edi 837

convert the value in Edx:eax to a decimal output form string, which is familiar, as in the previous example!; For example: edx=0,eax=01234567h, the converted string is:; -> ' 19088743 ', 0OUTEDXEAX proc uses ebx esi edi,lpstringMOV edi,lpstring points to the address where the results are storedMOV esi,lpstringmov ecx,10 converted into decimal. While eax!=0 | | Edx!=0Push EAXMOV Eax,edxXOR Edx,edxdiv ECXMOV

: Manual construction Stack Practice-How to manually construct the call stack ============ first illustrate the characteristics of the stack with a few pictures to help you understand. 1. Stack to low address growth. 2. Press the data into the stack, in the case of the stack. 3. Read the full textView the command summary for the disassembly code of the function in windbg: Command ========== U. U $ip the two commands above are the same effect, and disassemble the 8 commands on the current $IP add

simple.The main function first calls ProcCommandLine () to analyze the command line, obtain the Service Group to be started, and then calls SvcHostOptions () to query the options of the Service Group and all services of the Service Group, use a Data Structure svcTable to save the DLL of these services and their services, call the PrepareSvcTable () function to create the SERVICE_TABLE_ENTRY structure, and direct all processing functions SERVICE_MAIN_FUNCTION to one of your own functions FuncSer

Article Title: linux memory management initialization. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source. ENTRY (startup_32) /* * Set segments to known values. */ Cld Lgdt boot_gdt_descr-_ PAGE_OFFSET/* set the segment register */ Movl $ (_ BOOT_DS), % eax Movl % eax, % ds Movl % eax, % es Movl % eax, % fs Movl % eax, % gs /* * Clear BSS first so that there are

data members of the subclass.Let's take a look at VC7.1The generated assembly code can easily understand this behavior.This is the C190 constructor:01 00426FE0 push ebp 02 00426FE1 mov ebp,esp 03 00426FE3 sub esp,0CCh 04 00426FE9 push ebx 05 00426FEA push esi 06 00426FEB push edi 07 00426FEC push ecx 08 00426FED lea edi,[ebp+FFFFFF34h] 09 00426FF3 mov ecx,33h 10 00426FF8 mov eax ,0CCCCCCCCh 11 00426FFD rep

push edi 00402099 lea edi, [ebp-40h] 0040209C mov ecx, 10 h 004020A1 mov eax, 0 CCCCCCCCh 004020A6 rep stos dword ptr [edi] 252: return 0; 004020A8 xor eax, eax 253 :} 004020AA pop edi 004020AB pop esi 004020AC pop ebx 004020AD mov esp, ebp 004020AF pop ebp 004020B0 ret 250: static int process () 251 :{ 00402090 push

.686p. Model Flat,stdcallOption Casemap:noneInclude Windows.incInclude Kernel32.incInclude Masm32.incIncludelib "D:\vs\msvcrt.lib"Includelib Masm32.libIncludelib Kernel32.libprintf PROTO C:dword,:varargscanf PROTO C:dword,:vararg. DataHello db ' Hello ', 0A DWORD 5,4,30,2,1P byte '%s ', 0ahHint1 byte "Please enter 5 numbers:", 0ah,0Hint2 byte "like 5 2 3 1 4,", 0ah,0FMT byte "%d%d%d%d%d", 0ah,0Lin byte "function:%d", 0ah,0Edii byte "Before exchanging eax:%d,ebx:%d", 0ah,0Edia byte "After exchang

issue CCDebuger has been very clear. If you have any questions, read the article. We directly open the RUN trace, add the "entry to all function processes", and return to the "Check" button in the program. In this case, open the RUN trace record in OllyDBG to find the key location, then you can break down at this position. The program is broken here.004010E2 |. 8BFE mov edi, ESIUser name is sent to edi004010E4 |. 03F8 add

PUSH; Gptr00404120 FFD0 call EAX; Request 800 bytes00404122 8905 CA404000 MOV DWORD PTR ds:[4040ca],eax00404128 89c7 MOV Edi,eax0040412A be 00104000 MOV esi,ahpack.004010000040412F Pushad; start Aplib00404130 FC CLD00404131 B2 MOV dl,8000404133 31DB XOR ebx,ebx00404135 A4 MOVS BYTE ptr es:[edi],byte ptr Ds:[esi]00404136 B3 MOV bl,200404138 E8 6d000000 call AHPACK.004041AA0040413D ^ F6 JNB short ahpack.0040

It turns out that there have been checksum-related cracking on the internet. I will interview the checksum compilation code and the vb version for cracking.Currently, I am using the checksum code of vb.Assembly Code of checksum:GOOGLECHECK proc nearVar_8 = dword ptr-8Var_4 = dword ptr-4Url_offset = dword ptr 8Url_length = dword ptr 0ChMagic_dword = dword ptr 10 hPush ebpMov ebp, espPush ecxPush ecxMov eax, [ebp + url_length]Cmp eax, 0ChPush ebxPush esiMov esi, [ebp + magic_dword]; = 0xE6359A60Pu

1.GetcurrentdirectoryGet Current Directory 2.GetmodulefilenameObtain the complete path+ PathremovefilespecSeparate pure path . 386 . ModelFlat, stdcall Option Casemap: None IncludeWindows. inc IncludeKernel32.inc IncludeUser32.inc IncludelibKernel32.lib IncludelibUser32.lib IncludeShlwapi. inc; PathremovefilespecUse IncludelibShlwapi. Lib . Data HinstanceDd? SzprofilenameDBMax_path DUP (?) SzfilenameDB'/Test. ini', 0;The file name is prefixed./ . Code Start:InvokeGetmodulehandle, null MoVHins

CCBE push EBX. Text: 0045 CCBF push ESI. Text: 0045ccc0 mov [EBP + var_4], eax; set the last 4 bytes of the variable to [005fbf64] And a random value.. Text: 0045ccc3 push EDI. Text: 0045ccc4 Lea eax, [EBP + widecharstr]. Text: 0045 ccca push eax. Text: 0045 cccb mov ECx, offset a_htm; ". htm". Text: 0045ccd0 mov edX, 80000000 H. Text: 0045ccd5 call sub_45c9f0. Text: 0045 ccda test eax, eax. Text: 0045 CCDC jnz loc_45cdce. Text: 0045cce2 mov EBX, DS:

to the string lengthAdd ECx, Len // Add the character LengthINC ECxAdd ECx, 4 // Add the original entry RVA ValueAdd ECx, 4 // Add four bytes of the getmodulhand addressMoV dword ptr [ESI + 28 h], ECxLea ESI, ChaoMoV EDI, dword ptr [eax + 14 H]Add EDI, imagebaseMoV ECx, LenINC ECxClDRep movs byte PTR [EDI], byte PTR [esi]Lea ESI, address // address for writing g

temporary base address in the item bar where the person involved is located.0dd97468, search for this address to get several codes to monitor the access respectively. Move the mouse to change the person's character to get the code:0076b9d1-3B 3D 64811003-cmp edi, [03108164]0076b9d7-75 2a-JNE 0076ba030076b9d9-8B 84 B7 04040000-mov eax, [EDI + ESI * 4 + 00000404]Obviously [

Tags: OS SP Div code BS as method simple functionSTOs includes stosb stosw stosd. The registers involved are eax and EDI. The functions are as follows: stosb copies values in Al to byte ptr es: [EDI, at the same time, EDI ++ stosw copies the value in ax to word ptr es: [EDI], and E