欢迎您访问程序员文章站本站旨在为大家提供分享程序员计算机编程知识!
您现在的位置是: 首页

WIN32汇编-反汇编

程序员文章站 2022-03-02 11:38:07
...

 学好WIN32汇编,平时需要多阅读编译器生成的汇编代码,因为编译器生成的代码是最规范和最优化的,从中可以学到汇编编程和语句优化的技巧。

    如何得到一个程序的反汇编代码呢?使用反汇编软件,不是使用DOS的DEBUG,WINIODWS平台上已经有多反汇编软件,读者可以从下面的地址中下载反汇编软件
http://www.pediy.com/tools/Disassemblers/W32Dasm/W32dsm8.93.rar
下载示例分析文件GetID硬件特征码程序:http://www.91now.com/down/soft/137021.htm
http://www.91now.com/down/downpage.asp?id=137021&dp=1&fid=12
   下面列出了取得硬件特征码程序的反汇编源代码,笔者将在随后对它进行分析:
Disassembly of File: D:\My Documents\GetID.exe
Code Offset = 00000400, Code Size = 00000200
Data Offset = 00000800, Data Size = 00000600
Number of Objects = 0004 (dec), Imagebase = 00400000h
   Object01:.text    RVA:00001000 Offset: 00000400 Size: 00000200 Flags: 60000020
   Object02:.rdata   RVA: 00002000 Offset:00000600 Size: 00000200 Flags: 40000040
   Object03:.data    RVA:00003000 Offset: 00000800 Size: 00000600 Flags: C0000040
   Object04:.rsrc    RVA:00004000 Offset: 00000E00 Size: 00002A00 Flags: C0000040

+++++++++++++++++++  菜单信息   ++++++++++++++++++
                程序没有菜单选项                     
+++++++++++++++++    对话框信息    ++++++++++++++++++
       There Are No Dialog Resources in This Application
+++++++++++++++++++     导入函数     ++++++++++++++++++
Number of Imported Modules=    2(decimal)
   Import Module 001:user32.dll
   Import Module 002:kernel32.dll
+++++++++++++++++++     重要模块资料    +++++++++++++++
   Import Module 001:user32.dll
 Addr:0000206C hint(019D) Name:MessageBoxA
   Import Module 002:kernel32.dll
 Addr:000020A6 hint(0080) Name:ExitProcess
 Addr:00002086 hint(0030) Name: CreateFileA
 Addr:00002094 hint(005A) Name:DeviceIoControl
+++++++++++++++++++     导出函数     ++++++++++++++++++
Number of Exported Functions = 0000 (decimal)
 

+++++++++++++++++++ ASSEMBLY CODE LISTING ++++++++++++++++++
//********************** Start of Code in Object .text**************
Program Entry Point = 00401000 (D:\My Documents\GetID.exe FileOffset:00001600)
 
