网硕互联帮助中心
x32dbg/x64dbg逆向之反汇编if-else分析
1)反汇编if-else-if分析
咱们在正向开发的时候是不是经常使用到分支语句，那它在反编译中式什么样子呢？像汇编中的.if宏定义还是其他？在x32dbg/x64dbg调试逆向时，标准if-else固定由cmp/test比较，jxx条件跳转，jmp无条件跳转等指令组合而成，所以咱们先使用C语言写一个正向开发，然后在xdbg看一下它是什么样子的！
2）C语言案例代码
咱们在学习逆向分析的同时，同步梳理C和C++基础知识点，一正一反（正向开发，逆向分析）为后续深耕底层技术打好基础哦。
#define _CRT_SECURE_NO_WARNINGS
#include <stdio.h>
#include <string.h>
int main()
{
// Define the correct username and pwd
const char correctUser[] = "admin";
const char correctPwd[] = "123456";
// Store user input
char inputUser[50];
char inputPwd[50];
printf("Please input user name: ");
scanf("%s", inputUser);
printf("Please input password: ");
scanf("%s", inputPwd);
// strcmp returns 0 if two strings are equal
if (strcmp(inputUser, correctUser) == 0 && strcmp(inputPwd, correctPwd) == 0)
{
printf("\\nLogin Successful! Welcome, admin.\\n");
}
else
{
printf("\\nLogin failed.\\n");
}
printf("\\nYour input username: %s\\n", inputUser);
printf("Your input password: %s\\n", inputPwd);
return 0;
}
3）C语言案例代码1(多个if-else以及if-else嵌套)
咱们在学习逆向分析的同时，同步梳理C和C++基础知识点，一正一反（正向开发，逆向分析）为后续深耕底层技术打好基础哦。
#define _CRT_SECURE_NO_WARNINGS
#include <stdio.h>
int main()
{
int score;
printf("Please enter your exam score (0-100): ");
scanf("%d", &score);
// Multi-layer nested if-else
if (score >= 0 && score <= 100)
{
if (score >= 90)
{
printf("Grade: A (Excellent)\\n");
}
else if (score >= 80)
{
printf("Grade: B (Good)\\n");
}
else if (score >= 70)
{
printf("Grade: C (Medium)\\n");
}
else if (score >= 60)
{
printf("Grade: D (Pass)\\n");
}
else
{
printf("Grade: E (Fail)\\n");
if (score < 30)
{
printf("Warning: poor performance, need intensive review!\\n");
}
else
{
printf("Tip: review can help you pass next time.\\n");
}
}
}
else
{
printf("Error: The score you entered is invalid, please input a number between 0 and 100.\\n");
}
return 0;
}
4）反向分析指针单个 if-else,
x64Debug版本
00007FF69E3C1930 | 40:55 | push rbp | FileName.cpp:6
00007FF69E3C1932 | 56 | push rsi |
00007FF69E3C1933 | 57 | push rdi |
00007FF69E3C1934 | 48:81EC C0010000 | sub rsp,1C0 |
00007FF69E3C193B | 48:8D6C24 20 | lea rbp,qword ptr ss:[rsp+20] | [rsp+20]:__scrt_release_startup_lock+D
00007FF69E3C1940 | 48:8D7C24 20 | lea rdi,qword ptr ss:[rsp+20] | [rsp+20]:__scrt_release_startup_lock+D
00007FF69E3C1945 | B9 38000000 | mov ecx,38 | 38:'8'
00007FF69E3C194A | B8 CCCCCCCC | mov eax,CCCCCCCC |
00007FF69E3C194F | F3:AB | rep stosd |
00007FF69E3C1951 | 48:8B05 E8B60000 | mov rax,qword ptr ds:[<__security_cookie>] |
00007FF69E3C1958 | 48:33C5 | xor rax,rbp |
00007FF69E3C195B | 48:8985 98010000 | mov qword ptr ss:[rbp+198],rax |
00007FF69E3C1962 | 48:8D0D A5060100 | lea rcx,qword ptr ds:[<__14F49BB1_FileName@cpp>] | FileName.cpp:15732480
00007FF69E3C1969 | E8 3EFAFFFF | call project1.7FF69E3C13AC |
00007FF69E3C196E | 90 | nop |
00007FF69E3C196F | 48:8D45 04 | lea rax,qword ptr ss:[rbp+4] | FileName.cpp:8，const char correctUser[] = "admin"，获取栈上正确密码缓冲区地
00007FF69E3C1973 | 48:8D0D CA940000 | lea rcx,qword ptr ds:[<"admin"…>] | 00007FF69E3CAE44:"admin"，获取只读段字符串 "admin" 地址
00007FF69E3C197A | 48:8BF8 | mov rdi,rax | rdi = 目标缓冲区：correctUser数组
00007FF69E3C197D | 48:8BF1 | mov rsi,rcx | rsi = 源字符串：admin常量
00007FF69E3C1980 | B9 06000000 | mov ecx,6 | 拷贝长度 6 字节
00007FF69E3C1985 | F3:A4 | rep movsb | 循环逐字节拷贝admin到栈数组
00007FF69E3C1987 | 48:8D45 24 | lea rax,qword ptr ss:[rbp+24] | FileName.cpp:9，const char correctPwd[] = "123456"，同上面的原理
00007FF69E3C198B | 48:8D0D BA940000 | lea rcx,qword ptr ds:[<"123456"…>] | 00007FF69E3CAE4C:"123456"
00007FF69E3C1992 | 48:8BF8 | mov rdi,rax |
00007FF69E3C1995 | 48:8BF1 | mov rsi,rcx |
00007FF69E3C1998 | B9 07000000 | mov ecx,7 |
00007FF69E3C199D | F3:A4 | rep movsb |
00007FF69E3C199F | 48:8D0D B2940000 | lea rcx,qword ptr ds:[<"Please input user name: "…>] | FileName.cpp:15, 00007FF69E3CAE58:"Please input user name: "
00007FF69E3C19A6 | E8 ADF8FFFF | call project1.7FF69E3C1258 |
00007FF69E3C19AB | 90 | nop |
00007FF69E3C19AC | 48:8D55 48 | lea rdx,qword ptr ss:[rbp+48] | FileName.cpp:16
00007FF69E3C19B0 | 48:8D0D C1940000 | lea rcx,qword ptr ds:[<"%s"…>] | 00007FF69E3CAE78:"%s"
00007FF69E3C19B7 | E8 B0F8FFFF | call project1.7FF69E3C126C |
00007FF69E3C19BC | 90 | nop |
00007FF69E3C19BD | 48:8D0D BC940000 | lea rcx,qword ptr ds:[<"Please input password: "…>] | FileName.cpp:18, 00007FF69E3CAE80:"Please input password: "
00007FF69E3C19C4 | E8 8FF8FFFF | call project1.7FF69E3C1258 |
00007FF69E3C19C9 | 90 | nop |
00007FF69E3C19CA | 48:8D95 98000000 | lea rdx,qword ptr ss:[rbp+98] | FileName.cpp:19
00007FF69E3C19D1 | 48:8D0D A0940000 | lea rcx,qword ptr ds:[<"%s"…>] | 00007FF69E3CAE78:"%s"
00007FF69E3C19D8 | E8 8FF8FFFF | call project1.7FF69E3C126C |
00007FF69E3C19DD | 90 | nop |
00007FF69E3C19DE | 48:8D55 04 | lea rdx,qword ptr ss:[rbp+4] | FileName.cpp:22，strcmp(inputUser, correctUser) == 0
00007FF69E3C19E2 | 48:8D4D 48 | lea rcx,qword ptr ss:[rbp+48] |
00007FF69E3C19E6 | E8 9CF6FFFF | call project1.7FF69E3C1087 |
00007FF69E3C19EB | 85C0 | test eax,eax |
00007FF69E3C19ED | 75 23 | jne project1.7FF69E3C1A12 | 如果失败跳转到失败提示
00007FF69E3C19EF | 48:8D55 24 | lea rdx,qword ptr ss:[rbp+24] | && strcmp(inputPwd, correctPwd) == 0
00007FF69E3C19F3 | 48:8D8D 98000000 | lea rcx,qword ptr ss:[rbp+98] |
00007FF69E3C19FA | E8 88F6FFFF | call project1.7FF69E3C1087 |
00007FF69E3C19FF | 85C0 | test eax,eax | if (strcmp(inputUser, correctUser) == 0)
