cause of the vulnerability is that the persistent byte array (VT_UI1 | VT_ARRAY) is incorrectly read. Attackers can construct special files to trigger this vulnerability, which leads to arbitrary code execution with the current process permission. The following is an analysis of the vulnerability code:Take MSVidCtl. dll of 6.5.2600.2180 as an exampl

process. For different versions of NT systems, the kpcr structure is quite stable. We can even obtain the ETHREAD pointer of the current thread from the memory [0ffdff124h. 3. Replace the token of the current process with the system token. Because the token offset in eprocess is not fixed, you need to first find the offset value and then replace it. Ntoskrnl.exe exports the psreferenceprimarytoken function, which contains the operation to get the token from eprocess. We need to extract the offs

-specified check of v56archv archive shipmentV56atktx: Number of the input line of the modified textV56bmod transmission processing: Field ModificationV56diinjection shipping process: determine the distanceV56fcopy shipping processing: copying delivery dataV56fstat shipping handling: active when a status is setV56i0001 IDOC tpsdls: changes in the delivery header GroupV56i0002 IDOC tpsdls: Changes to the delivery Project TeamV56i0003 IDOC tpsdls: Modify the packaged data groupV56i0004 IDOC tpsdls

] // obtain the address of the method table. The first four bytes of the reference type on the stack are the address of the method table.00000079 call dword ptr [eax + 38 H] // the address of the function to be called is calculated every time a virtual function is called.2017007c NOPClass_test.test3 (); // static function00000083 call ffeec140 // call a function00000088 NOPPublic override string tostring () // subclass calls the parent class function{// Omitting the previous AssemblyReturn base.

will confuse us. Continue to look down: Code: 004bd61e cmp edi, 0ahCode: 004bd621 JG short loc_4bd62fCode: 004bd623 mov dword ptr [EBX + 90 H], 0chCode: 004bd62d JMP short loc_4bd639Code: 004bd62f; zookeeperCode: 004bd62fCode: 004bd62f loc_4bd62f:; Code xref: sub_4bd5a8 + 79jCode: 004bd62f mov dword ptr [EBX + 90 H], 10 h The above code sets whether 12 or 16 cycles are used for information encryption based on the length of the key table. Code: 00

The annual "big project" for reinstallation of the system has been under construction. Sort out the tools and materials of last year. Today, we start to give our customers a bit of gameplay assistance. (The customer will not mind if it has been more than a year) Today is the first article. Analysis notes of long Xiang mi Chuan Blame Breakthrough: Ce searches for the change value and does not stop selecting the blame. Locate the following:Code: 00413b5e-89 be B0 00 00-mov [ESI +

area of the last 48 hours. 00401039 Lea EDI, [ebp-48h] 0040103c mov ECx, 12 h 00401041 mov eax, 0 cccccccch 00401046 rep STOs dword ptr [EDI]. In the next three stack commands, EBX, ESI, and EDI are pushed into the stack, which is also part of "protecting the site". These are some data of the main function execution. EBX, ESI, and