//******************** Program Entry Point ********
:00401000B801000000             mov eax, 00000001
:004010050FA2                   cpuid
:00401007BEB7304000             mov esi, 004030B7
:0040100C50                     push eax
:0040100DE8E7000000             call 004010F9
:004010128906                   mov dword ptr [esi], eax
:0040101453                     push ebx
:00401015E8DF000000             call 004010F9
:0040101A894604                 mov dword ptr [esi+04], eax
:0040101D51                     push ecx
:0040101EE8D6000000             call 004010F9
:00401023894608                 mov dword ptr [esi+08], eax
:0040102652                     push edx
:00401027E8CD000000             call 004010F9
:0040102C89460C                 mov dword ptr [esi+0C], eax
:0040102FBF54304000             mov edi, 00403054
:00401034B910000000             mov ecx, 00000010
:00401039AC                     lodsb
:0040103AE8D9000000             call 00401118
:0040103F66AB                   stosw
:00401041E2F6                   loop 00401039
:004010436A00                   push 00000000
:004010456A00                   push 00000000
:004010476A03                   push 00000003
:004010496A00                   push 00000000
:0040104B6A03                   push 00000003
:0040104D68000000C0             push C0000000
* Possible StringData Ref from Data Obj->"\\.\PhysicalDrive0"
                                 |
:0040105268A0304000             push 004030A0
* Reference To: kernel32.CreateFileA, Ord:0030h
                                 |
:00401057E8DE000000             Call 0040113A
:0040105CA3B3304000             mov dword ptr [004030B3], eax
:00401061BBC7304000             mov ebx, 004030C7
:00401066C70300020000           mov dword ptr [ebx], 00000200
:0040106CC7430400010100         mov [ebx+04], 00010100
:00401073C7430800A0EC00         mov [ebx+08], 00ECA000
:0040107AC7430C00000000         mov [ebx+0C], 00000000
:00401081BBF7334000             mov ebx, 004033F7
:00401086C70312000000           mov dword ptr [ebx], 00000012
:0040108CC74304EC000000         mov [ebx+04], 000000EC
:00401093C7430801010001         mov [ebx+08], 01000101
:0040109AC7430C07000000         mov [ebx+0C], 00000007
:004010A16A00                   push 00000000
:004010A368F7334000             push 004033F7
:004010A86813020000             push 00000213
:004010AD68F7304000             push 004030F7
:004010B26A23                   push 00000023
:004010B468C7304000             push 004030C7
:004010B96888C00700             push 0007C088
:004010BEFF35B3304000           push dword ptr [004030B3]
* Reference To: kernel32.DeviceIoControl, Ord:005Ah
                                 |
:004010C4E877000000             Call 00401140
:004010C9BE1B314000             mov esi, 0040311B
:004010CEBF28304000             mov edi, 00403028
:004010D3B90A000000             mov ecx, 0000000A
:004010D866AD                   lodsw
:004010DA86C4                   xchg ah, al
:004010DC66AB                   stosw
:004010DEE2F8                   loop 004010D8
:004010E06A00                   push 00000000
* Possible StringData Ref from Data Obj->"本机硬件ID:"
                                 |
:004010E26800304000             push 00403000

* Possible StringData Ref from Data Obj->"你的硬件ID是:

硬盘ID:   "
                                       ->"                           

 "
                                       ->"CpuID:                      "
                                       ->"          

小技巧:你可以按 "
                                       ->"Ctrl+C 复制本框内容!"
                                 |
:004010E7680E304000             push 0040300E
:004010EC6A00                   push 00000000

* Reference To: user32.MessageBoxA, Ord:019Dh
                                 |
:004010EEE841000000             Call 00401134
:004010F350                     push eax

* Reference To: kernel32.ExitProcess, Ord:0080h
                                 |
:004010F4E84D000000             Call 00401146

* Referenced by a CALL at Addresses:
|:0040100D   ,:00401015   ,:0040101E   ,:00401027  
|
:004010F955                     push ebp
:004010FA8BEC                   mov ebp, esp
:004010FC53                     push ebx
:004010FD51                     push ecx
:004010FE8B4508                 mov eax, dword ptr [ebp+08]
:00401101B903000000             mov ecx, 00000003
:004011068AD8                   mov bl, al
:00401108C1E808                 shr eax, 08
:0040110BC1E308                 shl ebx, 08
:0040110EE2F6                   loop 00401106
:004011108BC3                   mov eax, ebx
:0040111259                     pop ecx
:004011135B                     pop ebx
:00401114C9                     leave
:00401115C20400                 ret 0004

 

* Referenced by a CALL at Address:
|:0040103A  
|
:004011188AE0                   mov ah, al
:0040111AC0E804                 shr al, 04
:0040111D80E40F                 and ah, 0F
:0040112080FC0A                 cmp ah, 0A
:004011237203                   jb 00401128
:0040112580C407                 add ah, 07

* Referenced by a (U)nconditional or (C)onditional Jump atAddress:
|:00401123(C)
|
:004011283C0A                   cmp al, 0A
:0040112A7202                   jb 0040112E
:0040112C0407                   add al, 07

* Referenced by a (U)nconditional or (C)onditional Jump atAddress:
|:0040112A(C)
|
:0040112E66053030               add ax, 3030
:00401132C3                     ret