00007FF69E3C1A01 | 75 0F | jne project1.7FF69E3C1A12 | 如果失败跳转到失败提示
00007FF69E3C1A03 | 48:8D0D 96940000 | lea rcx,qword ptr ds:[<"\\nLogin Successful! Welcome, admi"…>] | FileName.cpp:24, 00007FF69E3CAEA0:"\\nLogin Successful! Welcome, admin.\\n"
00007FF69E3C1A0A | E8 49F8FFFF | call project1.7FF69E3C1258 | printf
00007FF69E3C1A0F | 90 | nop |
00007FF69E3C1A10 | EB 0D | jmp project1.7FF69E3C1A1F | FileName.cpp:25
00007FF69E3C1A12 | 48:8D0D B7940000 | lea rcx,qword ptr ds:[<"\\nLogin failed.\\n"…>] | FileName.cpp:28, 00007FF69E3CAED0:"\\nLogin failed.\\n"
00007FF69E3C1A19 | E8 3AF8FFFF | call project1.7FF69E3C1258 | printf
00007FF69E3C1A1E | 90 | nop |
00007FF69E3C1A1F | 48:8D55 48 | lea rdx,qword ptr ss:[rbp+48] | FileName.cpp:31
00007FF69E3C1A23 | 48:8D0D BE940000 | lea rcx,qword ptr ds:[<"\\nYour input username: %s\\n"…>] | 00007FF69E3CAEE8:"\\nYour input username: %s\\n"
00007FF69E3C1A2A | E8 29F8FFFF | call project1.7FF69E3C1258 | printf
00007FF69E3C1A2F | 90 | nop |
00007FF69E3C1A30 | 48:8D95 98000000 | lea rdx,qword ptr ss:[rbp+98] | FileName.cpp:32
00007FF69E3C1A37 | 48:8D0D CA940000 | lea rcx,qword ptr ds:[<"Your input password: %s\\n"…>] | 00007FF69E3CAF08:"Your input password: %s\\n"
00007FF69E3C1A3E | E8 15F8FFFF | call project1.7FF69E3C1258 | printf
00007FF69E3C1A43 | 90 | nop |
00007FF69E3C1A44 | 33C0 | xor eax,eax | FileName.cpp:34，将 eax 寄存器清零
00007FF69E3C1A46 | 8BF8 | mov edi,eax | FileName.cpp:35
00007FF69E3C1A48 | 48:8D4D E0 | lea rcx,qword ptr ss:[rbp-20] |
00007FF69E3C1A4C | 48:8D15 9D930000 | lea rdx,qword ptr ds:[7FF69E3CADF0] | rdx:&"C:\\\\Users\\\\Admin\\\\source\\\\repos\\\\Project1\\\\x64\\\\Debug\\\\Project1.exe"
00007FF69E3C1A53 | E8 0CF6FFFF | call project1.7FF69E3C1064 |
00007FF69E3C1A58 | 8BC7 | mov eax,edi |
00007FF69E3C1A5A | 48:8B8D 98010000 | mov rcx,qword ptr ss:[rbp+198] | 栈数据，与rbp寄存器异或操作，用于安全校验/解密等等
00007FF69E3C1A61 | 48:33CD | xor rcx,rbp | 调用内存安全校验
00007FF69E3C1A64 | E8 14F6FFFF | call project1.7FF69E3C107D |
00007FF69E3C1A69 | 48:8DA5 A0010000 | lea rsp,qword ptr ss:[rbp+1A0] | 开始平栈
00007FF69E3C1A70 | 5F | pop rdi |
00007FF69E3C1A71 | 5E | pop rsi |
00007FF69E3C1A72 | 5D | pop rbp |
00007FF69E3C1A73 | C3 | ret |
|
x64Release版本
00007FF779AE10D0 | 48:81EC B8000000 | sub rsp,B8 | FileName.cpp:6
00007FF779AE10D7 | 48:8B05 221F0000 | mov rax,qword ptr ds:[<__security_cookie>] | rax:mainCRTStartup
00007FF779AE10DE | 48:33C4 | xor rax,rsp | rax:mainCRTStartup
00007FF779AE10E1 | 48:898424 A0000000 | mov qword ptr ss:[rsp+A0],rax | rax:mainCRTStartup
00007FF779AE10E9 | 8B05 21110000 | mov eax,dword ptr ds:[<"admin"…>] | FileName.cpp:8, 00007FF779AE2210:"admin"，读取常量字符串"admin"前4字节
00007FF779AE10EF | 48:8D0D 2A110000 | lea rcx,qword ptr ds:[<"Please input user name: "…>] | FileName.cpp:15, 00007FF779AE2220:"Please input user name: "
00007FF779AE10F6 | 894424 28 | mov dword ptr ss:[rsp+28],eax | 将常量admin写入栈用户名缓冲区，ss:[rsp+28],eax
00007FF779AE10FA | 0FB705 13110000 | movzx eax,word ptr ds:[7FF779AE2214] | 读取admin两字节并零扩展
00007FF779AE1101 | 66:894424 2C | mov word ptr ss:[rsp+2C],ax | 将剩余两个字节写入缓冲区，完成admin拷贝
00007FF779AE1106 | 8B05 0C110000 | mov eax,dword ptr ds:[<"123456"…>] | 00007FF779AE2218:"123456"
00007FF779AE110C | 894424 20 | mov dword ptr ss:[rsp+20],eax |
00007FF779AE1110 | 0FB705 05110000 | movzx eax,word ptr ds:[7FF779AE221C] | 00007FF779AE221C:"56"
00007FF779AE1117 | 66:894424 24 | mov word ptr ss:[rsp+24],ax |
00007FF779AE111C | 0FB605 FB100000 | movzx eax,byte ptr ds:[7FF779AE221E] |
00007FF779AE1123 | 884424 26 | mov byte ptr ss:[rsp+26],al |
00007FF779AE1127 | E8 F4FEFFFF | call <project1.printf> |
00007FF779AE112C | 48:8D5424 30 | lea rdx,qword ptr ss:[rsp+30] | FileName.cpp:16, rdx:mainCRTStartup, [rsp+30]:RtlUserThreadStart+2C
00007FF779AE1131 | 48:8D0D 04110000 | lea rcx,qword ptr ds:[<"%s"…>] | 00007FF779AE223C:"%s"
00007FF779AE1138 | E8 43FFFFFF | call <project1.scanf> |
00007FF779AE113D | 48:8D0D FC100000 | lea rcx,qword ptr ds:[<"Please input password: "…>] | FileName.cpp:18, 00007FF779AE2240:"Please input password: "
00007FF779AE1144 | E8 D7FEFFFF | call <project1.printf> |
00007FF779AE1149 | 48:8D5424 68 | lea rdx,qword ptr ss:[rsp+68] | FileName.cpp:19, rdx:mainCRTStartup
00007FF779AE114E | 48:8D0D E7100000 | lea rcx,qword ptr ds:[<"%s"…>] | 00007FF779AE223C:"%s"
00007FF779AE1155 | E8 26FFFFFF | call <project1.scanf> |
00007FF779AE115A | 48:8D5424 28 | lea rdx,qword ptr ss:[rsp+28] | FileName.cpp:22, rdx:mainCRTStartup ，rdx=正确用户名admin缓冲区，strcmp参数1
00007FF779AE115F | 48:8D4C24 30 | lea rcx,qword ptr ss:[rsp+30] | [rsp+30]:RtlUserThreadStart+2C ，rcx=用户输入用户名缓冲区，strcmp参数2
00007FF779AE1164 | E8 EC0D0000 | call <project1.strcmp> | 对比输入用户名与标准用户名
00007FF779AE1169 | 85C0 | test eax,eax | 判断strcmp返回值，eax=0代表匹配
00007FF779AE116B | 75 1A | jne project1.7FF779AE1187 | 用户名不对，跳登录失败分支
00007FF779AE116D | 48:8D5424 20 | lea rdx,qword ptr ss:[rsp+20] | rdx:mainCRTStartup ， rdx=标准密码123456缓冲区
00007FF779AE1172 | 48:8D4C24 68 | lea rcx,qword ptr ss:[rsp+68] | rcx=用户输入密码缓冲区
00007FF779AE1177 | E8 D90D0000 | call <project1.strcmp> | 对比输入密码与标准密码
00007FF779AE117C | 48:8D0D D5100000 | lea rcx,qword ptr ds:[<"\\nLogin Successful! Welcome, admi"…>] | FileName.cpp:24, 00007FF779AE2258:"\\nLogin Successful! Welcome, admin.\\n" ， 加载登录成功提示文本
