滴水逆向_esp寻址
作业：
官网上下载程序。
载入od ，找到main函数，然后找到注册窗口函数 的参数的寄存器。
00401000 /$ 83EC 44 sub esp,0x44
00401003 |. 56 push esi
00401004 |. 8B7424 4C mov esi,dword ptr ss:[esp+0x4C]
00401008 |. 57 push edi ; 找出三个.<ModuleEntryPoint>
00401009 |. B9 09000000 mov ecx,0x9
0040100E |. 33C0 xor eax,eax ; 找出三个.00400000
00401010 |. 8D7C24 28 lea edi,dword ptr ss:[esp+0x28]
00401014 |. C74424 24 000>mov dword ptr ss:[esp+0x24],0x0
0040101C |. 68 8A7F0000 push 0x7F8A ; /RsrcName = IDC_APPSTARTING
00401021 |. F3:AB rep stos dword ptr es:[edi] ; |
00401023 |. 50 push eax ; |hInst = 00400000
00401024 |. 8935 20994000 mov dword ptr ds:[0x409920],esi ; |
0040102A |. C74424 48 040>mov dword ptr ss:[esp+0x48],0x4 ; |
00401032 |. FF15 BC604000 call dword ptr ds:[<&USER32.LoadCursorA>>; \LoadCursorA
00401038 |. C74424 28 F01>mov dword ptr ss:[esp+0x28],找出三个.004010F>
00401040 |. C74424 48 407>mov dword ptr ss:[esp+0x48],找出三个.0040704>; ASCII "My First Window"
00401048 |. 894424 3C mov dword ptr ss:[esp+0x3C],eax ; 找出三个.00400000
0040104C |. 8D4424 24 lea eax,dword ptr ss:[esp+0x24]
00401050 |. 50 push eax ; /pWndClass = 找出三个.00400000
00401051 |. 897424 38 mov dword ptr ss:[esp+0x38],esi ; |
00401055 |. FF15 C0604000 call dword ptr ds:[<&USER32.RegisterClas>; \RegisterClassA
0040105B |. 6A 00 push 0x0 ; /lParam = NULL
0040105D |. 56 push esi ; |hInst = NULL
0040105E |. 6A 00 push 0x0 ; |hMenu = NULL
00401060 |. 6A 00 push 0x0 ; |hParent = NULL
00401062 |. 68 2C010000 push 0x12C ; |Height = 12C (300.)
00401067 |. 68 58020000 push 0x258 ; |Width = 258 (600.)
0040106C |. 6A 0A push 0xA ; |Y = A (10.)
0040106E |. 6A 0A push 0xA ; |X = A (10.)
00401070 |. 68 0000CF00 push 0xCF0000 ; |Style = WS_OVERLAPPED|WS_MINIMIZEBOX|WS_MAXIMIZEBOX|WS_SYSMENU|WS_THICKFRAME|WS_CAPTION
00401075 |. 68 30704000 push 找出三个.00407030 ; |WindowName = "我的第一个窗口"
0040107A |. 68 40704000 push 找出三个.00407040 ; |Class = "My First Window"
0040107F |. 6A 00 push 0x0 ; |ExtStyle = 0
00401081 |. FF15 C4604000 call dword ptr ds:[<&USER32.CreateWindow>; \CreateWindowExA
00401087 |. 8BF0 mov esi,eax ; 找出三个.00400000
00401089 |. 85F6 test esi,esi
0040108B |. 74 54 je short 找出三个.004010E1
0040108D |. 6A 05 push 0x5 ; /ShowState = SW_SHOW
0040108F |. 56 push esi ; |hWnd = NULL
00401090 |. FF15 C8604000 call dword ptr ds:[<&USER32.ShowWindow>] ; \ShowWindow
00401096 |. 56 push esi ; /hWnd = NULL
00401097 |. FF15 CC604000 call dword ptr ds:[<&USER32.UpdateWindow>; \UpdateWindow