:00401133CC                     int 03

* Referenced by a CALL at Address:
|:004010EE  
|

* Reference To: user32.MessageBoxA, Ord:019Dh
                                 |
:00401134FF2510204000           Jmp dword ptr [00402010]

* Referenced by a CALL at Address:
|:00401057  
|

* Reference To: kernel32.CreateFileA, Ord:0030h
                                 |
:0040113AFF2504204000           Jmp dword ptr [00402004]

* Referenced by a CALL at Address:
|:004010C4  
|

* Reference To: kernel32.DeviceIoControl, Ord:005Ah
                                 |
:00401140FF2508204000           Jmp dword ptr [00402008]

* Reference To: kernel32.ExitProcess, Ord:0080h
                                 |
:00401146FF2500204000           Jmp dword ptr [00402000]
:0040114C00000000000000000000   BYTE 10 DUP(0)
:0040115600000000000000000000   BYTE 10 DUP(0)
:0040116000000000000000000000   BYTE 10 DUP(0)
:0040116A00000000000000000000   BYTE 10 DUP(0)
:0040117400000000000000000000   BYTE 10 DUP(0)
:0040117E00000000000000000000   BYTE 10 DUP(0)
:0040118800000000000000000000   BYTE 10 DUP(0)
:0040119200000000000000000000   BYTE 10 DUP(0)
:0040119C00000000000000000000   BYTE 10 DUP(0)
:004011A600000000000000000000   BYTE 10 DUP(0)
:004011B000000000000000000000   BYTE 10 DUP(0)
:004011BA00000000000000000000   BYTE 10 DUP(0)
:004011C400000000000000000000   BYTE 10 DUP(0)
:004011CE00000000000000000000   BYTE 10 DUP(0)
:004011D800000000000000000000   BYTE 10 DUP(0)
:004011E200000000000000000000   BYTE 10 DUP(0)
:004011EC00000000000000000000   BYTE 10 DUP(0)
:004011F600000000000000000000   BYTE 10 DUP(0)

 有经验的程序员都知道,看别人代码是写代码必练的基本功,下面笔者和大家一起来看懂这段看似天书的汇编代码。

* Referenced by a CALL at Addresses:
|:0040100D   ,:00401015   ,:0040101E   ,:00401027  
|
:004010F955                     push ebp
:004010FA8BEC                   mov ebp, esp
:004010FC53                     push ebx
:004010FD51                     push ecx
:004010FE8B4508                 mov eax, dword ptr [ebp+08]
:00401101B903000000             mov ecx, 00000003
:004011068AD8                   mov bl, al
:00401108C1E808                 shr eax, 08
:0040110BC1E308                 shl ebx, 08
:0040110EE2F6                   loop 00401106
:004011108BC3                   mov eax, ebx
:0040111259                     pop ecx
:004011135B                     pop ebx
:00401114C9                     leave
:00401115C20400                 ret 0004
 
这是一段子程序,:0040100D   ,:00401015   ,:0040101E   ,:00401027 都对它进行了调用。所以先对这个子程序进行研究
:004010FE8B4508                 mov eax, dword ptr [ebp+08]
:00401101B903000000             mov ecx, 00000003
:004011068AD8                   mov bl, al
:00401108C1E808                 shr eax, 08
:0040110BC1E308                 shl ebx, 08
:0040110EE2F6                   loop 00401106
:004011108BC3                   mov eax, ebx
可以这个是一个循环,一循环三次
目的是将eax的值以字节为单位,反过来存放,存储器以字节为单位进行存储,对于字(16位),将要低8位放在低位地址,将高8位放在高位地址,因为存储器的地址单元是增加方向增长的,所以先将低8位放在ah,再将高8位取出放在AL,所以要反序取出。
ret指令返回并将调用者存放在堆栈中的返回地址弹出到EIP中,如果是段间调用的返回,弹出到CS:EIP
call执行的功能(段间),按顺序如下:
1、将CS寄存器中的值压入堆栈
2、把CALL指令的下条指令的32位偏移地址压入堆栈
3、拷贝48位的有效地址到CS:EIP
4、程序从了程序的第一条指令处开始执行
二、ret 立即数  
这种方式是指把返回地址弹出堆栈后,把该值与esp加,相当于堆栈顶去掉了若干字节的内容
 