00007FF779AE1183 | 85C0 | test eax,eax | 判断密码比较结果
00007FF779AE1185 | 74 07 | je project1.7FF779AE118E | 密码不对，跳过失败提示
00007FF779AE1187 | 48:8D0D F2100000 | lea rcx,qword ptr ds:[<"\\nLogin failed.\\n"…>] | FileName.cpp:28, 00007FF779AE2280:"\\nLogin failed.\\n" | 加载登录失败提示字符串
00007FF779AE118E | E8 8DFEFFFF | call <project1.printf> | FileName.cpp:31 ， 打印成功/失败提示信息
00007FF779AE1193 | 48:8D5424 30 | lea rdx,qword ptr ss:[rsp+30] | rdx:mainCRTStartup, [rsp+30]:RtlUserThreadStart+2C
00007FF779AE1198 | 48:8D0D F1100000 | lea rcx,qword ptr ds:[<"\\nYour input username: %s\\n"…>] | 00007FF779AE2290:"\\nYour input username: %s\\n"
00007FF779AE119F | E8 7CFEFFFF | call <project1.printf> |
00007FF779AE11A4 | 48:8D5424 68 | lea rdx,qword ptr ss:[rsp+68] | FileName.cpp:32, rdx:mainCRTStartup
00007FF779AE11A9 | 48:8D0D 00110000 | lea rcx,qword ptr ds:[<"Your input password: %s\\n"…>] | 00007FF779AE22B0:"Your input password: %s\\n"
00007FF779AE11B0 | E8 6BFEFFFF | call <project1.printf> |
00007FF779AE11B5 | 33C0 | xor eax,eax | FileName.cpp:34
00007FF779AE11B7 | 48:8B8C24 A0000000 | mov rcx,qword ptr ss:[rsp+A0] | FileName.cpp:35
00007FF779AE11BF | 48:33CC | xor rcx,rsp |
00007FF779AE11C2 | E8 19000000 | call <project1.__security_check_cookie> |
00007FF779AE11C7 | 48:81C4 B8000000 | add rsp,B8 | 栈平衡
00007FF779AE11CE | C3 | ret |
x86Debug版本
000D1940 | 55 | push ebp | FileName.cpp:6
000D1941 | 8BEC | mov ebp,esp |
000D1943 | 81EC 5C010000 | sub esp,15C |
000D1949 | 53 | push ebx |
000D194A | 56 | push esi | esi:__enc$textbss$end+37F
000D194B | 57 | push edi | edi:__enc$textbss$end+37F
000D194C | 8DBD 64FFFFFF | lea edi,dword ptr ss:[ebp-9C] | edi:__enc$textbss$end+37F
000D1952 | B9 27000000 | mov ecx,27 | ecx:__enc$textbss$end+37F, 27:'''
000D1957 | B8 CCCCCCCC | mov eax,CCCCCCCC | eax:"佚o"
000D195C | F3:AB | rep stosd |
000D195E | A1 00A00D00 | mov eax,dword ptr ds:[<___security_cook | eax:"佚o"
000D1963 | 33C5 | xor eax,ebp |
000D1965 | 8945 FC | mov dword ptr ss:[ebp-4],eax | [ebp-04]:BaseThreadInitThunk
000D1968 | B9 0EC00D00 | mov ecx,<project1._14F49BB1_FileName@cp | FileName.cpp:15732480, ecx:__enc$textbss$end+37F
000D196D | E8 B3F9FFFF | call project1.D1325 |
000D1972 | 90 | nop |
000D1973 | A1 307B0D00 | mov eax,dword ptr ds:[<"admin"…>] | FileName.cpp:8, eax:"佚o", 000D7B30:"admin"，读取全局常量用户名"admin"前4字节到
000D1978 | 8945 F0 | mov dword ptr ss:[ebp-10],eax | 常量用户名存入局部变量[ebp-0x10] 缓冲区中，类似x64中的ss:[rsp+28],eax
000D197B | 66:8B0D 347B0D00 | mov cx,word ptr ds:[D7B34] | 读取用户名剩余2字节
000D1982 | 66:894D F4 | mov word ptr ss:[ebp-C],cx | 补全局部正确用户名缓冲区
000D1986 | A1 387B0D00 | mov eax,dword ptr ds:[<"123456"…>] | FileName.cpp:9, eax:"佚o", 000D7B38:"123456"，同上原理
000D198B | 8945 E0 | mov dword ptr ss:[ebp-20],eax |
000D198E | 66:8B0D 3C7B0D00 | mov cx,word ptr ds:[D7B3C] | 000D7B3C:"56"
000D1995 | 66:894D E4 | mov word ptr ss:[ebp-1C],cx |
000D1999 | 8A15 3E7B0D00 | mov dl,byte ptr ds:[D7B3E] | 读取密码末尾单字节
000D199F | 8855 E6 | mov byte ptr ss:[ebp-1A],dl | 密码缓冲区收尾
000D19A2 | 68 407B0D00 | push <project1."Please input user name: | FileName.cpp:15, D7B40:"Please input user name: "
000D19A7 | E8 F2F8FFFF | call project1.D129E |
000D19AC | 83C4 04 | add esp,4 | 平衡栈
000D19AF | 8D45 A4 | lea eax,dword ptr ss:[ebp-5C] | FileName.cpp:16，用户输入的用户名
000D19B2 | 50 | push eax | eax:"佚o"
000D19B3 | 68 607B0D00 | push <project1."%s"…> | D7B60:"%s"
000D19B8 | E8 D8F7FFFF | call project1.D1195 |
000D19BD | 83C4 08 | add esp,8 |
000D19C0 | 68 647B0D00 | push <project1."Please input password: | FileName.cpp:18, D7B64:"Please input password: "
000D19C5 | E8 D4F8FFFF | call project1.D129E |
000D19CA | 83C4 04 | add esp,4 |
000D19CD | 8D85 68FFFFFF | lea eax,dword ptr ss:[ebp-98] | FileName.cpp:19，用户输入的密码
000D19D3 | 50 | push eax | eax:"佚o"
000D19D4 | 68 607B0D00 | push <project1."%s"…> | D7B60:"%s"
000D19D9 | E8 B7F7FFFF | call project1.D1195 |
000D19DE | 83C4 08 | add esp,8 |
000D19E1 | 8D45 F0 | lea eax,dword ptr ss:[ebp-10] | FileName.cpp:22， 正确用户名缓冲区地址
000D19E4 | 50 | push eax | eax:"佚o"，
000D19E5 | 8D4D A4 | lea ecx,dword ptr ss:[ebp-5C] | ecx:__enc$textbss$end+37F，用户输入的用户名
000D19E8 | 51 | push ecx | ecx:__enc$textbss$end+37F
000D19E9 | E8 BCF6FFFF | call project1.D10AA |
000D19EE | 83C4 08 | add esp,8 |
000D19F1 | 85C0 | test eax,eax | eax:"佚o"，比较用户名是否正确
000D19F3 | 75 26 | jne project1.D1A1B | 用户名不对吗，跳登录失败提示
000D19F5 | 8D45 E0 | lea eax,dword ptr ss:[ebp-20] | 正确密码缓冲区地址
000D19F8 | 50 | push eax | eax:"佚o"
000D19F9 | 8D8D 68FFFFFF | lea ecx,dword ptr ss:[ebp-98] | ecx:__enc$textbss$end+37F，用户输入的密码
000D19FF | 51 | push ecx | ecx:__enc$textbss$end+37F
000D1A00 | E8 A5F6FFFF | call project1.D10AA |
000D1A05 | 83C4 08 | add esp,8 |
000D1A08 | 85C0 | test eax,eax | eax:"佚o"，比较密码是否正确
000D1A0A | 75 0F | jne project1.D1A1B | 用户名不对吗，跳登录失败提示
000D1A0C | 68 807B0D00 | push <project1."\\nLogin Successful! Wel | FileName.cpp:24, D7B80:"\\nLogin Successful! Welcome, admin.\\n"
000D1A11 | E8 88F8FFFF | call project1.D129E |
000D1A16 | 83C4 04 | add esp,4 |
000D1A19 | EB 0D | jmp project1.D1A28 | FileName.cpp:25
000D1A1B | 68 AC7B0D00 | push <project1."\\nLogin failed.\\n"…> | FileName.cpp:28, D7BAC:"\\nLogin failed.\\n"
000D1A20 | E8 79F8FFFF | call project1.D129E |
000D1A25 | 83C4 04 | add esp,4 |
000D1A28 | 8D45 A4 | lea eax,dword ptr ss:[ebp-5C] | FileName.cpp:31
000D1A2B | 50 | push eax | eax:"佚o"