0040109D |. 8B35 D0604000 mov esi,dword ptr ds:[<&USER32.GetMessag>; user32.GetMessageA
004010A3 |. 6A 00 push 0x0 ; /MsgFilterMax = 0x0
004010A5 |. 6A 00 push 0x0 ; |MsgFilterMin = 0x0
004010A7 |. 8D4C24 10 lea ecx,dword ptr ss:[esp+0x10] ; |
图上401050 寄存器就是 消息类地址 。
存的是19fec0 这个就是窗口类的首地址找到10个结构成员。
其中经过分析 有一个就是处理函数地址。
转到。4010f0
004010F0 . 8B4424 08 mov eax,dword ptr ss:[esp+0x8] ; 消息处理函数地址
004010F4 . 83EC 20 sub esp,0x20
004010F7 . 3D 01020000 cmp eax,0x201 ; Switch (cases 2..204)
004010FC . 57 push edi
004010FD . 0F87 DB000000 ja 找出三个.004011DE
00401103 . 0F84 B8000000 je 找出三个.004011C1
00401109 . 8BC8 mov ecx,eax
0040110B . 83E9 02 sub ecx,0x2
0040110E . 0F84 9C000000 je 找出三个.004011B0
00401114 . 81E9 FE000000 sub ecx,0xFE
0040111A . 0F85 C5000000 jnz 找出三个.004011E5
00401120 . 8B4424 30 mov eax,dword ptr ss:[esp+0x30] ; Case 100 (WM_KEYDOWN) of switch 004010F7
00401124 . 83F8 41 cmp eax,0x41 ; Switch (cases 41..67)
00401127 . 74 49 je short 找出三个.00401172
00401129 . 83F8 46 cmp eax,0x46
0040112C . 74 33 je short 找出三个.00401161
0040112E . 83F8 67 cmp eax,0x67
00401131 . 74 1D je short 找出三个.00401150
00401133 . 6A 00 push 0x0 ; /Style = MB_OK|MB_APPLMODAL; Default case of switch 00401124
00401135 . 68 68704000 push 找出三个.00407068 ; |Title = "ERROR"
0040113A . 68 5C704000 push 找出三个.0040705C ; |Text = "ErrorCode"
0040113F . 6A 00 push 0x0 ; |hOwner = NULL
00401141 . FF15 B0604000 call dword ptr ds:[<&USER32.MessageBoxA>>; \MessageBoxA
00401147 . 33C0 xor eax,eax
00401149 . 5F pop edi ; 0019FEC0
0040114A . 83C4 20 add esp,0x20
0040114D . C2 1000 retn 0x10
00401150 > B9 08000000 mov ecx,0x8 ; Case 67 ('g') of switch 00401124
00401155 . 33C0 xor eax,eax
00401157 . 8D7C24 04 lea edi,dword ptr ss:[esp+0x4]
0040115B . 6A 67 push 0x67
0040115D . F3:AB rep stos dword ptr es:[edi]
0040115F . EB 20 jmp short 找出三个.00401181
00401161 > B9 08000000 mov ecx,0x8 ; Case 46 ('F') of switch 00401124
00401166 . 33C0 xor eax,eax
00401168 . 8D7C24 04 lea edi,dword ptr ss:[esp+0x4]
0040116C . 6A 46 push 0x46
0040116E . F3:AB rep stos dword ptr es:[edi]
00401170 . EB 0F jmp short 找出三个.00401181
00401172 > B9 08000000 mov ecx,0x8 ; Case 41 ('A') of switch 00401124
00401177 . 33C0 xor eax,eax
00401179 . 8D7C24 04 lea edi,dword ptr ss:[esp+0x4]
0040117D . 6A 41 push 0x41
0040117F . F3:AB rep stos dword ptr es:[edi]
00401181 > 8D4424 08 lea eax,dword ptr ss:[esp+0x8]
00401185 . 68 58704000 push 找出三个.00407058 ; ASCII "%d\n"
0040118A . 50 push eax
0040118B . E8 90000000 call 找出三个.00401220
可以看到很明显了，三个键。