* Referenced by a CALL at Address:
|:0040103A  
|
:004011188AE0                   mov ah, al
:0040111AC0E804                 shr al, 04
:0040111D80E40F                 and ah, 0F
:0040112080FC0A                 cmp ah, 0A
:004011237203                   jb 00401128
:0040112580C407                 add ah, 07

因为al中放了参数,所以将EAX的AL中的高4位移到ah中,要达到以十六进制显示,并且ASCII码为8位,所以进行了扩展,并且将十六进制码转化为ASCII码,

* Referenced by a (U)nconditional or (C)onditional Jump atAddress:
|:00401123(C)
|
:004011283C0A                   cmp al, 0A
:0040112A7202                   jb 0040112E
:0040112C0407                   add al, 07

* Referenced by a (U)nconditional or (C)onditional Jump atAddress:
|:0040112A(C)
|
:0040112E66053030               add ax, 3030
:00401132C3                     ret

以上完成将al由数字或字符分别转化成相应的两个ASCII码。

 

存储器以字节为单位进行存储,对于字(16位),将要低8位放在低位地址,将高8位放在高位地址,因为存储器的地址单元是增加方向增长的,且字的存储地址是低地址,取CPU序列号时,以4位为单位,所以先将低4位AL的低4位中,再将高4取出放在AL的高4位中,因此,这个子程序将AL的高位和低位调换过来,以还原正常。

 
 
//******************** Program Entry Point ********
:00401000B801000000             mov eax, 00000001
:004010050FA2                   cpuid
 
取得cpuid,从低32位到高32位放在eax,ebx,ecx,edx,

:00401007BEB7304000             mov esi, 004030B7
:0040100C50                     push eax
:0040100DE8E7000000             call 004010F9
:004010128906                   mov dword ptr [esi], eax
:0040101453                     push ebx
:00401015E8DF000000             call 004010F9
:0040101A894604                 mov dword ptr [esi+04], eax
:0040101D51                     push ecx
:0040101EE8D6000000             call 004010F9
:00401023894608                 mov dword ptr [esi+08], eax
:0040102652                     push edx
:00401027E8CD000000             call 004010F9
:0040102C89460C                 mov dword ptr [esi+0C], eax
调用子程序对CPUID进行反序,以还原正常的数值,因为存储将高位放在高地址,低位放在低地址。
:0040102FBF54304000             mov edi, 00403054
:00401034B910000000             mov ecx, 00000010
:00401039AC                     lodsb
:0040103AE8D9000000             call 00401118
:0040103F66AB                   stosw
:00401041E2F6                   loop 00401039
用4位单位进一步反序CPUID,并转化为ASCII码。
:004010436A00                   push 00000000
:004010456A00                   push 00000000
:004010476A03                   push 00000003
:004010496A00                   push 00000000
:0040104B6A03                   push 00000003
:0040104D68000000C0             push C0000000
* Possible StringData Ref from Data Obj->"\\.\PhysicalDrive0"
                                 |
:0040105268A0304000             push 004030A0
放置调用API的参数,最后入堆栈的参数是第一个参数
* Reference To: kernel32.CreateFileA, Ord:0030h
                                 |
:00401057E8DE000000             Call 0040113A
0040105CA3B3304000             mov dword ptr [004030B3], eax
:00401061BBC7304000             mov ebx, 004030C7
以下是二个变量的赋值
:00401066C70300020000           mov dword ptr [ebx], 00000200
:0040106CC7430400010100         mov [ebx+04], 00010100
:00401073C7430800A0EC00         mov [ebx+08], 00ECA000
:0040107AC7430C00000000         mov [ebx+0C], 00000000
:00401081BBF7334000             mov ebx, 004033F7
:00401086C70312000000           mov dword ptr [ebx], 00000012
:0040108CC74304EC000000         mov [ebx+04], 000000EC
:00401093C7430801010001         mov [ebx+08], 01000101
:0040109AC7430C07000000         mov [ebx+0C], 00000007
以下放置参数,调用API,取硬盘ID
:004010A16A00                   push 00000000
:004010A368F7334000             push 004033F7
:004010A86813020000             push 00000213
:004010AD68F7304000             push 004030F7
:004010B26A23                   push 00000023
:004010B468C7304000             push 004030C7
:004010B96888C00700             push 0007C088
:004010BEFF35B3304000           push dword ptr [004030B3]
* Reference To: kernel32.DeviceIoControl, Ord:005Ah
                                 |
:004010C4E877000000             Call 00401140
以下将取出的硬盘ID反序,以还原正常
:004010C9BE1B314000             mov esi, 0040311B
:004010CEBF28304000             mov edi, 00403028
:004010D3B90A000000             mov ecx, 0000000A
:004010D866AD                   lodsw
:004010DA86C4                   xchg ah, al
:004010DC66AB                   stosw
:004010DEE2F8                   loop 004010D8
:004010E06A00                   push 00000000
* Possible StringData Ref from Data Obj->"本机硬件ID:"
                                 |
:004010E26800304000             push 00403000

