Delphi寫的讀狗程式的簡單逆向對比.
標 題:Delphi寫的讀狗程式的簡單逆向對比.
發信人:nig
時 間:2005-01-04,10:35
詳細資訊:
是以前寫的一個程式,執行時帶上狗的驅動庫.這裡沒有帶編譯好的程式和庫,僅供參考吧!
程式只是表明了一種簡單的呼叫機制,以及對於Delphi的程式生成EXE之後用OD分析時具體的分析對比.很簡單的一個內容.
[最近還會公佈一個序號產生器的源程式]
WW:=1;
AssignFile(F,'DogData.txt'); //指定生成的資料檔案
Getmem(Buffer,101); //申請緩衝區
Buffer^:=' '; //實際應該給長101個空格
i:=$1; //初始返回值
j:=100; //讀資料的長度
While ((i<>0) and (j<>0)) do //讀狗，直到返回正確的值或長度為0
begin
i:=DRead(j,0,buffer^); //讀狗
dec(j);
label1.caption:=' '+inttostr(j+1); //讀到的位元組數-記數
end;
if i>0 then //未找到狗，出錯誤提示
begin
Application.MessageBox('沒有找到狗!','錯誤',0);
exit;
end;
Rewrite(F); //建立資料檔案，未做錯誤檢測
Writeln(F,'狗的資料：'); //名頭
str1:=Ansistring(Buffer^); //字元轉換
for i:=1 to j+1 do //變成字元。
begin
ch_hi:=ord(str1[i]) and $F0 shr 4; //取位元組的高位4個二進位制位
ch_LO:=ord(str1[i]) and $0F; //取位元組的低位4個二進位制位
if ch_hi>9 then write(f,chr(ch_hi+55)) else write(f,chr(ch_hi+48)); //換成字元
if ch_Lo>9 then write(f,chr(ch_Lo+55)) else write(f,chr(ch_Lo+48)); //換成字元
if i mod 16=0 then writeln(f) else write(f,' '); //寫到檔案裡
end;
closefile(F); //關閉檔案
freemem(buffer); //翻譯記憶體空間
0044F01C PUSH EBP
0044F01D MOV EBP,ESP
0044F01F ADD ESP,-1E0 ;申請的變數空間
0044F025 PUSH EBX
0044F026 PUSH ESI
0044F027 PUSH EDI
0044F028 XOR ECX,ECX
0044F02A MOV DWORD PTR SS:[EBP-1DC],ECX
0044F030 MOV DWORD PTR SS:[EBP-1E0],ECX
0044F036 MOV DWORD PTR SS:[EBP-8],ECX
0044F039 MOV EBX,EAX
0044F03B XOR EAX,EAX
0044F03D PUSH EBP
0044F03E PUSH wq.0044F254
0044F043 PUSH DWORD PTR FS:[EAX]
0044F046 MOV DWORD PTR FS:[EAX],ESP
0044F049 MOV DWORD PTR DS:[452BD8],1 ;初始變數WW:=1
0044F053 MOV EDX,wq.0044F26C ;ASCII "DogData.txt"
0044F058 LEA EAX,DWORD PTR SS:[EBP-1D8]
0044F05E CALL wq.00402C34 ；Assignfile(F,'DogData.txt')
0044F063 MOV EAX,65 ;GetMem(Buffer,101);
0044F068 CALL wq.004026FC ;執行函式GetMEM
0044F06D MOV DWORD PTR SS:[EBP-4],EAX ；返回值
0044F070 MOV EAX,DWORD PTR SS:[EBP-4] ；buffer^進行了初始化
0044F073 MOV EDX,wq.0044F280 ; ASCII " "
0044F078 CALL wq.0040436C ;格式串
0044F07D MOV EDI,1 ;i:=$1
0044F082 MOV ESI,64 ;j:=100
0044F087 JMP SHORT wq.0044F0D3
0044F089 /MOV EAX,DWORD PTR SS:[EBP-4] while (i<>0 and j<>0) do
0044F08C |MOV EAX,DWORD PTR DS:[EAX]
0044F08E |PUSH EAX
0044F08F |PUSH 0
0044F091 |PUSH ESI
0044F092 |CALL <JMP.&win32.DRead> ;讀狗
0044F097 |MOV EDI,EAX ；i:=DRead(*,*,*)返回值
0044F099 |DEC ESI ；dec(j)
0044F09A |LEA EAX,DWORD PTR DS:[ESI+1]
0044F09D |XOR EDX,EDX
0044F09F |PUSH EDX ; /Arg2 => 00000000
0044F0A0 |PUSH EAX ; |Arg1
0044F0A1 |LEA EAX,DWORD PTR SS:[EBP-1E0] ; |
0044F0A7 |CALL wq.0040815C ; \Inttostr(j)
0044F0AC |MOV ECX,DWORD PTR SS:[EBP-1E0]
