Windows下反匯編程序例子

1、Windows下反匯編程序例子Windows下編寫的程序經(jīng)編譯鏈接之后,就可用debug等調(diào)試工具調(diào)試執(zhí)行,也能看到反匯編的結(jié)果,這很便于理解“匯編指令”是如何翻譯成“機(jī)器指令”的。對(duì)Windows程序,這樣的工具有很多,像SoftICE、TRW、W32dasm、IDA、Hiew等。這里準(zhǔn)備談一下W32dasm(點(diǎn)此下載。;=;例:取命令行參數(shù),并顯示到消息框中;文件名:6.asm.386.model flat,stdcalloption casemap:noneinclude windows.inc ;常量及結(jié)構(gòu)定義include kernel32.inc ;函數(shù)原型聲明include us

2、er32.incincludelib kernel32.lib ;用到的引入庫(kù)includelib user32.lib.dataszCaption db 命令行參數(shù),0.codestart:invoke GetCommandLineinvoke MessageBox,NULL,eax,addr szCaption,MB_OKinvoke ExitProcess,NULLend start-用到API函數(shù):LPTSTR GetCommandLine(VOIDThis function has no parameters.The return value is a pointer to the

3、command-line string for the current proces s.-編譯鏈接:-下面使用W32dasm來(lái)反匯編6.exe。啟動(dòng)W32dasm,從菜單Disassembler中選Open File to Disassemble.,從出現(xiàn)的對(duì)話框中選擇要進(jìn)行反匯編的程序,比如6.exe并打開。若首次使用該反匯編工具,屏幕顯示可能有點(diǎn)亂,執(zhí)行Disassembler/Font./Select Fon t選擇合適的字體即可解決該問(wèn)題。執(zhí)行Disassembler/Font./Save Default Font,這樣下次啟動(dòng)該軟件時(shí)也不會(huì)亂啦。下面是6.exe反匯編后的結(jié)果:Di

4、sassembly of File: 6.exeCode Offset = 00000400, Code Size = 00000200Data Offset = 00000800, Data Size = 00000200Number of Objects = 0003 (dec, Imagebase = 00400000hObject01: .text RVA: 00001000 Offset: 00000400 Size: 00000200 Flags: 60000020 Object02: .rdata RVA: 00002000 Offset: 00000600 Size: 0000

5、0200 Flags: 40000040 Object03: .data RVA: 00003000 Offset: 00000800 Size: 00000200 Flags: C0000040+ MENU INFORMATION +There Are No Menu Resources in This Application+ DIALOG INFORMATION +There Are No Dialog Resources in This Application+ IMPORTED FUNCTIONS +Number of Imported Modules = 2 (decimal ;本

6、程序用到兩個(gè)引入庫(kù)Import Module 001: KERNEL32.dllImport Module 002: USER32.dll+ IMPORT MODULE DETAILS +Import Module 001: KERNEL32.dll ;要用到本庫(kù)中下面兩個(gè)函數(shù)Addr:00002072 hint(00B6 Name: GetCommandLineAAddr:00002064 hint(0075 Name: ExitProcessImport Module 002: USER32.dllAddr:00002092 hint(01BB Name: MessageBoxA+ EXP

7、ORTED FUNCTIONS +Number of Exported Functions = 0000 (decimal+ ASSEMBLY CODE LISTING +/* Start of Code in Object .text * Program Entry Point = 00401000 (6.exe File Offset:00001600* Reference To: KERNEL32.GetCommandLineA, Ord:00B6h|/* Program Entry Point * ;程序入口點(diǎn):00401000 E81D000000 Call 00401022 ;取命

8、令行參數(shù):00401005 6A00 push 00000000:00401007 680E304000 push 0040300E:0040100C 50 push eax:0040100D 6A00 push 00000000* Reference To: USER32.MessageBoxA, Ord:01BBh|:0040100F E814000000 Call 00401028 ;顯示消息框:00401014 6A00 push 00000000* Reference To: KERNEL32.ExitProcess, Ord:0075h|:00401016 E801000000 C

9、all 0040101C ;結(jié)束程序:0040101B CC int 03* Referenced by a CALL at Address:|:00401016|* Reference To: KERNEL32.ExitProcess, Ord:0075h|:0040101C FF2504204000 Jmp dword ptr 00402004 ;轉(zhuǎn)到ExitProcess去執(zhí)行* Referenced by a CALL at Address:|:00401000|* Reference To: KERNEL32.GetCommandLineA, Ord:00B6h|:00401022

10、FF2500204000 Jmp dword ptr 00402000 ;轉(zhuǎn)到GetCommandLine去執(zhí)行* Reference To: USER32.MessageBoxA, Ord:01BBh|:00401028 FF250C204000 Jmp dword ptr 0040200C ;轉(zhuǎn)到MessageBoxA去執(zhí)行-問(wèn)題:為什么invoke GetCommandLine在編譯時(shí)沒直接翻譯成Call dword ptr 00402000而用下面的形式呢?:00401000 E81D000000 Call 00401022 ;取命令行參數(shù). . . .:00401022 FF2500204000 Jmp dword ptr 00402000 轉(zhuǎn)到GetCommandLine去執(zhí)行注意:加載器在加載程序時(shí),還存在一個(gè)重定位的問(wèn)題,即動(dòng)態(tài)鏈接庫(kù)中的函數(shù)的地址必須