Simple analysis of the principle of easy language algorithm "one"

Note:

If you have finished reading the following article. Just try this KeyGenme, I believe you can get something.

Http://www.52pojie.cn/thread-540179-1-1.html

First, the beginning of the article we want to paste a simple language code, and compile this code, from the assembly angle analysis of the Easy language program compiled, easy language algorithm in the assembly of the implementation process.

. Version 2. assembly Window assembly _ Startup window. Subroutine _ button 1_ clicked. Local variable variable 1, integer type. local variable variable 2, integer type. local variable 3, integer variable 2 = 1 Variable 3 = 2 Variable 1 = variable 2 + variable 3

　　

For the sake of understanding, all the variables I use in Chinese instead, when the button is clicked, create three local variables, respectively, variable 1, variable 2, variable 3

Variable 2=1, variable 3=2 finally calculates the value of the variable 3, and evaluates the result to the variable 1.

Second, we compile this code, born into an EXE file, compiled using static compilation, the compiled file named ReverseMe.exe

Three, the play began, we will ReverseMe.exe loaded into the ollydbg, through the button event FF FC 5F 5E positioning to our key sub-program location

Four, the last picture above is the location of our key function, except the function head and function end, we can see that the core code is as follows.

Five, through the above figure can see a lot of Fild FSTP fld Fild Fadd and other directives. Obviously, we can extrapolate that the easy-to-use language program is the simplest subtraction, and is compiled with floating-point calculations.

Let's add a note to each code to make it easier to understand.

Note: The following two points are needed to know the little knowledge

An instruction in the 1.OD that looks like [local.x], which represents a local variable in a language that is easy to speak.

2.FILD,FSTP, such as floating-point instructions, operate on floating-point stacks, which is the ST0----in the OD register window ST7

Six, through the above analysis, we can see that only an integer addition, easy language compilation after the compilation of such a big heap of things, in fact, for cracker, a lot of assembly code is useless.

Below we will simplify the analysis just now. Seeing this sort of floating-point operation in the future, we can identify what he's doing.

Note: The following two points are needed to know the little knowledge

1. See this type of floating-point calculation. Looking for Fild, there are several fild there are several operands, there are two fild, so the code operand is [LOCAL.1] and [LOCAL.2], that is, variable 1 and variable 2

2. Find the Fild, find the operation instructions, eliminate all the stack operation instructions. There is only fadd, the arithmetic instruction, which is the addition instruction.

Sum up:

PS: In the future to see such a large piece of code, is not to be confused force it?

Simple analysis of the principle of easy language algorithm "one"