汇编高手进 ( 积分: 300 )

006BB068 /$ 55 PUSH EBP
006BB069 |. 8BEC MOV EBP,ESP
006BB06B |. 83C4 F4 ADD ESP,-0C
006BB06E |. 8955 F8 MOV DWORD PTR SS:[EBP-8],EDX
006BB071 |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
006BB074 |. B9 E5037079 MOV ECX,797003E5
006BB079 |. BA CA4F9C82 MOV EDX,829C4FCA
006BB07E |. B8 541E3D80 MOV EAX,803D1E54
006BB083 |. E8 A4BEE8FF CALL TMyProj_.00546F2C
006BB088 |. 6A 00 PUSH 0
/Arg2 = 00000000
006BB08A |. 6A 00 PUSH 0
|Arg1 = 00000000
006BB08C |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
|
006BB08F |. E8 C067D6FF CALL TMyProj_.00421854
/TMyProj_.00421854
006BB094 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
006BB097 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
006BB09A |. 8B80 B0030000 MOV EAX,DWORD PTR DS:[EAX+3B0]
006BB0A0 |. E8 6F2EE9FF CALL TMyProj_.0054DF14
006BB0A5 |. B2 01 MOV DL,1
006BB0A7 |. A1 0CCA4100 MOV EAX,DWORD PTR DS:[41CA0C]
006BB0AC |. E8 5F8CD4FF CALL TMyProj_.00403D10
006BB0B1 |. 8945 F4 MOV DWORD PTR SS:[EBP-C],EAX
006BB0B4 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
006BB0B7 |. 8B80 B0030000 MOV EAX,DWORD PTR DS:[EAX+3B0]
006BB0BD |. 83C0 44 ADD EAX,44
006BB0C0 |. BA 08B16B00 MOV EDX,TMyProj_.006BB108
ASCII "C4957F19233163BB2144A4E3CF32CD39"
006BB0C5 |. E8 DE9AD4FF CALL TMyProj_.00404BA8
006BB0CA |. 33C9 XOR ECX,ECX
006BB0CC |. 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C]
006BB0CF |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
006BB0D2 |. 8B80 B0030000 MOV EAX,DWORD PTR DS:[EAX+3B0]
006BB0D8 |. E8 6B38E9FF CALL TMyProj_.0054E948
006BB0DD |. 33D2 XOR EDX,EDX
006BB0DF |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
006BB0E2 |. 8B80 B0030000 MOV EAX,DWORD PTR DS:[EAX+3B0]
006BB0E8 |. E8 272EE9FF CALL TMyProj_.0054DF14
006BB0ED |. 6A 00 PUSH 0
/Arg2 = 00000000
006BB0EF |. 6A 00 PUSH 0
|Arg1 = 00000000
006BB0F1 |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
|
006BB0F4 |. E8 5B67D6FF CALL TMyProj_.00421854
/TMyProj_.00421854
006BB0F9 |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
006BB0FC |. 8BE5 MOV ESP,EBP
006BB0FE |. 5D POP EBP
006BB0FF /. C3 RETN

上面是一个加密压缩的算法汇编 谁能看出这是什么算法？

006BB068 /$ 55 PUSH EBP
006BB069 |. 8BEC MOV EBP,ESP
006BB06B |. 83C4 F4 ADD ESP,-0C
006BB06E |. 8955 F8 MOV DWORD PTR SS:[EBP-8],EDX
006BB071 |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
006BB074 |. B9 E5037079 MOV ECX,797003E5
006BB079 |. BA CA4F9C82 MOV EDX,829C4FCA
006BB07E |. B8 541E3D80 MOV EAX,803D1E54
006BB083 |. E8 A4BEE8FF CALL TMyProj_.00546F2C
006BB088 |. 6A 00 PUSH 0
/Arg2 = 00000000
006BB08A |. 6A 00 PUSH 0
|Arg1 = 00000000
006BB08C |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
|
006BB08F |. E8 C067D6FF CALL TMyProj_.00421854
/TMyProj_.00421854
006BB094 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
006BB097 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
006BB09A |. 8B80 B0030000 MOV EAX,DWORD PTR DS:[EAX+3B0]
006BB0A0 |. E8 6F2EE9FF CALL TMyProj_.0054DF14
006BB0A5 |. B2 01 MOV DL,1
006BB0A7 |. A1 0CCA4100 MOV EAX,DWORD PTR DS:[41CA0C]
006BB0AC |. E8 5F8CD4FF CALL TMyProj_.00403D10
006BB0B1 |. 8945 F4 MOV DWORD PTR SS:[EBP-C],EAX
006BB0B4 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
006BB0B7 |. 8B80 B0030000 MOV EAX,DWORD PTR DS:[EAX+3B0]
006BB0BD |. 83C0 44 ADD EAX,44
006BB0C0 |. BA 08B16B00 MOV EDX,TMyProj_.006BB108
ASCII "C4957F19233163BB2144A4E3CF32CD39"
006BB0C5 |. E8 DE9AD4FF CALL TMyProj_.00404BA8
006BB0CA |. 33C9 XOR ECX,ECX
006BB0CC |. 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C]
006BB0CF |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
006BB0D2 |. 8B80 B0030000 MOV EAX,DWORD PTR DS:[EAX+3B0]
006BB0D8 |. E8 6B38E9FF CALL TMyProj_.0054E948
006BB0DD |. 33D2 XOR EDX,EDX
006BB0DF |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
006BB0E2 |. 8B80 B0030000 MOV EAX,DWORD PTR DS:[EAX+3B0]
006BB0E8 |. E8 272EE9FF CALL TMyProj_.0054DF14
006BB0ED |. 6A 00 PUSH 0
/Arg2 = 00000000
006BB0EF |. 6A 00 PUSH 0
|Arg1 = 00000000
006BB0F1 |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
|
006BB0F4 |. E8 5B67D6FF CALL TMyProj_.00421854
/TMyProj_.00421854
006BB0F9 |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
006BB0FC |. 8BE5 MOV ESP,EBP
006BB0FE |. 5D POP EBP
006BB0FF /. C3 RETN

上面是一个加密压缩的算法汇编 谁能看出这是什么算法？

用过16位汇编，32位汇编不会，内存模式也不同

看起来贼拉恐怖，

好像用的什么库。你贴的这点汇编一点用也没有。给个程序下载地址吧。

真够晕的.楼主,你没见里边好几个CALL,全都CALL除去了,分析什么.
还有你可以用IDA PRO 4.8(GOOOOGLE)分析一下,可读性会好一些。
还有函数调用的参数传递有几个__stdcall自然是最好看的,全部push,还有其他一些__cdecl/__fastcall等,有可能直接使用寄存器传递参数,这些都是需要仔细分析的.

这点代码是看不出什么的，但根据这个数据，有可能是MD5加密的
006BB0C0 |. BA 08B16B00 MOV EDX,TMyProj_.006BB108
ASCII "C4957F19233163BB2144A4E3CF32CD39"

呵呵。。。
看样子好象是DEC加密：ASCII "C4957F19233163BB2144A4E3CF32CD39"（字符长度32位）。

诚挚邀请您加入我的群，共同探讨delphi的问题，群号：4963281，谢谢！