電子科技大學(xué)逆向工程實(shí)驗(yàn)報(bào)告作業(yè)

實(shí)驗(yàn)報(bào)告

20152*03**0*日期2016.7.15130,推。高難斷地升快速高效已項(xiàng)敗鍵之提高率擇尤要特IDE避地要隱藏大量節(jié)包含大量價(jià)值四時(shí)避免地要合使,加快調(diào)試速提高效率調(diào)試環(huán)節(jié)動態(tài)調(diào)試使調(diào)試很難看各效中占據(jù)當(dāng)要的地位必要它們做探討。ExrExr超強(qiáng)視化 iVB快速32位執(zhí)譯并修改其中資強(qiáng)大視化漢化集直接瀏覽修改包括菜對話框字符串表；W32DASMPEditorPE頭輯更修損壞資PE格式的如BPDPSYSCPOCSCR32位執(zhí)該支持插增加插加強(qiáng)該公司中捆綁UPX脫殼插掃描.口口延遲入表使您可查看執(zhí)外部其中包含DLL類VCPE/COFFMicrosoftCOFF(DUMPBIN.EXE)(COFF)DUMPBINCOFF、標(biāo)準(zhǔn)COFF、執(zhí)行動態(tài)鏈接(DLL)DLL中所輸符號的清單LINK.exe(COFF)鏈接起創(chuàng)建執(zhí)行(.exe)或動態(tài)鏈接(DLL)。五． 源程序notepad.cpp：notepad::notepad(QWidget*parent):QMainWindow(parent),ui(newUi::notepad){ui->setupUi(this);this->setWindowTitle("newfile");QObject::connect(ui->New,SIGNAL(triggered()),this,SLOT(NewFile()));QObject::connect(ui->Open,SIGNAL(triggered()),this,SLOT(OpenFile()));QObject::connect(ui->Save,SIGNAL(triggered()),this,SLOT(SaveFile()));QObject::connect(ui->SaveAs,SIGNAL(triggered()),this,SLOT(SaveAsFile()));QObject::connect(ui->Coloraction,SIGNAL(triggered()),this,SLOT(SetColor()));QObject::connect(ui->Fontaction,SIGNAL(triggered()),this,SLOT(SetFont()));QObject::connect(ui->Aboutaction,SIGNAL(triggered()),this,SLOT(About()));QObject::connect(ui->Helpaction,SIGNAL(triggered()),this,SLOT(Help()));}notepad::~notepad(){deleteui;}voidnotepad::changeEvent(QEvent*e){switch(e->type()){caseQEvent::LanguageChange:ui->retranslateUi(this);break;default:}}voidnotepad::NewFile(){this->setWindowTitle("newfile");ui->Text->clear();}voidnotepad::OpenFile(){QString =Q(this,"get(),"(*.*)");if(!()){QFile*file=newQFile;file->set();if(file->open(QIODevice::ReadOnly)==true){QTextStreamin(file);ui->Text->setText(in.readAll());this->setWindowTitle();}else{QMessageBox::information(this,"ERROROccurs","exist");}deletefile;}}voidnotepad::SaveFile(){QString =this->windowTitle();// if(("newfile")!=0)// {QFile*file=newQFile;file->set();if(file->open(QIODevice::WriteOnly)==true){QTextStreamout(file);out<Text->toPlainText();deletefile;}else{QMessageBox::information(this,"ERROROccurs","error");}// }}voidnotepad::SaveAsFile(){QString =Q(this,"saveQFile*file=newQFile;file->set();if(file->open(QIODevice::WriteOnly)==true){QTextStreamout(file);out<Text->toPlainText();file->close();deletefile;}else{QMessageBox::information(this,"ERROROccurs","error");}}voidnotepad::SetColor(){QColorcolor=QColorDialog::getColor(Qt::white,this);if(color.isValid()==true){ui->Text->setTextColor(color);}else{QMessageBox::information(this,"ERROROccurs","setcolorerror");}}voidnotepad::SetFont(){boolok;QFontfont=QFontDialog::getFont(&ok,QFont("Arial",18),this,"setfont");if(ok){ui->Text->setFont(font);}else{QMessageBox::information(this,"ERROROccurs","setfonterror");}}voidnotepad::About(){Dialogmychild;mychild.exec();}voidnotepad::Help()voidnotepad::Help(){}Plho5lVC++p0行9C/C++是已翻此外還時(shí)是無知道那地址因些生些指令時(shí)只能放占位符樣信息。和列或數(shù)據(jù)空間，用使用了這一術(shù)語。鏈接器空間分配是指根據(jù)PE文件格式規(guī)范個(gè)動態(tài)鏈接庫里變量。象這些同樣要生成信息。為了減少干擾，將源程序進(jìn)行Release 編譯。在工程Release 目錄可以看到notepad.obj文件。在"開始">"MicrosoftVisualStudio2005"->"VisualStudioTools"->"Visualdumpbin信息。由于導(dǎo)出信息很多，只列出如下幾個(gè)0D500000000SECT30notype()External|_WinMain@1601D00000000SECT5notype()External|?Get(voidcdeclGet(void))07D00000000SECT21notype()External|?WndProc@@YGJPAUHWND@@IIJ@Z(longstdcallWndProc(structHWND*,unsignedint,unsignedint,long))SECT8notype()External|?(boolcdecl(structHWND*,char*))原因在于，C++函數(shù)載導(dǎo)致。函數(shù)載使得，相同函數(shù)名稱卻有不同函數(shù)簽明。所以不經(jīng)數(shù)名稱進(jìn)行易容處理(mangle)，相反過程叫作復(fù)容處理(demangle)。PE/COFF格式VC/C++鏈接器，生成PE格式，PE格式一類文件規(guī)范，這個(gè)規(guī)范明確指x86保護(hù)模式的COFF就是目標(biāo)文件*.obj格式規(guī)范。PE文件另一個(gè)名稱就是映象文件，說它*.dll*.exe*.comPE8086PEPE.text;.rdata;.data;.bss;.idataDLL;.rsrc、菜單、位等。現(xiàn)PEExplorer對notepad.exe程序進(jìn)逆向5示以知道程序口點(diǎn)0x000028DFh。PEExplorernotepad.exe目錄區(qū)頭分別到了目錄區(qū)段頭調(diào)協(xié)定調(diào)協(xié)定規(guī)定了調(diào)參傳遞方返回值傳遞方應(yīng)程序二進(jìn)制兼必規(guī)范調(diào)協(xié)定下方1 stdcall于調(diào)Win32API采stdcall約定參按照從右到左順序入retn直接清理傳遞參堆棧2_cdecl:C,。對于傳送。另外在函名修飾方面也有所不同。fastcall它ECXEDX傳送前兩個(gè)雙字（DWORD）或更小剩下仍舊自向傳送被函在返回前清理傳送內(nèi)存。4傳遞分析在目標(biāo)程中有這樣一個(gè)函聲明如下：BOOLShow(HWNDhwnd,HDChDC,HDROPhDropInfo)發(fā)生地方為：Show(hwnd,hDC,hDropInfo);可以看到最后一條指令堆平衡傳遞了三個(gè)每個(gè)400Cho都ebp來做基址尋址取到說明前兩個(gè)不局部變量。傳遞方向從到依次。堆平衡又概念。幀實(shí)質(zhì)就一個(gè)函所堆都平衡了那么整個(gè)程8所示，函體第一條指令就ebpVC/C++EAX、ECX、EDX是易變也就是說調(diào)一個(gè)函數(shù)之前應(yīng)自已先把它們保起來