逆向15 50 p0027课件天草三人行唯一软件安全培训

OD专1cmp$VERSION,"1.47"//比较是否大于1.47jaaddx,0Faddeax,add[401000],"，在OllyDbg执行“自[Animateinto]操作申请你能读/写/执行.alloc1000AN aneip相当OllyDbg按Ctrl+AAND目的操作数,源操作andx,0Fandeax,ASK中cmp$RESULT,0jecancel_pressedASM中asmeipmoveaxecxmoveax,ecxATOIstr[,base=16.]返回结果放到$RESULTitoa"F" //字符串"F"转成了整型,结果会等于F BCbcbcxBPbpbpxD地址,条件d401000"ECX==1401000ecx1BPHWCBPHWS在指定地址，设置硬件断点。有三种模式："r"-,"w"-写入或者"x"-执行bphws401000xBPL地址,表达式DBPRMbprm401000FF//一个字节 地址,大小 CMPcmpeip,CMTDECdecDIVdivx,0FDMDMA地址DPE文件名,<DumpProcesswithEntrypoint>EOBEOE按<ExceptionSTep按变量必须已经在中。插到字符串中时，要放在用大括号{}中。结果保存在保留变量$RESULT中Setsthe eval"x的值是{x}"//执行后$RESULT为"x的值 varxmovxymoveax0DEADBEEFmovecxxmovecxeaxpushFIND将等于findeip6A00E8Call，其的第一个参数0push0)findeip,#6A??E8#//查找一个带参数的CallFINDOP地址findop401000,#61#//findnextfindop401000,#6A??#//findnextPUSHofC EAX,33 find401007,# //$RESULTfinddop40100733#//$RESULT40100CFINDMEMwhat[,StartAddr]findmem#6A00E8#//findaPUSH0followedbysomekindofcall 地址释放由ALLOC申请的内存.GCMT "info"canbeMEMORYBASE,MEMORYSIZEorMEMORYOWNER(ifyouwantotherinfointhefutureversions lSetsthe $RESULTvariable(0ifdatanotfound).GMEMIaddr,MEMORYBASE//Afterthis$RESULTistheaddresstothememorybaseoftheGMI地址,信息GN<GetgnGOgoGPA函数名,动态库<GetProcedure在设置API函数断点时，这个指令非常有效。GPIGetsprocessinformation,oneof HANDLEx,y,classReturnsthehandleofchildwindowofspecifiedclassatpointx,yrememberinhexvalues).INC变量incConvertsanintegertoReturnsthestringinthe JAJAEJB<JumpifJBEjbeSOME_LABELJE<JumpifJMPJNE<JumpifNotjneKEYvkcode[,shift[,keykey20,1LBL地址,字符串LENstrmsg$RESULTloadDmfiletomemLMistheoppositeoftheDMLOG源操作数如果源操作数是一个字符串常量，则原样记录。log"oworld"//记录为" varxlogx//记录为"x MOV目的操作数,源操作提醒：十六进制序列的位长只能是偶数，比如2,4,6,8等等。movy," moveax,ecxmov!CF,1mov[403000]," MSG消息MSG"暂停MUL目的操作数,源操作mulx,0FOPCODEOPCODEsetsthe$RESULTvariabletotheopcodebytes,$RESULT_1variabletomnemonicopcode(i.e."MOVECX,EAX")addrisincreasedbythelengthoftheopcode(disassemblecommand).Withthisfunctionyoucanstepforwardthroughcode.ORorx,0Foreax,Getasmcommandlineaddressjustbeforespecifiedaddress.Attention:Willnotgiverealexecutedcommandeipbeforethejump.REFaddrRepeat"REFaddr"until$RESULT=0togetnextrefslog$RESULTlog$RESULT_1log$RESULT_2jnecontinueREPL地址,查找字符串,替换字符串,长 repleip,#??00#,#??01#, 行" oSCMPdest,SHLshlx,8//xisSHRshrx,8//xisSubstractssrcfromdestandstoresresultindestsubx,0Fsubeax,sub[401000],Ddeip40100A"//当eip40100ADTraceoverdeip40100A"//当eip40100AXORxorx,0Fxoreax,xor[401000],Writet