000D1A2C | 68 C07B0D00 | push <project1."\\nYour input username: | D7BC0:"\\nYour input username: %s\\n"
000D1A31 | E8 68F8FFFF | call project1.D129E |
000D1A36 | 83C4 08 | add esp,8 |
000D1A39 | 8D85 68FFFFFF | lea eax,dword ptr ss:[ebp-98] | FileName.cpp:32
000D1A3F | 50 | push eax | eax:"佚o"
000D1A40 | 68 E07B0D00 | push <project1."Your input password: %s | D7BE0:"Your input password: %s\\n"
000D1A45 | E8 54F8FFFF | call project1.D129E |
000D1A4A | 83C4 08 | add esp,8 |
000D1A4D | 33C0 | xor eax,eax | FileName.cpp:34, eax:"佚o"，开始返回值，调试检测，寄存器恢复，Cookie校验，平栈等
000D1A4F | 52 | push edx | FileName.cpp:35, edx:__enc$textbss$end+37F
000D1A50 | 8BCD | mov ecx,ebp | ecx:__enc$textbss$end+37F
000D1A52 | 50 | push eax | eax:"佚o"
000D1A53 | 8D15 801A0D00 | lea edx,dword ptr ds:[<>] | edx:__enc$textbss$end+37F
000D1A59 | E8 0EF8FFFF | call project1.D126C |
000D1A5E | 58 | pop eax | eax:"佚o"
000D1A5F | 5A | pop edx | edx:__enc$textbss$end+37F
000D1A60 | 5F | pop edi | edi:__enc$textbss$end+37F
000D1A61 | 5E | pop esi | esi:__enc$textbss$end+37F
000D1A62 | 5B | pop ebx |
000D1A63 | 8B4D FC | mov ecx,dword ptr ss:[ebp-4] | ecx:__enc$textbss$end+37F, [ebp-04]:BaseThreadInitThunk
000D1A66 | 33CD | xor ecx,ebp | ecx:__enc$textbss$end+37F
000D1A68 | E8 22F8FFFF | call project1.D128F |
000D1A6D | 81C4 5C010000 | add esp,15C |
000D1A73 | 3BEC | cmp ebp,esp |
000D1A75 | E8 D3F8FFFF | call project1.D134D |
000D1A7A | 8BE5 | mov esp,ebp |
000D1A7C | 5D | pop ebp |
000D1A7D | C3 | ret |
x86Release版
00441080 | 55 | push ebp | FileName.cpp:6，保存函数栈基址ebp
00441081 | 8BEC | mov ebp,esp |
00441083 | 83EC 7C | sub esp,7C | 扩张0x7C字节，分配局部变量存储空间
00441086 | A1 00304400 | mov eax,dword ptr ds:[<___security_cookie>] | eax:_mbcasemap+3DC
0044108B | 33C5 | xor eax,ebp | eax:_mbcasemap+3DC
0044108D | 8945 FC | mov dword ptr ss:[ebp-4],eax | eax:_mbcasemap+3DC
00441090 | A1 E8204400 | mov eax,dword ptr ds:[<"admin"…>] | FileName.cpp:8, eax:_mbcasemap+3DC, 004420E8:"admin"，同理常量admin获取赋值，零扩展等操作
00441095 | 8945 84 | mov dword ptr ss:[ebp-7C],eax | [ebp-7C]:pre_cpp_initialization, eax:_mbcasemap+3DC
00441098 | 0FB705 EC204400 | movzx eax,word ptr ds:[4420EC] | eax:_mbcasemap+3DC
0044109F | 66:8945 88 | mov word ptr ss:[ebp-78],ax |
004410A3 | A1 F0204400 | mov eax,dword ptr ds:[<"123456"…>] | FileName.cpp:9, eax:_mbcasemap+3DC, 004420F0:"123456"，同理常量123456获取赋值，零扩展等操作
004410A8 | 8945 8C | mov dword ptr ss:[ebp-74],eax | eax:_mbcasemap+3DC
004410AB | 0FB705 F4204400 | movzx eax,word ptr ds:[4420F4] | eax:_mbcasemap+3DC, 004420F4:"56"
004410B2 | 66:8945 90 | mov word ptr ss:[ebp-70],ax |
004410B6 | A0 F6204400 | mov al,byte ptr ds:[4420F6] |
004410BB | 68 F8204400 | push <project1."Please input user name: "…> | FileName.cpp:15, 4420F8:"Please input user name: "，提示和scanf开始接收用户输入的信息
004410C0 | 8845 92 | mov byte ptr ss:[ebp-6E],al |
004410C3 | E8 58FFFFFF | call <project1._printf> |
004410C8 | 8D45 C8 | lea eax,dword ptr ss:[ebp-38] | FileName.cpp:16, eax:_mbcasemap+3DC, [ebp-38]:&"ACSetupSvcPort=23210"
004410CB | 50 | push eax | eax:_mbcasemap+3DC
004410CC | 68 14214400 | push <project1."%s"…> | 442114:"%s"
004410D1 | E8 7AFFFFFF | call <project1._scanf> |
004410D6 | 68 18214400 | push <project1."Please input password: "…> | FileName.cpp:18, 442118:"Please input password: "，提示和scanf开始接收用户输入的信息
004410DB | E8 40FFFFFF | call <project1._printf> |
004410E0 | 8D45 94 | lea eax,dword ptr ss:[ebp-6C] | FileName.cpp:19, eax:_mbcasemap+3DC
004410E3 | 50 | push eax | eax:_mbcasemap+3DC
004410E4 | 68 14214400 | push <project1."%s"…> | 442114:"%s"
004410E9 | E8 62FFFFFF | call <project1._scanf> |
004410EE | 83C4 18 | add esp,18 |
004410F1 | 8D4D 84 | lea ecx,dword ptr ss:[ebp-7C] | FileName.cpp:22, ecx:___scrt_native_startup_lock, [ebp-7C]:pre_cpp_initialization
004410F4 | 8D45 C8 | lea eax,dword ptr ss:[ebp-38] | eax:_mbcasemap+3DC, [ebp-38]:&"ACSetupSvcPort=23210"
004410F7 | 8A10 | mov dl,byte ptr ds:[eax] | eax:_mbcasemap+3DC，用户名循环体入口
004410F9 | 3A11 | cmp dl,byte ptr ds:[ecx] | ecx:___scrt_native_startup_lock，对比用户名，但是和debug不一样是循环，用户名逐字节比对循环
004410FB | 75 1A | jne project1.441117 | 字符不相等对比失败，跳出循环
004410FD | 84D2 | test dl,dl | 判断当前读取字符是否为结束符'\\0'
004410FF | 74 12 | je project1.441113 | 读到'\\0'，用户名全部匹配成功
00441101 | 8A50 01 | mov dl,byte ptr ds:[eax+1] | eax+01:_mbcasemap+3DD，读取下一个字符+1
00441104 | 3A51 01 | cmp dl,byte ptr ds:[ecx+1] | ecx+01:__scrt_native_startup_lock+1
00441107 | 75 0E | jne project1.441117 |
00441109 | 83C0 02 | add eax,2 | eax:_mbcasemap+3DC，两个缓冲区指针都向后移动2字节，一次性跳过当前2个已比对字符
0044110C | 83C1 02 | add ecx,2 | ecx:___scrt_native_startup_lock
0044110F | 84D2 | test dl,dl | 判断第二个字符是否为字符串结束符'\\0'
00441111 | 75 E4 | jne project1.4410F7 | 未读到结束符，跳回循环开头继续比对字符
00441113 | 33C0 | xor eax,eax | eax:_mbcasemap+3DC，eax置0
00441115 | EB 05 | jmp project1.44111C | 无条件跳转，跳过下方失败代码段
00441117 | 1BC0 | sbb eax,eax | eax:_mbcasemap+3DC，CF=1，sbb会把eax全部置0xFFFFFFFF
00441119 | 83C8 01 | or eax,1 | eax:_mbcasemap+3DC
0044111C | 85C0 | test eax,eax | eax:_mbcasemap+3DC，检测eax是否为0
0044111E | 75 34 | jne project1.441154 | eax≠0，用户名不相等
00441120 | 8D4D 8C | lea ecx,dword ptr ss:[ebp-74] | ecx:___scrt_native_startup_lock，ecx指向标准密码缓冲区首地址
00441123 | 8D45 94 | lea eax,dword ptr ss:[ebp-6C] | eax:_mbcasemap+3DC，eax指向用户输入密码缓冲区首地址
00441126 | 8A10 | mov dl,byte ptr ds:[eax] | eax:_mbcasemap+3DC，密码循环体入口，密码逐字节比对循环