0044F0B2 |LEA EAX,DWORD PTR SS:[EBP-1DC]
0044F0B8 |MOV EDX,wq.0044F2F0
0044F0BD |CALL wq.00404624 ;串合併
0044F0C2 |MOV EDX,DWORD PTR SS:[EBP-1DC]
0044F0C8 |MOV EAX,DWORD PTR DS:[EBX+300]
0044F0CE |CALL wq.0042E38C ;
0044F0D3 TEST EDI,EDI ;i=0不
0044F0D5 |JE SHORT wq.0044F0DB
0044F0D7 |TEST ESI,ESI ;j=0不
0044F0D9 \JNZ SHORT wq.0044F089
0044F0DB TEST EDI,EDI ;if (i>0) then
0044F0DD JBE SHORT wq.0044F0FC
0044F0DF PUSH 0 ;i>0了,則進入此,要出錯了
0044F0E1 MOV ECX,wq.0044F2F4
0044F0E6 MOV EDX,wq.0044F2FC
0044F0EB MOV EAX,DWORD PTR DS:[450FD4]
0044F0F0 MOV EAX,DWORD PTR DS:[EAX]
0044F0F2 CALL wq.0044DACC ;Applicatin.Messagebox('','',0);
0044F0F7 JMP wq.0044F22E ;exit;
0044F0FC LEA EAX,DWORD PTR SS:[EBP-1D8] ; Rewrite(F); //名頭
0044F102 CALL wq.004029D0 ; Writeln(F,'狗的資料：');
0044F107 CALL wq.00402864 ; str1:=Ansistring(Buffer^); //字元轉換
0044F10C MOV EDX,wq.0044F310
0044F111 LEA EAX,DWORD PTR SS:[EBP-1D8]
0044F117 CALL wq.004049C8
0044F11C CALL wq.004030A8 ;字元
0044F121 CALL wq.00402864
0044F126 LEA EAX,DWORD PTR SS:[EBP-8]
0044F129 MOV EDX,DWORD PTR SS:[EBP-4]
0044F12C MOV EDX,DWORD PTR DS:[EDX]
0044F12E CALL wq.004043B0
0044F133 INC ESI
0044F134 TEST ESI,ESI
0044F136 JBE wq.0044F216
0044F13C MOV EDI,1 ;生成字元處了
0044F141 /MOV EAX,DWORD PTR SS:[EBP-8]
0044F144 |MOV AL,BYTE PTR DS:[EAX+EDI-1]
0044F148 |MOV EBX,EAX
0044F14A |AND BL,0F0 ;and $F0
0044F14D |AND EBX,0FF
0044F153 |SHR EBX,4 ;Shr 4
0044F156 |AND AL,0F ;and $0F
0044F158 |MOV BYTE PTR SS:[EBP-9],AL ;變到變數裡
0044F15B |CMP BL,9 if ch_hi>9
0044F15E |JBE SHORT wq.0044F17E
0044F160 |XOR EDX,EDX
0044F162 |MOV DL,BL
0044F164 |ADD EDX,37 ;ch_hi+55
0044F167 |LEA EAX,DWORD PTR SS:[EBP-1D8]
0044F16D |CALL wq.0040306C
0044F172 |CALL wq.00402CF0
0044F177 |CALL wq.00402864
0044F17C |JMP SHORT wq.0044F19A
0044F17E |XOR EDX,EDX
0044F180 |MOV DL,BL
0044F182 |ADD EDX,30 ;ch_hi+48
0044F185 |LEA EAX,DWORD PTR SS:[EBP-1D8]
0044F18B |CALL wq.0040306C
0044F190 |CALL wq.00402CF0
0044F195 |CALL wq.00402864
0044F19A |CMP BYTE PTR SS:[EBP-9],9 ;if ch_lo>9
0044F19E |JBE SHORT wq.0044F1BF
0044F1A0 |XOR EDX,EDX
0044F1A2 |MOV DL,BYTE PTR SS:[EBP-9]
0044F1A5 |ADD EDX,37 ;ch_lo+55
0044F1A8 |LEA EAX,DWORD PTR SS:[EBP-1D8]
0044F1AE |CALL wq.0040306C
0044F1B3 |CALL wq.00402CF0
0044F1B8 |CALL wq.00402864
0044F1BD |JMP SHORT wq.0044F1DC
0044F1BF |XOR EDX,EDX
0044F1C1 |MOV DL,BYTE PTR SS:[EBP-9]
0044F1C4 |ADD EDX,30 ;ch_lo+48
0044F1C7 |LEA EAX,DWORD PTR SS:[EBP-1D8]
0044F1CD |CALL wq.0040306C
0044F1D2 |CALL wq.00402CF0
0044F1D7 |CALL wq.00402864