* Possible StringData Ref from Data Obj->"你的硬件ID是:

硬盘ID:   "
                                       ->"                           

 "
                                       ->"CpuID:                      "
                                       ->"          

小技巧:你可以按 "
                                       ->"Ctrl+C 复制本框内容!"
                                 |
:004010E7680E304000             push 0040300E
:004010EC6A00                   push 00000000

* Reference To: user32.MessageBoxA, Ord:019Dh
 调用API显示ID

                                |
:004010EEE841000000             Call 00401134
:004010F350                     push eax

* Reference To: kernel32.ExitProcess, Ord:0080h
                                 |
:004010F4E84D000000             Call 00401146

                ret

程序退出
:00401133CC                     int 03

* Referenced by a CALL at Address:
|:004010EE  
|

* Reference To: user32.MessageBoxA, Ord:019Dh
                                 |
:00401134FF2510204000           Jmp dword ptr [00402010]

* Referenced by a CALL at Address:
|:00401057  
|

* Reference To: kernel32.CreateFileA, Ord:0030h
                                 |
:0040113AFF2504204000           Jmp dword ptr [00402004]

* Referenced by a CALL at Address:
|:004010C4  
|

* Reference To: kernel32.DeviceIoControl, Ord:005Ah
                                 |
:00401140FF2508204000           Jmp dword ptr [00402008]

* Reference To: kernel32.ExitProcess, Ord:0080h
                                 |
:00401146FF2500204000           Jmp dword ptr [00402000]
:0040114C00000000000000000000   BYTE 10 DUP(0)
:0040115600000000000000000000   BYTE 10 DUP(0)
:0040116000000000000000000000   BYTE 10 DUP(0)
:0040116A00000000000000000000   BYTE 10 DUP(0)
:0040117400000000000000000000   BYTE 10 DUP(0)
:0040117E00000000000000000000   BYTE 10 DUP(0)
:0040118800000000000000000000   BYTE 10 DUP(0)
:0040119200000000000000000000   BYTE 10 DUP(0)
:0040119C00000000000000000000   BYTE 10 DUP(0)
:004011A600000000000000000000   BYTE 10 DUP(0)
:004011B000000000000000000000   BYTE 10 DUP(0)
:004011BA00000000000000000000   BYTE 10 DUP(0)
:004011C400000000000000000000   BYTE 10 DUP(0)
:004011CE00000000000000000000   BYTE 10 DUP(0)
:004011D800000000000000000000   BYTE 10 DUP(0)
:004011E200000000000000000000   BYTE 10 DUP(0)
:004011EC00000000000000000000   BYTE 10 DUP(0)
:004011F600000000000000000000   BYTE 10 DUP(0)