00441128 | 3A11 | cmp dl,byte ptr ds:[ecx] | ecx:___scrt_native_startup_lock，输入密码字符与标准密码对应字符对比
0044112A | 75 1A | jne project1.441146 | 字符不相等失败，跳出循环
0044112C | 84D2 | test dl,dl | 判断当前读取字符是否为结束符'\\0'
0044112E | 74 12 | je project1.441142 | 读到'\\0'，用户名全部匹配成功
00441130 | 8A50 01 | mov dl,byte ptr ds:[eax+1] | eax+01:_mbcasemap+3DD，读取下一个字符+1
00441133 | 3A51 01 | cmp dl,byte ptr ds:[ecx+1] | ecx+01:__scrt_native_startup_lock+1
00441136 | 75 0E | jne project1.441146 |
00441138 | 83C0 02 | add eax,2 | eax:_mbcasemap+3DC，两个缓冲区指针都向后移动2字节，一次性跳过当前2个已比对字符
0044113B | 83C1 02 | add ecx,2 | ecx:___scrt_native_startup_lock
0044113E | 84D2 | test dl,dl |
00441140 | 75 E4 | jne project1.441126 | 循环跳转接着检测
00441142 | 33C0 | xor eax,eax | eax:_mbcasemap+3DC
00441144 | EB 05 | jmp project1.44114B |
00441146 | 1BC0 | sbb eax,eax | eax:_mbcasemap+3DC
00441148 | 83C8 01 | or eax,1 | eax:_mbcasemap+3DC
0044114B | 85C0 | test eax,eax | eax:_mbcasemap+3DC
0044114D | B8 30214400 | mov eax,<project1."\\nLogin Successful! Welcome, admi"…> | FileName.cpp:24, eax:_mbcasemap+3DC, 442130:"\\nLogin Successful! Welcome, admin.\\n"
00441152 | 74 05 | je project1.441159 |
00441154 | B8 54214400 | mov eax,<project1."\\nLogin failed.\\n"…> | FileName.cpp:28, eax:_mbcasemap+3DC, 442154:"\\nLogin failed.\\n"
00441159 | 50 | push eax | FileName.cpp:31, eax:_mbcasemap+3DC
0044115A | E8 C1FEFFFF | call <project1._printf> |
0044115F | 8D45 C8 | lea eax,dword ptr ss:[ebp-38] | eax:_mbcasemap+3DC, [ebp-38]:&"ACSetupSvcPort=23210"
00441162 | 50 | push eax | eax:_mbcasemap+3DC
00441163 | 68 64214400 | push <project1."\\nYour input username: %s\\n"…> | 442164:"\\nYour input username: %s\\n"
00441168 | E8 B3FEFFFF | call <project1._printf> |
0044116D | 8D45 94 | lea eax,dword ptr ss:[ebp-6C] | FileName.cpp:32, eax:_mbcasemap+3DC
00441170 | 50 | push eax | eax:_mbcasemap+3DC
00441171 | 68 80214400 | push <project1."Your input password: %s\\n"…> | 442180:"Your input password: %s\\n"
00441176 | E8 A5FEFFFF | call <project1._printf> |
0044117B | 8B4D FC | mov ecx,dword ptr ss:[ebp-4] | FileName.cpp:35, ecx:___scrt_native_startup_lock
0044117E | 83C4 14 | add esp,14 |
00441181 | 33CD | xor ecx,ebp | ecx:___scrt_native_startup_lock
00441183 | 33C0 | xor eax,eax | eax:_mbcasemap+3DC
00441185 | E8 06000000 | call <project1.@__security_check_cookie@4> |
0044118A | 8BE5 | mov esp,ebp | 平栈收尾
0044118C | 5D | pop ebp | 恢复上层函数栈基址ebp
0044118D | C3 | ret |
5）反向分析多个if-else以及if-else嵌套
多个if-esle-if-esle-if分支中咱们会发现一个问题，它在汇编下面会多出一个jmp指令
x64Debug版本
00007FF697481930 | 40:55 | push rbp | FileName.cpp:5,创建栈帧，保存rbp，rsi，rdi
00007FF697481932 | 57 | push rdi |
00007FF697481933 | 48:81EC 08010000 | sub rsp,108 |
00007FF69748193A | 48:8D6C24 20 | lea rbp,qword ptr ss:[rsp+20] |
00007FF69748193F | 48:8D7C24 20 | lea rdi,qword ptr ss:[rsp+20] |
00007FF697481944 | B9 0A000000 | mov ecx,A | 0A:'\\n'
00007FF697481949 | B8 CCCCCCCC | mov eax,CCCCCCCC |
00007FF69748194E | F3:AB | rep stosd |
00007FF697481950 | 48:8B05 E9B60000 | mov rax,qword ptr ds:[<__security_cookie>] | rax:__enc$textbss$end+5A, 00007FF69748D040:"_OSg劌"
00007FF697481957 | 48:33C5 | xor rax,rbp | rax:__enc$textbss$end+5A
00007FF69748195A | 48:8985 D8000000 | mov qword ptr ss:[rbp+D8],rax | rax:__enc$textbss$end+5A
00007FF697481961 | 48:8D0D A0060100 | lea rcx,qword ptr ds:[<__14F49BB1_FileName@cpp>] | FileName.cpp:15732480
00007FF697481968 | E8 3FFAFFFF | call project1.7FF6974813AC |
00007FF69748196D | 90 | nop |
00007FF69748196E | 48:8D0D B3930000 | lea rcx,qword ptr ds:[<"Please enter your exam score (0-"…>] | FileName.cpp:8, 00007FF69748AD28:"Please enter your exam score (0-100): "
00007FF697481975 | E8 DEF8FFFF | call project1.7FF697481258 | printf
00007FF69748197A | 90 | nop |
00007FF69748197B | 48:8D55 04 | lea rdx,qword ptr ss:[rbp+4] | FileName.cpp:9, rdx:__enc$textbss$end+5A，接收用户输入
00007FF69748197F | 48:8D0D D2930000 | lea rcx,qword ptr ds:[<"%d"…>] | 00007FF69748AD58:"%d"
00007FF697481986 | E8 E1F8FFFF | call project1.7FF69748126C | scanf
00007FF69748198B | 90 | nop |
00007FF69748198C | 837D 04 00 | cmp dword ptr ss:[rbp+4],0 | FileName.cpp:12，比较用户输入的内容
00007FF697481990 | 0F8C 8F000000 | jl project1.7FF697481A25 | 如果小于零
00007FF697481996 | 837D 04 64 | cmp dword ptr ss:[rbp+4],64 | 64:'d'，比较用户输入的内容是否大于100
00007FF69748199A | 0F8F 85000000 | jg project1.7FF697481A25 | 如果大于100
00007FF6974819A0 | 837D 04 5A | cmp dword ptr ss:[rbp+4],5A | FileName.cpp:14, 5A:'Z'，if (score >= 90)
00007FF6974819A4 | 7C 0F | jl project1.7FF6974819B5 |
00007FF6974819A6 | 48:8D0D B3930000 | lea rcx,qword ptr ds:[<"Grade: A (Excellent)\\n"…>] | FileName.cpp:16, 00007FF69748AD60:"Grade: A (Excellent)\\n"
00007FF6974819AD | E8 A6F8FFFF | call project1.7FF697481258 |
00007FF6974819B2 | 90 | nop |
00007FF6974819B3 | EB 6E | jmp project1.7FF697481A23 | FileName.cpp:17
00007FF6974819B5 | 837D 04 50 | cmp dword ptr ss:[rbp+4],50 | FileName.cpp:18, 50:'P'，else if (score >= 80)
00007FF6974819B9 | 7C 0F | jl project1.7FF6974819CA |
00007FF6974819BB | 48:8D0D BE930000 | lea rcx,qword ptr ds:[<"Grade: B (Good)\\n"…>] | FileName.cpp:20, 00007FF69748AD80:"Grade: B (Good)\\n"
00007FF6974819C2 | E8 91F8FFFF | call project1.7FF697481258 |
00007FF6974819C7 | 90 | nop |
00007FF6974819C8 | EB 59 | jmp project1.7FF697481A23 | FileName.cpp:21
