请帮我分析个汇编问题。(100分)

  • 主题发起人 主题发起人 fd151711
  • 开始时间 开始时间
F

fd151711

Unregistered / Unconfirmed
GUEST, unregistred user!
004A0050 >/> /55 push ebp
004A0051 |. 8BEC mov ebp, esp
004A0053 |. B8 48100000 mov eax, 1048
004A0058 |. E8 53280C00 call _chkstk
004A005D |. 53 push ebx
004A005E |. 56 push esi
004A005F |. 57 push edi
004A0060 |. 8B45 08 mov eax, [ebp+8]
004A0063 |. 8945 FC mov [ebp-4], eax
004A0066 |. 8B4D FC mov ecx, [ebp-4]
004A0069 |. 8A55 0C mov dl, [ebp+C]
004A006C |. 8851 03 mov [ecx+3], dl
004A006F |. C685 FCEFFFFF>mov byte ptr [ebp-1004], 0
004A0076 |. B9 FF030000 mov ecx, 3FF
004A007B |. 33C0 xor eax, eax
004A007D |. 8DBD FDEFFFFF lea edi, [ebp-1003]
004A0083 |. F3:AB rep stos dword ptr es:[edi]
004A0085 |. 66:AB stos word ptr es:[edi]
004A0087 |. AA stos byte ptr es:[edi]
004A0088 |. 68 00010000 push 100 ; /n = 100 (256.)
004A008D |. 6A 00 push 0 ; |c = 00
004A008F |. 8B45 FC mov eax, [ebp-4] ; |
004A0092 |. 83C0 0D add eax, 0D ; |
004A0095 |. 50 push eax ; |s
004A0096 |. E8 D5210C00 call memset ; /memset
004A009B |. 83C4 0C add esp, 0C
004A009E |. 8D4D 14 lea ecx, [ebp+14]
004A00A1 |. 898D F8EFFFFF mov [ebp-1008], ecx
004A00A7 |. 8B95 F8EFFFFF mov edx, [ebp-1008]
004A00AD |. 52 push edx ; /arglist
004A00AE |. 8B45 10 mov eax, [ebp+10] ; |
004A00B1 |. 50 push eax ; |format
004A00B2 |. 8D8D FCEFFFFF lea ecx, [ebp-1004] ; |
004A00B8 |. 51 push ecx ; |buffer
004A00B9 |. E8 3A2A0C00 call vsprintf ; /vsprintf
004A00BE |. 83C4 0C add esp, 0C
004A00C1 |. C785 F8EFFFFF>mov dword ptr [ebp-1008], 0
004A00CB |. 68 00010000 push 100
004A00D0 |. 8B55 FC mov edx, [ebp-4]
004A00D3 |. 83C2 0D add edx, 0D
004A00D6 |. 52 push edx
004A00D7 |. 8D85 FCEFFFFF lea eax, [ebp-1004]
004A00DD |. 50 push eax ; /s
004A00DE |. E8 7D290C00 call strlen ; /strlen
004A00E3 |. 83C4 04 add esp, 4
004A00E6 |. 50 push eax ; |StringSize
004A00E7 |. 8D8D FCEFFFFF lea ecx, [ebp-1004] ; |
004A00ED |. 51 push ecx ; |StringToMap
004A00EE |. 6A 00 push 0 ; |Options = 0
004A00F0 |. 68 EA040000 push 4EA ; |CodePage = 4EA
004A00F5 |. FF15 0C7FD906 call [<&KERNEL32.MultiByteToWideChar>>; /MultiByteToWideChar
004A00FB |. 8B55 FC mov edx, [ebp-4]
004A00FE |. C682 0B010000>mov byte ptr [edx+10B], 0
004A0105 |. 8B45 FC mov eax, [ebp-4]
004A0108 |. C680 0C010000>mov byte ptr [eax+10C], 0
004A010F |. 8B4D FC mov ecx, [ebp-4]
004A0112 |. 83C1 0D add ecx, 0D
004A0115 |. 51 push ecx ; /s
004A0116 |. E8 C0290C00 call wcslen ; /wcslen
004A011B |. 83C4 04 add esp, 4
004A011E |. 8D5400 12 lea edx, [eax+eax+12]
004A0122 |. 52 push edx
004A0123 |. 6A 0D push 0D
004A0125 |. 8B45 FC mov eax, [ebp-4]
004A0128 |. 50 push eax
004A0129 |. E8 5225F6FF call 00402680
004A012E |. 83C4 0C add esp, 0C
004A0131 |. 5F pop edi
004A0132 |. 5E pop esi ; gameserv.00403C15
004A0133 |. 5B pop ebx
004A0134 |. 8BE5 mov esp, ebp
004A0136 |. 5D pop ebp
004A0137 /. C3 retn
我想去掉 KERNEL32.MultiByteToWideChar
 
晕,去掉做什么哟,哪个函数是转换为双字节用的,
 
就是不想让他转换拉。
 
004A00ED |. 51 push ecx ; |StringToMap //这个是你要转换的字符,压入栈中
004A00EE |. 6A 00 push 0 ; |Options = 0
004A00F0 |. 68 EA040000 push 4EA ; |CodePage = 4EA
004A00F5 |. FF15 0C7FD906 call [<&KERNEL32.MultiByteToWideChar>>; /MultiByteToWideChar
004A00FB |. 8B55 FC mov edx, [ebp-4] ;//这个是转换完成的地址
你只要把这里,改成 mov edx, ecx
并把上面几句压栈,及调用 用修改软件如WinHex改成nop(nop 在汇编语言里为空操作,机器码为90),
 

Similar threads

A
回复
0
查看
1K
Andreas Hausladen
A
I
回复
0
查看
827
import
I
I
回复
0
查看
763
import
I
I
回复
0
查看
868
import
I
I
回复
0
查看
794
import
I
后退
顶部