exeinfo如何查找字符串？
exeinfo好像没有字符串查看功能哦？
peid的stringview.dll插件有源代码嘛？
我od了下，完全看不懂，有人看懂可以给我说下他的算法好吗
1000115F/$55 push ebp
10001160|.8DAC24 60FFFF>lea ebp, dword ptr
10001167|.81EC 20010000 sub esp, 0x120
1000116D|.A1 70920010 mov eax, dword ptr
10001172|.56 push esi
10001173|.33F6 xor esi, esi
10001175|.6A 04 push 0x4
10001177|.8985 9C000000 mov dword ptr , eax
1000117D|.8B85 B0000000 mov eax, dword ptr
10001183|.56 push esi
10001184|.50 push eax
10001185|.8945 84 mov dword ptr , eax
10001188|.8975 88 mov dword ptr , esi
1000118B|.8975 8C mov dword ptr , esi
1000118E|.E8 4D060000 call StringVi.100017E0
10001193|.83C4 0C add esp, 0xC
10001196|.39B5 B4000000 cmp dword ptr , esi
1000119C|.0F8C C5000000 jl StringVi.10001267
100011A2|.8B35 0C710010 mov esi, dword ptr [<&USER32.SendDlg>;user32.SendDlgItemMessageA
100011A8|.53 push ebx
100011A9|.57 push edi
100011AA|.BB 2D100000 mov ebx, 0x102D
100011AF|.BF E9030000 mov edi, 0x3E9
100011B4|>8325 0C990010>/and dword ptr , 0x0
100011BB|.68 04990010 |push StringVi.10009904
100011C0|.FF75 8C |push dword ptr
100011C3|.8D85 90000000 |lea eax, dword ptr
100011C9|.53 |push ebx
100011CA|.57 |push edi
100011CB|.FFB5 A8000000 |push dword ptr
100011D1|.C705 1C990010>|mov dword ptr , 0x9
100011DB|.A3 18990010 |mov dword ptr , eax
100011E0|.FFD6 |call esi
100011E2|.68 04990010 |push StringVi.10009904
100011E7|.FF75 8C |push dword ptr
100011EA|.8D45 90 |lea eax, dword ptr
100011ED|.53 |push ebx
100011EE|.57 |push edi
100011EF|.FFB5 A8000000 |push dword ptr
100011F5|.C705 0C990010>|mov dword ptr , 0x1
100011FF|.C705 1C990010>|mov dword ptr , 0x100
10001209|.A3 18990010 |mov dword ptr , eax
1000120E|.FFD6 |call esi
10001210|.8D45 90 |lea eax, dword ptr
10001213|.50 |push eax
10001214|.8D85 90000000 |lea eax, dword ptr
1000121A|.50 |push eax
1000121B|.68 48710010 |push StringVi.10007148 ;%s: %s\r\n
10001220|.FF75 84 |push dword ptr
10001223|.E8 59050000 |call StringVi.10001781
10001228|.8D45 90 |lea eax, dword ptr
1000122B|.50 |push eax
1000122C|.E8 4F060000 |call StringVi.10001880
10001231|.8B4D 84 |mov ecx, dword ptr
10001234|.8D4401 0C |lea eax, dword ptr
10001238|.8945 84 |mov dword ptr , eax
1000123B|.8D45 90 |lea eax, dword ptr
1000123E|.50 |push eax
1000123F|.E8 3C060000 |call StringVi.10001880
10001244|.8B4D 88 |mov ecx, dword ptr
10001247|.83C4 18 |add esp, 0x18
1000124A|.FF45 8C |inc dword ptr
1000124D|.8D4401 0C |lea eax, dword ptr
10001251|.8945 88 |mov dword ptr , eax
10001254|.8B45 8C |mov eax, dword ptr
10001257|.3B85 B4000000 |cmp eax, dword ptr
1000125D|.^ 0F8E 51FFFFFF \jle StringVi.100011B4
10001263|.5F pop edi
10001264|.33F6 xor esi, esi
10001266|.5B pop ebx
10001267|>56 push esi ; /pOverlapped
10001268|.8D45 80 lea eax, dword ptr ; |
1000126B|.50 push eax ; |pBytesWritten
1000126C|.8B45 88 mov eax, dword ptr ; |
1000126F|.83C0 FE add eax, -0x2 ; |
10001272|.50 push eax ; |nBytesToWrite
10001273|.FFB5 B0000000 push dword ptr ; |Buffer
10001279|.FFB5 AC000000 push dword ptr ; |hFile
1000127F|.FF15 0C700010 call dword ptr [<&KERNEL32.WriteFile>>; \WriteFile
这是第一个call里的内容
100017E0/$8B5424 0C mov edx, dword ptr
100017E4|.8B4C24 04 mov ecx, dword ptr
100017E8|.85D2 test edx, edx
100017EA|.74 4F je short StringVi.1000183B
100017EC|.33C0 xor eax, eax
100017EE|.8A4424 08 mov al, byte ptr
100017F2|.57 push edi
100017F3|.8BF9 mov edi, ecx
100017F5|.83FA 04 cmp edx, 0x4
100017F8|.72 31 jb short StringVi.1000182B
100017FA|.F7D9 neg ecx
100017FC|.83E1 03 and ecx, 0x3
100017FF|.74 0C je short StringVi.1000180D
10001801|.2BD1 sub edx, ecx
10001803|>8807 /mov byte ptr , al
10001805|.83C7 01 |add edi, 0x1
10001808|.83E9 01 |sub ecx, 0x1
1000180B|.^ 75 F6 \jnz short StringVi.10001803
1000180D|>8BC8 mov ecx, eax
1000180F|.C1E0 08 shl eax, 0x8
10001812|.03C1 add eax, ecx
10001814|.8BC8 mov ecx, eax
10001816|.C1E0 10 shl eax, 0x10
10001819|.03C1 add eax, ecx
1000181B|.8BCA mov ecx, edx
1000181D|.83E2 03 and edx, 0x3
10001820|.C1E9 02 shr ecx, 0x2
10001823|.74 06 je short StringVi.1000182B
10001825|.F3:AB rep stos dword ptr es:
10001827|.85D2 test edx, edx
10001829|.74 0A je short StringVi.10001835
1000182B|>8807 /mov byte ptr , al
1000182D|.83C7 01 |add edi, 0x1
10001830|.83EA 01 |sub edx, 0x1
10001833|.^ 75 F6 \jnz short StringVi.1000182B
10001835|>8B4424 08 mov eax, dword ptr
10001839|.5F pop edi
1000183A|.C3 retn
1000183B|>8B4424 04 mov eax, dword ptr
1000183F\.C3 retn
页:
[1]