00007FF6974819CA | 837D 04 46 | cmp dword ptr ss:[rbp+4],46 | FileName.cpp:22, 46:'F'，else if (score >= 70)
00007FF6974819CE | 7C 0F | jl project1.7FF6974819DF |
00007FF6974819D0 | 48:8D0D C1930000 | lea rcx,qword ptr ds:[<"Grade: C (Medium)\\n"…>] | FileName.cpp:24, 00007FF69748AD98:"Grade: C (Medium)\\n"
00007FF6974819D7 | E8 7CF8FFFF | call project1.7FF697481258 |
00007FF6974819DC | 90 | nop |
00007FF6974819DD | EB 44 | jmp project1.7FF697481A23 | FileName.cpp:25
00007FF6974819DF | 837D 04 3C | cmp dword ptr ss:[rbp+4],3C | FileName.cpp:26, 3C:'<'， else if (score >= 60)
00007FF6974819E3 | 7C 0F | jl project1.7FF6974819F4 |
00007FF6974819E5 | 48:8D0D C4930000 | lea rcx,qword ptr ds:[<"Grade: D (Pass)\\n"…>] | FileName.cpp:28, 00007FF69748ADB0:"Grade: D (Pass)\\n"
00007FF6974819EC | E8 67F8FFFF | call project1.7FF697481258 |
00007FF6974819F1 | 90 | nop |
00007FF6974819F2 | EB 2F | jmp project1.7FF697481A23 | FileName.cpp:29
00007FF6974819F4 | 48:8D0D CD930000 | lea rcx,qword ptr ds:[<"Grade: E (Fail)\\n"…>] | FileName.cpp:32, 00007FF69748ADC8:"Grade: E (Fail)\\n"
00007FF6974819FB | E8 58F8FFFF | call project1.7FF697481258 |
00007FF697481A00 | 90 | nop |
00007FF697481A01 | 837D 04 1E | cmp dword ptr ss:[rbp+4],1E | FileName.cpp:34，if (score < 30)
00007FF697481A05 | 7D 0F | jge project1.7FF697481A16 |
00007FF697481A07 | 48:8D0D D2930000 | lea rcx,qword ptr ds:[<"Warning: poor performance, need "…>] | FileName.cpp:36, 00007FF69748ADE0:"Warning: poor performance, need intensive review!\\n"
00007FF697481A0E | E8 45F8FFFF | call project1.7FF697481258 |
00007FF697481A13 | 90 | nop |
00007FF697481A14 | EB 0D | jmp project1.7FF697481A23 | FileName.cpp:37
00007FF697481A16 | 48:8D0D 03940000 | lea rcx,qword ptr ds:[<"Tip: review can help you pass ne"…>] | FileName.cpp:40, 00007FF69748AE20:"Tip: review can help you pass next time.\\n",else
00007FF697481A1D | E8 36F8FFFF | call project1.7FF697481258 |
00007FF697481A22 | 90 | nop |
00007FF697481A23 | EB 0D | jmp project1.7FF697481A32 | FileName.cpp:43
00007FF697481A25 | 48:8D0D 34940000 | lea rcx,qword ptr ds:[<"Error: The score you entered is "…>] | FileName.cpp:46, 00007FF69748AE60:"Error: The score you entered is invalid, please input a number between 0 and 100.\\n"
00007FF697481A2C | E8 27F8FFFF | call project1.7FF697481258 |
00007FF697481A31 | 90 | nop |
00007FF697481A32 | 33C0 | xor eax,eax | FileName.cpp:49
00007FF697481A34 | 8BF8 | mov edi,eax | FileName.cpp:50
00007FF697481A36 | 48:8D4D E0 | lea rcx,qword ptr ss:[rbp-20] |
00007FF697481A3A | 48:8D15 BF920000 | lea rdx,qword ptr ds:[7FF69748AD00] | rdx:__enc$textbss$end+5A
00007FF697481A41 | E8 23F6FFFF | call project1.7FF697481069 |
00007FF697481A46 | 8BC7 | mov eax,edi |
00007FF697481A48 | 48:8B8D D8000000 | mov rcx,qword ptr ss:[rbp+D8] |
00007FF697481A4F | 48:33CD | xor rcx,rbp |
00007FF697481A52 | E8 2BF6FFFF | call project1.7FF697481082 |
00007FF697481A57 | 48:8DA5 E8000000 | lea rsp,qword ptr ss:[rbp+E8] | 栈平衡
00007FF697481A5E | 5F | pop rdi |
00007FF697481A5F | 5D | pop rbp |
00007FF697481A60 | C3 | ret |
x64Release版本
Release帮咱们优化了很多
00007FF68D0D10CF | CC | int3 |
00007FF68D0D10D0 | 48:83EC 38 | sub rsp,38 | FileName.cpp:5
00007FF68D0D10D4 | 48:8B05 251F0000 | mov rax,qword ptr ds:[<__security_cookie>] | rax:mainCRTStartup, 00007FF68D0D3000:"誩S紇_"
00007FF68D0D10DB | 48:33C4 | xor rax,rsp | rax:mainCRTStartup
00007FF68D0D10DE | 48:894424 28 | mov qword ptr ss:[rsp+28],rax | rax:mainCRTStartup
00007FF68D0D10E3 | 48:8D0D 16110000 | lea rcx,qword ptr ds:[<"Please enter your exam score (0-"…>] | FileName.cpp:8, 00007FF68D0D2200:"Please enter your exam score (0-100): "
00007FF68D0D10EA | E8 31FFFFFF | call <project1.printf> |
00007FF68D0D10EF | 48:8D5424 20 | lea rdx,qword ptr ss:[rsp+20] | FileName.cpp:9, rdx:mainCRTStartup,存放用户输入分数int变量
00007FF68D0D10F4 | 48:8D0D 2D110000 | lea rcx,qword ptr ds:[<"%d"…>] | 00007FF68D0D2228:"%d"
00007FF68D0D10FB | E8 80FFFFFF | call <project1.scanf> |
00007FF68D0D1100 | 8B4424 20 | mov eax,dword ptr ss:[rsp+20] | FileName.cpp:12
00007FF68D0D1104 | 83F8 64 | cmp eax,64 | 64:'d',if (score >= 90)
00007FF68D0D1107 | 77 5D | ja project1.7FF68D0D1166 |
00007FF68D0D1109 | 83F8 5A | cmp eax,5A | FileName.cpp:14, 5A:'Z'，else if (score >= 80)
00007FF68D0D110C | 7C 09 | jl project1.7FF68D0D1117 |
00007FF68D0D110E | 48:8D0D 1B110000 | lea rcx,qword ptr ds:[<"Grade: A (Excellent)\\n"…>] | FileName.cpp:16, 00007FF68D0D2230:"Grade: A (Excellent)\\n"
00007FF68D0D1115 | EB 56 | jmp project1.7FF68D0D116D | FileName.cpp:17
00007FF68D0D1117 | 83F8 50 | cmp eax,50 | FileName.cpp:18, 50:'P'，else if (score >= 70)
00007FF68D0D111A | 7C 09 | jl project1.7FF68D0D1125 |
00007FF68D0D111C | 48:8D0D 25110000 | lea rcx,qword ptr ds:[<"Grade: B (Good)\\n"…>] | FileName.cpp:20, 00007FF68D0D2248:"Grade: B (Good)\\n"
00007FF68D0D1123 | EB 48 | jmp project1.7FF68D0D116D | FileName.cpp:21
00007FF68D0D1125 | 83F8 46 | cmp eax,46 | FileName.cpp:22, 46:'F'，else if (score >= 60)
00007FF68D0D1128 | 7C 09 | jl project1.7FF68D0D1133 |
00007FF68D0D112A | 48:8D0D 2F110000 | lea rcx,qword ptr ds:[<"Grade: C (Medium)\\n"…>] | FileName.cpp:24, 00007FF68D0D2260:"Grade: C (Medium)\\n"
00007FF68D0D1131 | EB 3A | jmp project1.7FF68D0D116D | FileName.cpp:25
00007FF68D0D1133 | 83F8 3C | cmp eax,3C | FileName.cpp:26, 3C:'<'，else if (score >= 30)