0044F1DC |MOV EAX,EDI ;i mod 16
0044F1DE |AND EAX,0F
0044F1E1 |TEST EAX,EAX ;if (i mod 16=0)
0044F1E3 |JNZ SHORT wq.0044F1F7
0044F1E5 |LEA EAX,DWORD PTR SS:[EBP-1D8]
0044F1EB |CALL wq.004030A8
0044F1F0 |CALL wq.00402864
0044F1F5 |JMP SHORT wq.0044F20E
0044F1F7 |MOV DL,20
0044F1F9 |LEA EAX,DWORD PTR SS:[EBP-1D8]
0044F1FF |CALL wq.0040306C
0044F204 |CALL wq.00402CF0
0044F209 |CALL wq.00402864
0044F20E |INC EDI
0044F20F |DEC ESI
0044F210 \JNZ wq.0044F141
0044F216 LEA EAX,DWORD PTR SS:[EBP-1D8]
0044F21C CALL wq.00402CFC
0044F221 CALL wq.00402864
0044F226 MOV EAX,DWORD PTR SS:[EBP-4]
0044F229 CALL wq.0040271C
0044F22E XOR EAX,EAX
0044F230 POP EDX
0044F231 POP ECX
0044F232 POP ECX
0044F233 MOV DWORD PTR FS:[EAX],EDX
0044F236 PUSH wq.0044F25B
0044F23B LEA EAX,DWORD PTR SS:[EBP-1E0]
0044F241 MOV EDX,2
0044F246 CALL wq.0040433C
0044F24B LEA EAX,DWORD PTR SS:[EBP-8]
0044F24E CALL wq.00404318
0044F253 RETN
0044F254 JMP wq.00403D1C
0044F259 JMP SHORT wq.0044F23B
0044F25B POP EDI
0044F25C POP ESI
0044F25D POP EBX
0044F25E MOV ESP,EBP
0044F260 POP EBP
0044F261 RETN
相關文章
- 使用Delphi，SDK編寫Windows簡單程式 (轉)2007-12-13Windows
- 一個用delphi寫的整合彙編與api的簡單的視窗程式2013-07-26API
- iOS 簡單資料的讀寫2016-05-07iOS
- Kotlin和Java的簡單對比2018-06-21KotlinJava
- Delphi的元件讀寫機制（一） (轉)2007-12-04元件
- Delphi的元件讀寫機制(二） (轉)2007-12-04元件
- Delphi的元件讀寫機制(三） (轉)2007-08-15元件
- 【翻譯】Delphi中類的逆向工程2015-11-15
- Python影像讀寫方法對比2020-11-14Python
- EasyReact的簡單試用及和RAC的對比2018-08-21React
- php對mysql簡單讀取的例項2014-01-16PHPMySql
- 【GO】Elasticsearch的簡單寫入和讀取示例2018-07-19GoElasticsearch
- ListView 與 RecyclerView 簡單對比2018-08-25View
- Python實現簡單的excel對比工具2021-04-22PythonExcel
- React 中的新舊 Context 簡單對比2018-02-26ReactContext
- Oracle/MySQL/PostgreSQL 簡單查詢的效能對比2016-04-02OracleMySql
- iOS逆向之四 FishHook的簡單使用2019-04-04iOSHook
- C編寫的簡單密碼程式2012-06-29密碼
- 比較簡單的win32 OpenGL 程式2014-03-29Win32
- mORMot 1.18 第07章 簡單的讀寫操作2024-04-28ORM
- 簡單對比git pull和git pull --rebase的使用2016-09-22Git
- RxJava2與RxJava1的簡單對比2017-05-18RxJava
- HTTPS SPDY和 HTTP/2效能的簡單對比2015-01-21HTTP
- 日誌收集工具簡單對比2020-07-22
- 編寫簡單的Java程式碼：HelloWorid2024-04-29Java
- Delphi逆向工程筆記[1]2004-10-27筆記
- Delphi逆向工程筆記[2]2004-10-27筆記
- Delphi逆向工程筆記[3]2004-10-27筆記
- Delphi逆向工程筆記[4]2004-10-28筆記
- Delphi逆向工程筆記[5]2004-11-11筆記
- Delphi寫小執行程式2002-03-07行程
- 程式猿與產品狗的真實寫照？2013-08-18
- Delphi 簡單命名管道在兩個程式間通訊2014-10-10
- 對VM逆向的分析(CTF)(比較經典的一個虛擬機器逆向題目)2021-06-04虛擬機
- 用Delphi編寫點對點傳檔案程式(1) (轉)2008-04-23
- 用Delphi編寫點對點傳檔案程式(2) (轉)2008-04-23
- linux讀寫檔案 簡單版2021-01-02Linux
- javascript讀寫cookie操作簡單介紹2017-06-19JavaScriptCookie