通过OllyDbg调试windows窗口程序

来源：互联网发布：centos kvm 多主机编辑：程序博客网时间：2024/06/16 05:04

1.OllyDeg找到GetDlgItemTextA函数的入口地址

2.获取文本内容后汇编指令

004011C8   .  FFD7          call    edi                             ; \GetDlgItemTextA004011CA   .  8A4424 4C     mov     al, byte ptr [esp+4C]004011CE   .  84C0          test    al, al004011D0   .  74 76         je      short 00401248004011D2   .  83FB 05       cmp     ebx, 5004011D5   .  7C 71         jl      short 00401248004011D7   .  8D5424 4C     lea     edx, dword ptr [esp+4C]004011DB   .  53            push    ebx;函数的参数1004011DC   .  8D8424 A00000>lea     eax, dword ptr [esp+A0]004011E3   .  52            push    edx;函数的参数2004011E4   .  50            push    eax;函数的参数3004011E5   .  E8 56010000   call    00401340;函数的入口地址004011EA   .  8B3D BC404000       mov     edi, dword ptr [<&USER32.GetDlgI>;  USER32.GetDlgItem

3.函数的内部处理过程

00401340  /$  55            push    ebp00401341  |.  8B6C24 0C     mov     ebp, dword ptr [esp+C]00401345  |.  56            push    esi00401346  |.  57            push    edi00401347  |.  8B7C24 18     mov     edi, dword ptr [esp+18]0040134B  |.  B9 03000000   mov     ecx, 300401350  |.  33F6          xor     esi, esi00401352  |.  33C0          xor     eax, eax00401354  |.  3BF9          cmp     edi, ecx00401356  |.  7E 21         jle     short 0040137900401358  |.  53            push    ebx00401359  |>  83F8 07       /cmp     eax, 70040135C  |.  7E 02         |jle     short 004013600040135E  |.  33C0          |xor     eax, eax00401360  |>  33D2          |xor     edx, edx00401362  |.  33DB          |xor     ebx, ebx00401364  |.  8A1429        |mov     dl, byte ptr [ecx+ebp]00401367  |.  8A98 30504000 |mov     bl, byte ptr [eax+405030]0040136D  |.  0FAFD3        |imul    edx, ebx00401370  |.  03F2          |add     esi, edx00401372  |.  41            |inc     ecx00401373  |.  40            |inc     eax00401374  |.  3BCF          |cmp     ecx, edi00401376  |.^ 7C E1         \jl      short 0040135900401378  |.  5B            pop     ebx00401379  |>  56            push    esi                              ; /<%ld>0040137A  |.  68 78504000   push    00405078                         ; |Format = "%ld"0040137F  |.  55            push    ebp                              ; |s00401380  |.  FF15 9C404000 call    dword ptr [<&USER32.wsprintfA>]  ; \wsprintfA00401386  |.  8B4424 1C     mov     eax, dword ptr [esp+1C]0040138A  |.  83C4 0C       add     esp, 0C0040138D  |.  55            push    ebp                              ; /String20040138E  |.  50            push    eax                              ; |String10040138F  |.  FF15 04404000 call    dword ptr [<&KERNEL32.lstrcmpA>] ; \lstrcmpA00401395  |.  F7D8          neg     eax00401397  |.  1BC0          sbb     eax, eax00401399  |.  5F            pop     edi0040139A  |.  5E            pop     esi0040139B  |.  40            inc     eax0040139C  |.  5D            pop     ebp0040139D  \.  C3            retn0040139E      90            nop0040139F      90            nop

4.根据函数的返回值判断是否指令

004011E5   .  E8 56010000         call    00401340004011EA   .  8B3D BC404000       mov     edi, dword ptr [<&USER32.GetDlgI>;  USER32.GetDlgItem004011F0   .  83C4 0C             add     esp, 0C004011F3   .  85C0                test    eax, eax004011F5   .  74 37               je      short 0040122E

je short 0040122E 返回值为FALSE就跳转否则正常执行

阅读全文

0 0