00007FF68D0D1136 | 7C 09 | jl project1.7FF68D0D1141 |
00007FF68D0D1138 | 48:8D0D 39110000 | lea rcx,qword ptr ds:[<"Grade: D (Pass)\\n"…>] | FileName.cpp:28, 00007FF68D0D2278:"Grade: D (Pass)\\n"
00007FF68D0D113F | EB 2C | jmp project1.7FF68D0D116D | FileName.cpp:29
00007FF68D0D1141 | 48:8D0D 48110000 | lea rcx,qword ptr ds:[<"Grade: E (Fail)\\n"…>] | FileName.cpp:32, 00007FF68D0D2290:"Grade: E (Fail)\\n"
00007FF68D0D1148 | E8 D3FEFFFF | call <project1.printf> |
00007FF68D0D114D | 837C24 20 1E | cmp dword ptr ss:[rsp+20],1E | FileName.cpp:34
00007FF68D0D1152 | 48:8D0D 4F110000 | lea rcx,qword ptr ds:[<"Warning: poor performance, need "…>] | 00007FF68D0D22A8:"Warning: poor performance, need intensive review!\\n"
00007FF68D0D1159 | 48:8D05 80110000 | lea rax,qword ptr ds:[<"Tip: review can help you pass ne"…>] | rax:mainCRTStartup, 00007FF68D0D22E0:"Tip: review can help you pass next time.\\n"
00007FF68D0D1160 | 48:0F4DC8 | cmovge rcx,rax | rax:mainCRTStartup
00007FF68D0D1164 | EB 07 | jmp project1.7FF68D0D116D | FileName.cpp:43
00007FF68D0D1166 | 48:8D0D A3110000 | lea rcx,qword ptr ds:[<"Error: The score you entered is "…>] | FileName.cpp:46, 00007FF68D0D2310:"Error: The score you entered is invalid, please input a number between 0 and 100.\\n"
00007FF68D0D116D | E8 AEFEFFFF | call <project1.printf> | FileName.cpp:49
00007FF68D0D1172 | 33C0 | xor eax,eax |
00007FF68D0D1174 | 48:8B4C24 28 | mov rcx,qword ptr ss:[rsp+28] | FileName.cpp:50
00007FF68D0D1179 | 48:33CC | xor rcx,rsp |
00007FF68D0D117C | E8 1F000000 | call <project1.__security_check_cookie> |
00007FF68D0D1181 | 48:83C4 38 | add rsp,38 |
00007FF68D0D1185 | C3 | ret |
x86Debug版本
00551930 | 55 | push ebp | FileName.cpp:5
00551931 | 8BEC | mov ebp,esp |
00551933 | 81EC D0000000 | sub esp,D0 |
00551939 | 53 | push ebx |
0055193A | 56 | push esi | esi:__enc$textbss$end+37F
0055193B | 57 | push edi | edi:__enc$textbss$end+37F
0055193C | 8D7D F0 | lea edi,dword ptr ss:[ebp-10] | edi:__enc$textbss$end+37F
0055193F | B9 04000000 | mov ecx,4 | ecx:__enc$textbss$end+37F
00551944 | B8 CCCCCCCC | mov eax,CCCCCCCC |
00551949 | F3:AB | rep stosd |
0055194B | A1 00A05500 | mov eax,dword ptr ds:[<___security_cookie>] | 0055A000:"飲泓"
00551950 | 33C5 | xor eax,ebp |
00551952 | 8945 FC | mov dword ptr ss:[ebp-4],eax | [ebp-04]:BaseThreadInitThunk
00551955 | B9 08C05500 | mov ecx,<project1._14F49BB1_FileName@cpp> | FileName.cpp:15732480, ecx:__enc$textbss$end+37F
0055195A | E8 C1F9FFFF | call project1.551320 |
0055195F | 90 | nop |
00551960 | 68 307B5500 | push <project1."Please enter your exam score (0-"…> | FileName.cpp:8, 557B30:"Please enter your exam score (0-100): "
00551965 | E8 2FF9FFFF | call project1.551299 |
0055196A | 83C4 04 | add esp,4 |
0055196D | 8D45 F4 | lea eax,dword ptr ss:[ebp-C] | FileName.cpp:9, [ebp-0C]:BaseThreadInitThunk+19，接收用户输入的分数
00551970 | 50 | push eax |
00551971 | 68 607B5500 | push <project1."%d"…> | 557B60:"%d"
00551976 | E8 10F8FFFF | call project1.55118B |
0055197B | 83C4 08 | add esp,8 | 平栈
0055197E | 837D F4 00 | cmp dword ptr ss:[ebp-C],0 | FileName.cpp:12, [ebp-0C]:BaseThreadInitThunk+19，比较用户输入
00551982 | 0F8C 8F000000 | jl project1.551A17 | 是否小于0
00551988 | 837D F4 64 | cmp dword ptr ss:[ebp-C],64 | [ebp-0C]:BaseThreadInitThunk+19, 64:'d'，比较用户输入
0055198C | 0F8F 85000000 | jg project1.551A17 | 是否大于100
00551992 | 837D F4 5A | cmp dword ptr ss:[ebp-C],5A | FileName.cpp:14, [ebp-0C]:BaseThreadInitThunk+19, 5A:'Z'
00551996 | 7C 0F | jl project1.5519A7 |
00551998 | 68 647B5500 | push <project1."Grade: A (Excellent)\\n"…> | FileName.cpp:16, 557B64:"Grade: A (Excellent)\\n"
0055199D | E8 F7F8FFFF | call project1.551299 |
005519A2 | 83C4 04 | add esp,4 |
005519A5 | EB 6E | jmp project1.551A15 | FileName.cpp:17
005519A7 | 837D F4 50 | cmp dword ptr ss:[ebp-C],50 | FileName.cpp:18, [ebp-0C]:BaseThreadInitThunk+19, 50:'P'
005519AB | 7C 0F | jl project1.5519BC |
005519AD | 68 807B5500 | push <project1."Grade: B (Good)\\n"…> | FileName.cpp:20, 557B80:"Grade: B (Good)\\n"
005519B2 | E8 E2F8FFFF | call project1.551299 |
005519B7 | 83C4 04 | add esp,4 |
005519BA | EB 59 | jmp project1.551A15 | FileName.cpp:21
005519BC | 837D F4 46 | cmp dword ptr ss:[ebp-C],46 | FileName.cpp:22, [ebp-0C]:BaseThreadInitThunk+19, 46:'F'
005519C0 | 7C 0F | jl project1.5519D1 |
005519C2 | 68 947B5500 | push <project1."Grade: C (Medium)\\n"…> | FileName.cpp:24, 557B94:"Grade: C (Medium)\\n"
005519C7 | E8 CDF8FFFF | call project1.551299 |
005519CC | 83C4 04 | add esp,4 |
005519CF | EB 44 | jmp project1.551A15 | FileName.cpp:25
005519D1 | 837D F4 3C | cmp dword ptr ss:[ebp-C],3C | FileName.cpp:26, [ebp-0C]:BaseThreadInitThunk+19, 3C:'<'
005519D5 | 7C 0F | jl project1.5519E6 |
005519D7 | 68 AC7B5500 | push <project1."Grade: D (Pass)\\n"…> | FileName.cpp:28, 557BAC:"Grade: D (Pass)\\n"
005519DC | E8 B8F8FFFF | call project1.551299 |
005519E1 | 83C4 04 | add esp,4 |
005519E4 | EB 2F | jmp project1.551A15 | FileName.cpp:29
005519E6 | 68 C07B5500 | push <project1."Grade: E (Fail)\\n"…> | FileName.cpp:32, 557BC0:"Grade: E (Fail)\\n"
005519EB | E8 A9F8FFFF | call project1.551299 |
005519F0 | 83C4 04 | add esp,4 |
005519F3 | 837D F4 1E | cmp dword ptr ss:[ebp-C],1E | FileName.cpp:34, [ebp-0C]:BaseThreadInitThunk+19
005519F7 | 7D 0F | jge project1.551A08 |
005519F9 | 68 D47B5500 | push <project1."Warning: poor performance, need "…> | FileName.cpp:36, 557BD4:"Warning: poor performance, need intensive review!\\n"
005519FE | E8 96F8FFFF | call project1.551299 |
00551A03 | 83C4 04 | add esp,4 |
00551A06 | EB 0D | jmp project1.551A15 | FileName.cpp:37
00551A08 | 68 147C5500 | push <project1."Tip: review can help you pass ne"…> | FileName.cpp:40, 557C14:"Tip: review can help you pass next time.\\n"
00551A0D | E8 87F8FFFF | call project1.551299 |
00551A12 | 83C4 04 | add esp,4 |
00551A15 | EB 0D | jmp project1.551A24 | FileName.cpp:43
00551A17 | 68 487C5500 | push <project1."Error: The score you entered is "…> | FileName.cpp:46, 557C48:"Error: The score you entered is invalid, please input a number between 0 and 100.\\n"
00551A1C | E8 78F8FFFF | call project1.551299 |
00551A21 | 83C4 04 | add esp,4 |
00551A24 | 33C0 | xor eax,eax | FileName.cpp:49
00551A26 | 52 | push edx | FileName.cpp:50, edx:__enc$textbss$end+37F
00551A27 | 8BCD | mov ecx,ebp | ecx:__enc$textbss$end+37F
00551A29 | 50 | push eax |
00551A2A | 8D15 581A5500 | lea edx,dword ptr ds:[<>] | edx:__enc$textbss$end+37F
00551A30 | E8 32F8FFFF | call project1.551267 |
00551A35 | 58 | pop eax |
00551A36 | 5A | pop edx | edx:__enc$textbss$end+37F
00551A37 | 5F | pop edi | edi:__enc$textbss$end+37F
00551A38 | 5E | pop esi | esi:__enc$textbss$end+37F
00551A39 | 5B | pop ebx |
00551A3A | 8B4D FC | mov ecx,dword ptr ss:[ebp-4] | ecx:__enc$textbss$end+37F, [ebp-04]:BaseThreadInitThunk
00551A3D | 33CD | xor ecx,ebp | ecx:__enc$textbss$end+37F
00551A3F | E8 46F8FFFF | call project1.55128A |
00551A44 | 81C4 D0000000 | add esp,D0 |
00551A4A | 3BEC | cmp ebp,esp |
00551A4C | E8 F7F8FFFF | call project1.551348 |
00551A51 | 8BE5 | mov esp,ebp |
00551A53 | 5D | pop ebp |
00551A54 | C3 | ret |
x86Release版
Release帮咱们优化了很多，很清晰就不聊了
00911080 | 55 | push ebp | FileName.cpp:5
00911081 | 8BEC | mov ebp,esp |
00911083 | 83EC 08 | sub esp,8 |
00911086 | A1 00309100 | mov eax,dword ptr ds:[<___security_cookie>] | eax:"t鷖"
0091108B | 33C5 | xor eax,ebp |
0091108D | 8945 FC | mov dword ptr ss:[ebp-4],eax | [ebp-04]:BaseThreadInitThunk
00911090 | 68 E8209100 | push <project1."Please enter your exam score (0-"…> | FileName.cpp:8, 9120E8:"Please enter your exam score (0-100): "
00911095 | E8 86FFFFFF | call <project1._printf> |
0091109A | 8D45 F8 | lea eax,dword ptr ss:[ebp-8] | FileName.cpp:9
0091109D | 50 | push eax | eax:"t鷖"
0091109E | 68 10219100 | push <project1."%d"…> | 912110:"%d"
009110A3 | E8 A8FFFFFF | call <project1._scanf> |
009110A8 | 8B45 F8 | mov eax,dword ptr ss:[ebp-8] | FileName.cpp:12
009110AB | 83C4 0C | add esp,C |
009110AE | 83F8 64 | cmp eax,64 | eax:"t鷖", 64:'d'
009110B1 | 77 50 | ja project1.911103 |
009110B3 | 83F8 5A | cmp eax,5A | FileName.cpp:14, eax:"t鷖", 5A:'Z'
009110B6 | 7C 07 | jl project1.9110BF |
009110B8 | B8 14219100 | mov eax,<project1."Grade: A (Excellent)\\n"…> | FileName.cpp:16, eax:"t鷖", 912114:"Grade: A (Excellent)\\n"
009110BD | EB 49 | jmp project1.911108 | FileName.cpp:17
009110BF | 83F8 50 | cmp eax,50 | FileName.cpp:18, eax:"t鷖", 50:'P'
009110C2 | 7C 07 | jl project1.9110CB |
009110C4 | B8 2C219100 | mov eax,<project1."Grade: B (Good)\\n"…> | FileName.cpp:20, eax:"t鷖", 91212C:"Grade: B (Good)\\n"
009110C9 | EB 3D | jmp project1.911108 | FileName.cpp:21
009110CB | 83F8 46 | cmp eax,46 | FileName.cpp:22, eax:"t鷖", 46:'F'
009110CE | 7C 07 | jl project1.9110D7 |
009110D0 | B8 40219100 | mov eax,<project1."Grade: C (Medium)\\n"…> | FileName.cpp:24, eax:"t鷖", 912140:"Grade: C (Medium)\\n"
009110D5 | EB 31 | jmp project1.911108 | FileName.cpp:25
009110D7 | 83F8 3C | cmp eax,3C | FileName.cpp:26, eax:"t鷖", 3C:'<'
009110DA | 7C 07 | jl project1.9110E3 |
009110DC | B8 54219100 | mov eax,<project1."Grade: D (Pass)\\n"…> | FileName.cpp:28, eax:"t鷖", 912154:"Grade: D (Pass)\\n"
009110E1 | EB 25 | jmp project1.911108 | FileName.cpp:29
009110E3 | 68 68219100 | push <project1."Grade: E (Fail)\\n"…> | FileName.cpp:32, 912168:"Grade: E (Fail)\\n"
009110E8 | E8 33FFFFFF | call <project1._printf> |
009110ED | 83C4 04 | add esp,4 |
009110F0 | B8 7C219100 | mov eax,<project1."Warning: poor performance, need "…> | FileName.cpp:34, eax:"t鷖", 91217C:"Warning: poor performance, need intensive review!\\n"
009110F5 | 837D F8 1E | cmp dword ptr ss:[ebp-8],1E |
009110F9 | B9 B0219100 | mov ecx,<project1."Tip: review can help you pass ne"…> | ecx:_mainCRTStartup, 9121B0:"Tip: review can help you pass next time.\\n"
009110FE | 0F4DC1 | cmovge eax,ecx | eax:"t鷖", ecx:_mainCRTStartup
00911101 | EB 05 | jmp project1.911108 | FileName.cpp:43
00911103 | B8 E0219100 | mov eax,<project1."Error: The score you entered is "…> | FileName.cpp:46, eax:"t鷖", 9121E0:"Error: The score you entered is invalid, please input a number between 0 and 100.\\n"
00911108 | 50 | push eax | FileName.cpp:49, eax:"t鷖"
00911109 | E8 12FFFFFF | call <project1._printf> |
0091110E | 8B4D FC | mov ecx,dword ptr ss:[ebp-4] | FileName.cpp:50, ecx:_mainCRTStartup, [ebp-04]:BaseThreadInitThunk
00911111 | 83C4 04 | add esp,4 |
00911114 | 33CD | xor ecx,ebp | ecx:_mainCRTStartup
00911116 | 33C0 | xor eax,eax | eax:"t鷖"
00911118 | E8 13000000 | call <project1.@__security_check_cookie@4> |
0091111D | 8BE5 | mov esp,ebp |
0091111F | 5D | pop ebp |
00911120 | C3 | ret |
评论前必须登录！
注册